{"id":13508520,"url":"https://github.com/knight0x07/ImpulsiveDLLHijack","last_synced_at":"2025-03-30T11:32:05.442Z","repository":{"id":44330194,"uuid":"403957794","full_name":"knight0x07/ImpulsiveDLLHijack","owner":"knight0x07","description":"C# based tool which automates the process of discovering and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during Red Team Operations to evade EDR's.","archived":false,"fork":false,"pushed_at":"2021-09-15T08:03:59.000Z","size":2205,"stargazers_count":495,"open_issues_count":5,"forks_count":98,"subscribers_count":11,"default_branch":"main","last_synced_at":"2024-11-01T08:33:21.700Z","etag":null,"topics":["cybersecurity","dll-hijacking","redteam","redteam-tools"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/knight0x07.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-09-07T11:48:03.000Z","updated_at":"2024-10-28T04:01:51.000Z","dependencies_parsed_at":"2022-07-24T23:31:58.388Z","dependency_job_id":null,"html_url":"https://github.com/knight0x07/ImpulsiveDLLHijack","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/knight0x07%2FImpulsiveDLLHijack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/knight0x07%2FImpulsiveDLLHijack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/knight0x07%2FImpulsiveDLLHijack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/knight0x07%2FImpulsiveDLLHijack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/knight0x07","download_url":"https://codeload.github.com/knight0x07/ImpulsiveDLLHijack/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246314011,"owners_count":20757450,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cybersecurity","dll-hijacking","redteam","redteam-tools"],"created_at":"2024-08-01T02:00:54.274Z","updated_at":"2025-03-30T11:32:00.434Z","avatar_url":"https://github.com/knight0x07.png","language":"C#","funding_links":[],"categories":["C#","C# #","redteam"],"sub_categories":[],"readme":"# ImpulsiveDLLHijack\n\nC# based tool which automates the process of discovering and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during RedTeam Operations to evade EDR's.\n\n# 1. Methodological Approach :\n\nThe tool basically acts on automating following stages performed for DLL Hijacking:\n\n- **Discovery** - Finding Potentially Vulnerable DLL Hijack paths\n- **Exploitation** - Confirming whether the Confirmatory DLL was been loaded from the Hijacked path leading to a confirmation of 100% exploitable DLL Hijack!\n\n**Discovery Methodology :**\n\n- Provide Target binary path to ImpulsiveDLLHijack.exe\n- Automation of ProcMon along with the execution of Target binary to find Potentially Vulnerable DLL Hijackable paths.\n\n**Exploitation Methodology :**\n\n- Parse Potentially Vulnerable DLL Hijack paths from CSV generated automatically via ProcMon.\n- Copy the Confirmatory DLL (as per the PE architecture) to the hijack paths one by one and execute the Target Binary for predefined time period simultaneously.\n- As the DLL hijacking process is in progress following are the outputs which can be gathered from the Hijack Scenario:\n\t* The Confirmatory DLL present on the potentially vulnerable Hijackable Path is loaded by the Target Binary we get following output on the console stating that the DLL Hijack was successful - **DLL Hijack Successful -\u003e DLLName: \u003cDLLname\u003e | \u003cTarget_binary_name\u003e**\n\t* The Confirmatory DLL present on the potentially vulnerable Hijackable Path is not loaded by the Target Binary we get following output on the console stating that the DLL Hijack was unsuccessful - **DLL Hijack Unsuccessful -\u003e \u003cDLL_Path\u003e**\n\n\t**Entry Point Not Found Scenarios:**\n\n\t-  The Confirmatory DLL present on the potentially vulnerable Hijackable Path is not loaded by the Target Binary as the Entry Point of the DLL is \t\t\t\t   different from our default entry point \"DllMain\" throwing an error - \"Entry Point Not Found\", we get following output on the console stating that the                              DLL Hijack was hijackable if the entry point was correct -\u003e **DLL Hijack Successful -\u003e [Entry Point Not Found - Manual Analysis Required!]: \u003cHijack_path\u003e**\n\t- The Confirmatory DLL present on the potentially vulnerable Hijackable Path is executed by the Target Binary even after the Entry Point of the DLL is \t\t    different from our default entry point \"DllMain\" throwing an error \"Entry Point Not Found\", we get following output on the console stating that the DLL Hijack was success even after the entry point was not correct -\u003e **DLL Hijack Successful -\u003e [Entry Point Not Found]: \u003cHijack_path\u003e**\n\n**Note: