Affichage des articles dont le libellé est Persistence. Afficher tous les articles
Affichage des articles dont le libellé est Persistence. Afficher tous les articles

mardi 24 avril 2018

Side Loading Dll with a SteelSeries Signed Binaries

I'm a gamer. I bought one of the awesome SteelSeries Sensei [RAW] Mouse.


This is an awesome mouse perfect to micro your units in SC2 :-)

So I looked around the installation of the SteelSeries Engine 3 software which allows to manage your device: "SteelSeries Engine 3 talks directly to your game, which changes your device's illumination in real time, based off of in-game events.".

In the installation folder, I found the following interesting binary:

win_driver_installer.exe

This binary is digitally signed by SteelSeries:



I tried to run it and I got the following error:


The binary win_driver_installer.exe tried to load SSEdevice.dll which is also signed.



So I forged a C++ .dll that leverages a PowerShell payload and tries to connect to one of my CobaltStrike server and I tried to make it side loaded by win_driver_installer.exe but unfortunately I got this new error:


I changed my entry point in my .dll:


I checked the export worked:


I ran again and... bingo I have a beacon!





That's all folks!