Skip to content

mekrina/tools-dllhijacking

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

修改自:https://github.com/tothi/dll-hijack-by-proxying.git

step:

copy target dll to this dir gen def file by python script use i686-w64-mingw32-gcc(32 bits)/x86_64-w64-mingw32-gcc(64 bits) to compile the dllmain.c with the def file for example: x86_64-w64-mingw32-gcc -shared -o target.dll dllmain.c proxy.def -s cp or upload the generated dll (malicious) and the original dll (to make the app run normally) to the app dir which exe file exists

run the exe file

pwn!!

原理: 使用pefile这个python库分析原来的dll文件,看它提供了哪些函数,再据此生成def文件定义这些函数,让他们转发到原来的dll文件,从而保持原有功能不变 (这就要求原来的dll也要能够被找到)

dllmain函数定义了恶意逻辑,当dll文件被加载时执行恶意命令。

Q: 为什么不直接反编译原dll,然后改写dllmain添加恶意逻辑? A: 反编译困难

About

windows恶意dll构建工具,实现dll劫持

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

 
 
 

Contributors