The \"Entry Point not found\" Error is been handled by the code programmatically no need to close the MsgBox manually :) # Rather this would crash the code further******\n\n- Once the DLL Hijacking process is completed for every Potentially Vulnerable DLL Hijack path we get the final output on the console as well as in a text file (C:\\DLLLogs\\output_logs.txt) in the following format:\n\n\t- \u003cDLLHijack_path\u003e --\u003e DLL Hijack Successful (**if the Hijack was successful**)\n\t- \u003cDLLHijack_path\u003e --\u003e DLL Hijack Unuccessful (**if the Hijack was unsuccessful**)\n\t- \u003cDLLHijack_path\u003e --\u003e DLL Hijack Successful [Entry Point Not Found - Manual Analysis Required] (**if the Entry point was not found but can be successful after manual analysis**)\n\t- \u003cDLLHijack_path\u003e --\u003e DLL Hijack Successful [Entry Point Not Found] (**if the hijack was successful even after the entry point was not found**)\n\t- \u003cDLLHijack_path\u003e --\u003e Copy: Access to Path is Denied (**Access denied**)\n\n**These Confirmed DLL Hijackable paths can later be weaponized during a Red Team Engagement to load a Malicious DLL Implant via a legitimate executable (such as OneDrive,Firefox,MSEdge,\"Bring your own LOLBINs\" etc.) and bypass State of the art EDR's as most of them fail to detect DLL Hijacking as assessed by George Karantzas and Constantinos Patsakis as mentioned in there research paper: https://arxiv.org/abs/2108.10422\n\n\n\t\t\n# 2. Prerequisites:\n\n- **Procmon.exe**  -\u003e https://docs.microsoft.com/en-us/sysinternals/downloads/procmon\n- **Custom Confirmatory DLL's** :\n\t- These are DLL files which assist the tool to get the confirmation whether the DLL's are been successfully loaded from the identified hijack path \n\t- Compiled from the MalDLL project provided above (or use the precompiled binaries if you trust me!)\n\t- 32Bit dll name should be: maldll32.dll\n\t- 64Bit dll name should be: maldll64.dll\n\t- Install NuGet Package:** PeNet** -\u003e https://www.nuget.org/packages/PeNet/ (Prereq while compiling the ImpulsiveDLLHijack project)\n\n**Note: i \u0026 ii prerequisites should be placed in the ImpulsiveDLLHijacks.exe's directory itself.**\n\n- **Build and Setup Information:**\n\n\t- **ImpulsiveDLLHijack**\n\n\t\t- Clone the repository in Visual Studio\n\t\t- Once project is loaded in Visual Studio go to \"Project\" --\u003e \"Manage NuGet packages\"  --\u003e Browse for packages and install \"PeNet\" -\u003e https://www.nuget.org/packages/PeNet/\n\t\t- Build the project!\n\t\t- The ImpulsiveDLLHijack.exe will be inside the bin directory.\n\n\t- **And for Confirmatory DLL's:**\n\n\t\t- Clone the repository in Visual Studio\n\t\t- Build the project with x86 and x64\n\t\t- Rename x86 release as maldll32.dll and x64 release as maldll64.dll\n\n\t- **Setup:** Copy the Confirmatory DLL's (maldll32 \u0026 maldll64) in the ImpulsiveDLLHijack.exe directory \u0026 then execute ImpulsiveDLLHijack.exe :))\n\n# 3. Usage:\n\n![usage](https://user-images.githubusercontent.com/60843949/132341238-c6e0cad4-dfc1-4d8e-a011-73df17b652d6.PNG)\n\n# 4. Examples:\n\n- Target Executable: OneDrive.exe\n\n- Stage: Discovery\n\n![first](https://user-images.githubusercontent.com/60843949/132492019-6dbb30aa-658f-4642-b9bd-69036d2d081a.PNG)\n\n- Stage: Exploitation\n\n\t- Successful DLL Hijacks:\n\n\t![success_one](https://user-images.githubusercontent.com/60843949/132493144-78072724-c2c0-4390-b761-7bfb9abfcb5b.PNG)\n\n\t- Unsuccessful DLL Hijacks:\n\n\t![unsuccessful](https://user-images.githubusercontent.com/60843949/132493860-d9df5fff-6cbc-4785-88a2-92d27cf128e2.PNG)\n\n\t- DLL is not loaded as the entry point is not identical! Manual Analysis might make it a successful DLL Hijack :)\n\n\t![entrypoint_not_found](https://user-images.githubusercontent.com/60843949/132494965-9d3b302b-360c-48b1-b2a4-ec950fddd893.PNG)\n\n\t- DLL Hijack successful even after unidentical entry point!\n\n\t![entry_pointnot found - but dll is executed](https://user-images.githubusercontent.com/60843949/132639672-b14aa124-2927-44b0-90b9-7e1f9497afd5.PNG)\n\n\n- Stage: Final Results and Logs\n\n\t- C:\\DLLLogs\\output_logs.txt:\n\n\t![output_logs](https://user-images.githubusercontent.com/60843949/132496859-808bb809-9230-4aee-afef-fe71ef03e8b5.PNG)\n\n\n**Thankyou, Feedback would be greatly appreciated!** - knight!\n\n\n\n\n\n\n\n\t\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknight0x07%2FImpulsiveDLLHijack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fknight0x07%2FImpulsiveDLLHijack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknight0x07%2FImpulsiveDLLHijack/lists"}