Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit is that the file is never written to disk and is difficult to detect. Many examples I've seen are based on Joachim Bauch's work.

However, at DEF CON 20 (this year, 2012) Andrew King demonstrated that he was able to detect DLL's injected using reflective DLL injection. His presentation was called "Detecting Reflective Injection". Unfortunately, he has not released the source code (which he certainly is under no obligation to do).

In addition, a tool called "Antimeter" can detect the meterpreter engine when loaded using reflective dll injection. Again, closed source.

I understand that Andrew King's tool and Antimeter are both written in Python and use pydbg/pydasm in order to enumerate the memory of running executables.

Does anyone have some general source code (in Python or otherwise) that they are willing to share that demonstrates how to detect reflective DLL injection? There are memory forensic tools that can analyze a memory dump and find this, but I'm looking to execute an application on a running system (like antimeter does) and find processes with reflectively injected DLL's.

If you are interested in understanding how reflective DLL injection works, there is some open-source code written in Delphi that shows how to do this.

UPDATE: I tested and I can reflectively inject DLL's without admin rights (and as a regular user), but of course as a USER I can only inject into processes running at the same integrity level (and in my session)...but that still covers applications like the Office suite, Internet Explorer, etc.

share|improve this question
1  
it is the same as here: stackoverflow.com/questions/12697292/… You should update your question here too. –  Hanan N. Dec 24 '12 at 10:22
add comment

1 Answer

Consider what reflective DLL injection is: You exploit an application to get it to execute arbitrary code and this shell code loads a DLL into memory as a blob of data (all standard shell code stuff so far...) and then gives it execution such that the DLL loads itself properly as a DLL via a PE loader. The purpose of this whole idea: Let you write a full application that can compile to a DLL in a language of your choosing instead of writing the whole malware as assembly code with fixed memory offsets.

So to detect, you want to look for a PE file that exist only in memory and not on on disk and is running code in it. So scan through executable memory blobs for things that look like PE files, but aren't associated with any on disk file. That can be done as a post-exploitation forensics. Or if you want to detect real-time, hook calls normally associated with Reflective DLL Injection such as LoadLibrary, GetProcAddress and VirtualAlloc, and perform the previous step with more smarts. See ambuships.com

share|improve this answer
    
Well, you don't exactly exploit an application to execute arbitrary code. As I understand it, reflective DLL injection is merely loading a DLL in another application without the use of the standard api calls like "CreateRemoteThread". So long as you have rights to write into another processes address space, you can do it. It doesn't require an exploit to accomplish it. See "BTMemoryModule" for a Delphi port of Joachim Bauch's work...complete with ready to compile example code: code.google.com/p/memorymodule –  Mick Oct 1 '12 at 13:56
    
The whole purpose of reflective DLL injection is that you never write injected DLL file on disk so that you can avoid detection by AV. If you don't have the file on disk you can't use the regular injection technique (i.e CreateRemoteThread) hence you should use something as reflective DLL injection and that BTW makes the detection of the injected DLL harder. –  Hanan N. Dec 24 '12 at 10:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.