DLL-Sideload-Loader

---

Download / Install

Major Dependencies:

1. dumpbin.exe must be installed from Microsof Build Tools then check the box for "✔ Desktop development with C++"

2. rust compiler off the Official Rust Download

3. g++ compiler from Official MinGW Download

4. install Python Interpreter

Setup

1. Clone the repo
   git clone github.com/that-dog-eater/DLL-Sideload-Loader

Config / Guide / Use

• Add third party exes to "exes" folder
• add a singal rust payload file to "rust_payload" folder that exports a function called dll_inject_code()
• run start.ps1 to start the script
• "output" folder will contain the dll sideloaded exes with the payload attached for each dll that is vulnerable

Important

1. Do not include System Exes since they will fail
   
2. Script will output a log file called sideload.json

---

Code Breakdown / How it works

Overview

This script tests third party exe's for dll sideloading by running it through scan.py first witch adds them to a temp folder and injects a fake proxy dll for testing then adds the results to a log file called sideload.json. With the results from sideload.json the build.py file builts the real proxy dll (static rust lib + proxy.cpp + proxy.h = proxy.dll). Once it builds the DLL it injects it into each folder with application specific dlls the exe needs to run and acts as one of the vulnerbale DLLs, it does this for each vulnerable DLL. vulnerable exes and DLLs will be placed in the "output" folder.

build_payload (folder)

• Strictly for building the rust static lib payload

exes (folder)

• this is were the third party exe's are dropped for testing against dll sideloading

output (folder)

• stores a folder for each vulnerable exe, within each exe folder is a folder that has a payload proxy dll for each vulnerable dll

Proxy_dll_templates (folder)

• stores the templates for the payload proxy dll and the log proxy dll

rust_payload (folder)

• hosts the rust payload, there must be only one file there

_sideload_api.py (file)

• a dump of all the functions needed by build.py and scan.py

scan.py (file)

• tests each exe to see if they are vulnerable by injecting a log proxy dll then outputs the data into sideload.json

build.py (file)

• reads from sideload.json and builds a proxy dll with the rust paylaod and puts the output folders in the output folder