https://github.com/sailay1996/WerTrigger

Weaponizing for privileged file writes bugs with windows problem reporting
https://github.com/sailay1996/WerTrigger

dll-hijacking windows-exploitation windows-privilege-escalation

Last synced: 21 days ago
JSON representation

Weaponizing for privileged file writes bugs with windows problem reporting

• Host: GitHub
• URL: https://github.com/sailay1996/WerTrigger
• Owner: sailay1996
• Created: 2020-05-20T11:27:56.000Z (over 4 years ago)
• Default Branch: master
• Last Pushed: 2022-05-10T17:36:49.000Z (over 2 years ago)
• Last Synced: 2024-08-05T17:24:45.862Z (4 months ago)
• Topics: dll-hijacking, windows-exploitation, windows-privilege-escalation
• Language: C++
• Size: 199 KB
• Stars: 205
• Watchers: 4
• Forks: 35
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - sailay1996/WerTrigger - Weaponizing for privileged file writes bugs with windows problem reporting (C++)

README

        
# WerTrigger

Weaponizing for privileged file writes bugs with windows problem reporting

#### Short Description:

I've found phoneinfo.dll (which is missing in system32 dir) has been loaded by wermgr.exe (windows problem reporting) when I enable boot logging in Procmon. It mean, `phoneinfo.dll` is loaded after reboot. Then, I asked to [@jonasLyk](https://twitter.com/jonasLyk) that can I trigger to load `phoneinfo.dll` without reboot and he said "yes!". And then, This trigger was happened.  

#### *Note:*

*you can also use [@it4man](https://twitter.com/itm4n)'s  [UsoDllLoader](https://github.com/itm4n/UsoDllLoader) as a weapon for privileged file writes bugs and also there's another techniques at here [FileWrite2system](https://github.com/sailay1996/awesome_windows_logical_bugs/blob/master/FileWrite2system.txt)*

#### For testing purposes:

1. **As an administrator**, copy `phoneinfo.dll` to `C:\Windows\System32\`

2. Place `Report.wer` file and `WerTrigger.exe` in a same directory.

3. Then, run `WerTrigger.exe`.

4. Enjoy a shell as NT AUTHORITY\SYSTEM.

![test1](https://github.com/sailay1996/WerTrigger/blob/master/werTrigger.jpg)

*by [@404death](https://twitter.com/404death)*

*Thanks to: [@jonasLyk](https://twitter.com/jonasLyk) for giving advice which is `without reboot technique`*