Tag Archive for: DLL

New Malicious PyPI Packages Uses DLL Sideloading

/in


Researchers have discovered that threat actors have been using open-source platforms and codes for several purposes, such as hosting C2 infrastructure, storing stolen data, and delivering second and third-stage downloaders or rootkit programs.

Two open-source PyPI packages were discovered to be utilized by threat actors for executing code via DLL sideloading attacks as a means of evading security monitoring tools.

The packages were identified as NP6HelperHttptest and NP6HelperHttper. 

Malicious PyPI Packages

According to the reports shared with Cyber Security News, open-source ecosystems are most widely used by almost every developer, which does not have a reputation provider to assess the quality and reliability of the code.

Thus making it extremely simple and easier for threat actors to insert malicious codes into the repositories and perform supply chain attacks.

In addition to this, researchers discovered two attack types that are used in software supply chain attacks, namely typosquatting and repojacking.

The two malicious PyPI packages were involved in the Typosquatting attacks as the package names are identical to one of the legitimate NP6 packages.

Malware infection stages (Source: Reversing Labs)

Developers mostly ignore the spelling and consider the packages legitimate, proceeding to use them in development.

Once this is done, threat actors can pivot their ways into the organizations and perform malicious activities.

Malicious Script Abusing DLL Sideloading

Both of the malicious PyPI packages consisted of a setup.py script that extends the setup tools command for downloading two other files: Comserver.exe and dgdeskband64.dll.

Comserver.exe is a legitimate file signed with a valid certificate from Beijing-based Kingsoft Corp, while dgdeskband64.dll is a malicious file that downloads further and runs a second-stage payload.

Setup.py file (Source: Reversing Labs)

The Comserver.exe has the purpose of loading a library, dgdeskband64.dll, for invoking its exported function Dllinstall.

However, the dgdeskband64.dll malicious file inside the package is not the legitimate one expected from comserver.exe. 

Different exports for the legit and malicious dll (Source:…

Source…

Hunting for Windows “Features” with Frida: DLL Sideloading

/in


Offensive security professionals have been using Frida for analyzing iOS and Android mobile applications. However, there has been minimal usage of Frida for desktop operating systems such as Windows. Frida is described by the author as a “Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.” From a security research and adversarial simulation perspective, Frida can be used to identify MITRE ATT&CK technique T1574.002 also known as dynamic-link library (DLL) sideloading. Frida is not limited to identifying DLL sideloading. It can also identify MITRE ATT&CK technique T1546.015 also known as Component Object Model (COM) hijacking. This blog post will review DLL sideloading, and how attackers and offensive security professionals can identify potential DLL sideloading opportunities using X-Force Red’s proof-of-concept Frida tool Windows Feature Hunter (WFH).

What Is DLL Sideloading?

MITRE ATT&CK describes DLL sideloading in T1574.002 as follows:

Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking, side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).

MITRE ATT&CK goes on to say that “side-loading takes advantage of the DLL search order used by the loader by positioning both the victim application and malicious payload(s) alongside each other.”

Microsoft also wrote a blog post where they define what is considered a vulnerability, saying that CWD scenarios would be addressed with a security fix, while PATH directory scenarios would not, “since there can’t be a non-admin directory in the PATH, [it] can’t be exploited.”

Windows DLL Search Order

Microsoft details DLL search order in this post. The post describes DLL search order, as shown in the excerpt below:

A system can contain multiple versions of the same dynamic-link library (DLL). Applications can control the location…

Source…