perfect dll proxy

完美的DLL代理

不久前，我需要一个代理来执行DLL劫持，但是我不喜欢现有解决方案如何生成ASM存根来处理转发。事实证明，有一个窍门可以向前迈进，可以使用绝对路径：

# pragma comment(linker,
" /EXPORT:CredPackAuthenticationBufferA= \\ . \ GLOBALROOT \ SystemRoot \ System32 \ credui.dll.CredPackAuthenticationBufferA "
)

有关更多信息，请参见参考。

要自动生成一个DLL，该DLL导出所有内容并加载任意DLL（无拦截功能），请查看以下项目：https：//github.com/namazso/dll-proxy-generator

用法

python -m pip install pefile
python perfect-dll-proxy.py credui.dll

参考

• https://nibblestew.blogspot.com/2019/05/
• https://googleprojectzero.blogspot.com/2016/02/the-definistive-guide-on-win32-to-nt.html
• https://learn.microsoft.com/en-us/cpp/build/reference/export-export-ports-a-function
• https://devblogs.microsoft.com/oldnewthing/2012116-00/?p=6073
• https://medium.com/@lsecqt/weaponizing-dll-hijacking-via-dll-proxying-3983a8249de0
• https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dll-hijacking
• https://www.ired.team/offvision-security/persistence/dll-proxying-for-persistence
• https://github.com/flangvik/sharpdllproxy
• https://github.com/hfiref0x/winobjex64