Making way through DLL hollowing in spite of CFG by Debjeet Banerjee at Null/OWASP Kolkata Chapter Combined Monthly Meetup on 20th April

1. Debjeet Banerjee
Researcher @ BHIS
Making way through DLL Hollowing in spite of CFG

2. @whoami
Security Intern
Payatu
Security Research
Intern
FireCompass
Security Consultant
Certus Cybersecurity
Security Researcher
BlackHills Infosec

3. Overview 🔎
● DLL Hollowing
● What is CFG
● Problems posed by CFG
● Dynamically finding
Targets
● Control Flow
● VirusTotal Analysis

4. DLL Hollowing
DLL hollowing is a form of process injection, which is when an
attacker inserts malicious code into known benign software.
With DLL hollowing, the attacker can insert the code into the
current process or into a remote process's memory space by
loading a new DLL and overwriting sections of its code. The
goal of the attacker is to hide from causal analysis. When
looking for quick wins, researchers or Incident Response
analysts will look for any process or executable that does not
look normal. In most use cases, the process and the DLL are
both benign. Looking at the file system of the EXE and DLL will
show nothing out of the ordinary.
@TRUSTEDSEC

5. What is CFG?
Control Flow Guard (CFG) is a highly-optimized platform security feature that was
created to combat memory corruption vulnerabilities. By placing tight restrictions
on where an application can execute code from, it makes it much harder for
exploits to execute arbitrary code through vulnerabilities such as buffer overflows.
dumpbin /headers /loadconfig
C:WindowsSystem32ntdll.dll

6. Problems posed by CFG
The compiler does the following:
● Adds lightweight security checks to the compiled code.
● Identifies the set of functions in the application that are valid
targets for indirect calls.
The runtime support, provided by the Windows kernel:
● Efficiently maintains state that identifies valid indirect call
targets.
● Implements the logic that verifies that an indirect call target is
valid.
When a CFG check fails at runtime, Windows immediately terminates
the program, thus breaking any exploit that attempts to indirectly call
an invalid address.
https://learn.microsoft.com/en-us/windows/win32/secbp/control-flow-guard

7. Dynamically
Finding Targets
Long live Powershell v1 and other Non CFG DLLs

8. Finding Target DLLs
To use a DLL for this technique, a DLL must meet the following requirements:
● DLL must NOT already be loaded in memory
● DLL MUST HAVE a .text section
● DLL must NOT have CFG enabled
* The most common example of these types of DLLs which I could find were
the modules from Powershell v1 DLLs, Media Player DLLs and VirtualBox
DLLs.

9. DLL already loaded in memory?

10. Control Flow

11. Jmp’ing To Shellcode
AddJmp(LPVOID jmp_tgt, LPVOID src) {
size_t inst_size = 12 * sizeof(unsigned
char);
unsigned char* inst = malloc(inst_size);
RtlZeroMemory(inst, 12 * sizeof(unsigned
char));
inst[0] = 0x48;
inst[1] = 0xb8;
inst[10] = 0xff;
inst[11] = 0xd0;
int i = 2;
uintptr_t bytes = (uintptr_t)(jmp_tgt);
while (i < 10) {
inst[i] = bytes & 0xFF;
bytes = bytes >> 8;
i++;
}
AllocatePayload(src, inst, inst_size);
}

12. Show And Tell

13. Show And Tell

14. Process
Hacker’s POV

15. VirusTotal Analysis
“It works” - Source: Trust Me.

16. Direct Call to Shellcode
Jmp’ing to Shellcode

17. @whokilleddb
Debjeet Banerjee
twt: @whokilleddb