Malicious DLLs.

[Vap0r]

How would I craft a malicious dll? I tried in Visual Studio 2010 using C#, but it kept giving me an error on some basic stuff. Does anybody have a short, detailed guide? Or does it look like I'm gonna have to learn how to write .dll files first, then malicious ones later? What normally does a malicious .dll do? Just deliver a payload? Or does it normally do all the work, it seems to me the functionality of the code in a dll is limited. Thanks for your time, Vap0r.

[blink_212]

By malicious dlls, I assume you mean dll injection? Throw that into google and it comes up with a few tutorials.

blink

[Vap0r]

Hmmm. This appears to be exactly what I wanted, thanks blink, I was having trouble with the term "malicious dll" turning up tons of past security reports and vulnerabilities.

In case you're wondering, (you're probably not), I plan to try this out as a PoC, I know it's been done, but I still want to try it. http://www.kb.cert.org/vuls/id/940193

[Raze]

C# doesn't generate native DLLs that can be used in such an exploit. You'll need to go with C/C++, Delphi, or ASM (or something else like D). You might want to look into managed C++ which let's you do bad stuff like normal C++ with all the fun of .net (won't work if they don't have .net though). The most you could do with C# is make a comvisible dll and use that for something.

[Psiber_Syn]

This sounds like a fun project be sure to post us any code you come up with and id really like to see that POC you were speaking of when it gets done :-)

[Vap0r]

C# doesn't generate native DLLs that can be used in such an exploit. You'll need to go with C/C++, Delphi, or ASM (or something else like D). You might want to look into managed C++ which let's you do bad stuff like normal C++ with all the fun of .net (won't work if they don't have .net though). The most you could do with C# is make a comvisible dll and use that for something.

And I found this out, unfortunately, a few details are left out so people without knowledge of the windows shell dll and how exactly link icons are handled are left in the dark. I'm gonna work a bit more on this, and hopefully find something that will work.