{"id":9414,"date":"2024-09-03T21:23:10","date_gmt":"2024-09-03T21:23:10","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=9414"},"modified":"2024-09-03T23:14:57","modified_gmt":"2024-09-03T23:14:57","slug":"rundll32-and-phantom-dll-lolbins","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2024\/09\/03\/rundll32-and-phantom-dll-lolbins\/","title":{"rendered":"Rundll32 and Phantom DLL lolbins"},"content":{"rendered":"\n<p>This may be a new, kinda ephemereal addition to the lolbin world (not sure if anyone covered it before).<\/p>\n\n\n\n<p>Windows 11 comes with a large number of DLLs &#8211; some of which are broken.<\/p>\n\n\n\n<p><strong>DuCsps.dll<\/strong> on Windows 11 Pro 22H2<\/p>\n\n\n\n<p>The <em>DuCsps.dll<\/em> imports 2 APIs from <em>UpdateAPI.dll<\/em>: <\/p>\n\n\n\n<ul>\n<li><em>GetInstalledPackageInfo<\/em>, and <\/li>\n\n\n\n<li><em>FreeInstalledPackageInfo<\/em>. <\/li>\n<\/ul>\n\n\n\n<p>The problem is that there is no <em>UpdateAPI.dll.<\/em> It may be present in other versions of Windows, but it&#8217;s not present in 22H2 (note: I have not tested all the subversions, so YMMV).<\/p>\n\n\n\n<p><strong>tssrvlic.dll<\/strong> on Windows 11 Pro 22H2<\/p>\n\n\n\n<p>The same goes for <em>tssrvlic.dll<\/em> that imports 3 APIs from a non-existing <em>TlsBrand.dll<\/em>:<\/p>\n\n\n\n<ul>\n<li><em>RDSGetProductAccessRights<\/em>,<\/li>\n\n\n\n<li><em>W2K3ADPUCALDetailsCreator<\/em>, and<\/li>\n\n\n\n<li><em>RDSProductDetailsCreator<\/em><\/li>\n<\/ul>\n\n\n\n<p>They both create a lolbin opportunity via a missing phantom DLL, and an attacker can simply bring in their versions of malicious <em>UpdateAPI.dll<\/em> or <em>TlsBrand.dll<\/em>, and then run (from the same directory where these payloads are located) the following rundll32 commands:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">rundll32 DuCsps.dll, foo\n\nrundll32 tssrvlic.dll, bar<\/pre>\n\n\n\n<p>where <em>foo<\/em> and <em>bar<\/em> can be anything.<\/p>\n\n\n\n<p>See below:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/rundll32_phantomdll.gif\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/rundll32_phantomdll.gif\" alt=\"\" class=\"wp-image-9415\" width=\"500\"\/><\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>This may be a new, kinda ephemereal addition to the lolbin world (not sure if anyone covered it before). Windows 11 comes with a large number of DLLs &#8211; some of which are broken. DuCsps.dll on Windows 11 Pro 22H2 &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2024\/09\/03\/rundll32-and-phantom-dll-lolbins\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,53,56,64,61],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9414"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=9414"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9414\/revisions"}],"predecessor-version":[{"id":9418,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9414\/revisions\/9418"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=9414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=9414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=9414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}