Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Loading DLL failed. Try again. #4

Open
gearcapitan opened this issue Aug 20, 2022 · 2 comments
Open

Loading DLL failed. Try again. #4

gearcapitan opened this issue Aug 20, 2022 · 2 comments

Comments

@gearcapitan
Copy link

imagen

@Florablia
Copy link

Florablia commented Nov 30, 2022

Same problem here, I've narrowed it down a bit:
The malicious driver is loaded in the driver folder, but the call to reinstall a valid driver (in order to load the malicious one) somehow fail: repository /old is not created, so the "try" part to load the dll receive a "PATH_NOT_FOUND" error, and the program ends with "Loading DLL failed. Try again".

Local DLL still works, but you'll need to first copy the malicious driver out of the driver repo to be able to use it.

Whenever I try to install a new driver dll, I don't see the "Old" repository being created on the machine. However, if I try to install a driver dll that is already in use (one already in the driver repo), it fails and the system logs says something like "couldn't copy the dll file to C:\Windows\system32\spool\drivers\x64\3\Old\1\dllfile.dll". So it does make that repo; but it may disappear right after the copy? No idea what's going on here, if anyone know how to solve it would be great :)

Edit to add: same problem here: cube0x0/CVE-2021-1675#11
A proposed solution is to check the user's privilege. Should work with a lowpriv user but not with an admin user. Same answer here: cube0x0/CVE-2021-1675#27

@Florablia
Copy link

Correction:
Create a new lowprivilege user. Powershell command: new-localuser -name "test"
prompt for password (care to follow password policy)
relaunch attack using the newly created lowpriv user.
Attack works.
Windows sucks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants