Presentation for my talk at Global Infosec Summit, LPU (11 Nov 2017). The Presentation demonstrates risk of using outdated and cracked software. Additionally, demonstrates the hand-on approach to finding DLL search order hijacking vulnerabilities. The Presentation is for educational purposes only. This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

1. HACKIJACKING
SOFTWARE
BY:
NIPUN JASWAL

2. #whoami
■ SOMEONE WHO LOVES BREAKING INTO TECHNOLOGY
■ TECHNICAL DIRECTOR, PYRAMID CYBER AND FORENSICS
■ INTERNATIONAL INFOSEC AUTHOR
■ CHAIR MEMBER, NCDRC
■ 10 YEARS, 20+ Zero Days ( Public ), 20+ Security Hall of Fame, 5 Books, 50+ Articles, OLD
■ WORKED WITH LAW ENFORCEMENT WORLDWIDE

3. #whoami

4. NOBODY GIVES A S**T
TALK

5. THE STORY… OF A HACKER
GET MARRIED…
NOPE

6. AND GOOGLE DOESN’T HELP…

7. SECURITY TO THE RESCUE..
When will the
boss get
married?

8. MAKING THINGS WORSE….
Matrimony BRANDS
IN INDIA

9. THE MATCH MAKING SOFTWARE… =D

10. MONEY | MONEY AND MONEY… $$$$$
I THINK, I CAN HACK THIS
SOFTWARE AND TURN THIS
EPIC MATCHMAKING S**T INTO
SOME HARD CASH

11. SO WHAT I HAVE TO DO?
■ I NEED TO HACK THE SOFTWARE
■ I WANT TO GAIN ACCESS TO EVERY USER USING IT
■ ONCE I HAVE THE ACCESS, I WILL INSTALL MY CRPTOMINER ON THE TARGET
■ I WILL USE HIS SYSTEM TO MAKE MONEY, I MEAN A LOT OF MONEY
■ BUT WAIT, MY CHALLENGES:
– I WILL HAVE TO GET THE SOFTWARE INSTALLED

12. LET’S GET THIS STARTED…
■ OBSERVATIONS:
– NO BUFFER OVERFLOWS FOUND
– ANTIVIRUS DETECTS MY BACKDOORED SOFTWARE

13. REVENGE OF THE NERDS:
DLL SEARCH ORDER HIJACKING

14. How does a program execute?

15. So where is our program?

21. The Big Picture: Metasploit
■ Let’s Create a Malicious DLL:

22. The Big Picture: Metasploit
■ Let’s Place meterpreter.dll into the Kundli Software with the name VB5DB.dll

23. Let’s Execute the Program Again

24. Let’s Execute the Program Again

25. Software Didn’t Load… but we got the access…

26. But.........
We have the following set of problems:
■ Software not working can create suspicion and can land you
in trouble
■ Antiviruses will literally eat the DLL like a Dog behind a Bone
■ Your Access will be lost no matter what
■ Let’s see how we can evade the problems… J

27. Introduction to Code Caves

28. Unused Space within a Program

29. Windows DLLs may not have Code Caves

30. The Backdoor Factory

34. Next Steps.. are Easy.. :P
Pack the Software &
Distribute

35. Preventions
1. Crackers make use of these techniques
while distributing cracked software,
patches etc.
2. Download from legitimate websites only.
3. Verify Digital Signatures

36. Thanks!!

37. Questions?
Mail Your Queries to:
mail@nipunjaswal.info