forrest-orr / phantom-dll-hollower-poc

Phantom DLL hollowing PoC

Phantom DLL hollowing

DLL hollowing is a technique which can be used to provide stealth for malware in memory, either within the local process or a remote one (in combination with process injection/hollowing). This PoC code is associated with the blog post at https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing

This solution contains two projects. The first is a PoC which can execute DLL hollowing using either the classic or phantom (TxF) method. It takes a user-supplied shellcode and only targets the address space of the local process. The second project is a memory scanner, which can enumerate the regional attributes of a user-provided PID, or all accessible processes. It can also collect statistics on the most common permissions for different types of memory.

Compilation

Visual Studio Community 2019 Release|x86 Release|x64

Usage

PhantomDllHollower.exe (shellcode file path) "txf" (optional, phantom hollow using TxF)

phantom-dll-hollower-poc's Issues

Cannot Successfully Execute on WIn10 Enterprise N(10.0.19044 N/A Build 19044)

PhantomDllHollower.exe MsgBoxShellcode64.bin

• Successfully opened MsgBoxShellcode64.bin (size: 319)

• aadauthhelper.dll - image size: 487424 - .text size: 306955
• aadauthhelper.dll - mapped size: 487424

• Successfully mapped an image to hollow at 0x00007FFC43250000 (size: 487424 bytes)

• Calling 0x00007FFC43251000...

But No MessageBox Popup.

I Attach it on x64dbg,Find this exception:
First chance exception on 0x00007FFC43251037(C0000005,EXCEPTION_ACCESS_VIOLATION).

payload as follow:
┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/messagebox EXITFUNC=thread TEXT="Exploit Test" -f raw -o MsgBoxShellcode64.bin
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 319 bytes
Saved as: MsgBoxShellcode64.bin

-

Rebuild

Hey,
Thanks for you write up - I like it.
I started coding c++ like a year back, I improved from them, however I asked myself, how would I do DLL Hollowing in anothers process context?
I see NtMapViewOfSection with GetCurrentProcess() however pointing an handle from another context doesn't seem to work ->

• Failed to create mapping of section (error 0xc0000018)* AppVEntSubsystems64.dll - image size: 2060288 - .text size: 1346652
• Failed to create mapping of section (error 0xc0000018)* AppVEntVirtualization.dll - image size: 1609728 - .text size: 1069482

So what would I have to do in order to be able to make DLL Hollowing (very neat technique) in another process context?
Thanks, stay healthy.