Skip to content

Commit

Permalink
Modified hid.yml to reflect Phantom DLL Hijack via service (#55)
Browse files Browse the repository at this point in the history 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
  • Loading branch information
@v1stra @wietze
v1stra and wietze authored Jul 26, 2023
1 parent 74ee4bc commit b79492d
Showing 1 changed file with 9 additions and 0 deletions.
9 changes: 9 additions & 0 deletions yml/microsoft/built-in/hid.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,17 @@ VulnerableExecutables:
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Type: Catalog
- Path: '%SYSTEM32%\PerceptionSimulation\PerceptionSimulationService.exe'
Type: Phantom
ExpectedSignatureInformation:
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Type: Catalog
Resources:
- https://wietze.github.io/blog/hijacking-dlls-in-windows
- https://github.com/netero1010/ServiceMove-BOF
Acknowledgements:
- Name: Wietze
Twitter: '@wietze'
- Name: v1stra
Twitter: '@_v1stra'

2 comments on commit b79492d

@v1stra
Copy link
Contributor Author

@v1stra v1stra commented on b79492d Jul 30, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I figured this would be a search order hijack, considering the hid.dll resides in C:\Windows\System32, the service just checks its working directory first

@wietze
Copy link
Owner

@wietze wietze commented on b79492d Jul 30, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah thanks for following up on this, I was fooled by the "a non-existing DLL file will be loaded" in the article. I should have guessed, based on the fact that hid.yml already existed, that it is trying to load an existing DLL.

Will fix this now.

Please sign in to comment.