DLL Injection with C
Let’s begin by generating our DLL with msfvenom,
saving the file to our web root.
Before returning to Windows, we’ll start our listener.
To implement the DLL injection technique,
we are going to create a new C# solution
with a .NET Standard Console app
that will fetch our DLL from the attacker’s web server.
We’ll then write the DLL to disk
since LoadLibrary only accepts files present on disk.
Next, we’ll resolve the process ID of explorer.exe
and pass it to OpenProcess.
For the next step, we’ll use VirtualAllocEx to allocate memory
in the remote process that is readable and writable
and then use WriteProcessMemory
to copy the path and name of the DLL into it.
Next, we’ll resolve the memory address of LoadLibray
inside the remote process.
Luckily, most native Windows DLLs are allocated
at the same base address across processes,
so the address of LoadLibrary in our current process
will be the same as in the remote.
To locate its address, we’ll use the combination
of GetModuleHandle
and GetProcAddress to resolve it
and add the associated DllImport statements:
Finally, we can invoke CreateRemoteThread,
this time supplying both a starting address and an argument address.
When we compile…
…and execute the completed code…
…it fetches the Meterpreter DLL from the web server
and gives us a reverse shell.
We can display all the loaded DLLs in the processes with Process Explorer.
We’ll select the explorer.exe process…
…navigate to View
> Lower Pane View
and select DLLs.
Scrolling down…
…we find met.dll as expected.
By reusing the techniques from process injection,
we are able to load an unmanaged DLL
into a remote process.
Unfortunately, this technique does write the DLL to disk.
In the next section, we’ll address this.