Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 21 guests online
EH-Net Donations

Enter Amount:
$

Google Ads
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Featuresarrow /rootarrow [Article]-Intercepted! Windows Hacking via DLL Redirection
Ethical Hacker Community Forums
January 08, 2009, 01:31:19 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: ChicagoCon 2-Day Ethical Hacking Conference with MS Blue Hats Oct 31 - Nov 1. Tickets Only $100! www.chicagocon.com/content/view/103/51/
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: [Article]-Intercepted! Windows Hacking via DLL Redirection  (Read 4860 times)
0 Members and 1 Guest are viewing this topic.
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 2435


Editor-In-Chief


View Profile WWW
« on: September 09, 2008, 10:13:02 PM »

Craig does it again with this step-by-step tutorial. Have fun and don't be afraid to experiment on your own. Let us know how you do.

Permanent link: [Article]-Intercepted! Windows Hacking via DLL Redirection

Quote



By Craig Heffner 

In Windows, all applications must communicate with the kernel through API functions; as such, these functions are critical to even the simplest Windows application. Thus, the ability to intercept, monitor, and modify a program's API calls, commonly called API hooking, effectively gives one full control over that process. This can be useful for a multitude of reasons including debugging, reverse engineering, and hacking (in all interpretations of the word).

While there are several methods which can be used to achieve our goal, this tutorial will examine only DLL redirection. This approach was chosen for several reasons:

  • It is relatively simple to implement.
  • It allows us to view and modify parameters passed to an API function, change return values of that function, and run any other code we desire.
  • While most other methods require code to be injected into the target process or run from an external application, DLL redirection requires only write access to the target application's working directory.
  • We can intercept any API call without modifying the target (either on disk or in memory) or any system files.


As always, please add your thoughts to this thread as well as suggestions for other tutorials for Mr. Heffner... add joke here.  Wink

Don
Logged

CISSP, MCSE, CEH, Security+ SME
RoleReversal
Hero Member
*****
Offline Offline

Posts: 507


View Profile WWW
« Reply #1 on: September 10, 2008, 07:16:38 AM »

add joke here.  Wink

must...resist...joke...

Great article though, definitely on my to do list for going through again in more detail. Thanks.
Logged

A little bit of sanity:
http://www.infosanity.co.uk
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 2435


Editor-In-Chief


View Profile WWW
« Reply #2 on: September 11, 2008, 12:43:05 PM »

Submitted to digg as:

Quote

Awesome step-by-step tutorial on Windows API Interception helps you compromise a user's system or circumvent trial protection techniques. A little coding, a little disassembly, loads of hands-on fun.
http://digg.com/security/Intercepted_Windows_Hacking_via_DLL_Redirection


I'm sure we have 200 - 250 people who visit this site that can regularly help us get noticed on a larger scale by digging our articles. This is the cheapest and easiest way to help support EH-Net.

Thanks,
Don
Logged

CISSP, MCSE, CEH, Security+ SME
mad_irish
Newbie
*
Offline Offline

Posts: 16



View Profile WWW
« Reply #3 on: October 16, 2008, 12:11:01 PM »

I'm a little confused.  Milw0rm lists this article as posted in November of 2006 - two years ago (http://www.milw0rm.com/author/858).  Is this just a cross post or did Craig Heffner actually produce this content for EHN?  Adding a dig for content posted on milw0rm, packetstorm and other sites seems a little odd.  I did find the PDF format on milw0rm much easier to read (and print/save Smiley.
Logged
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 2435


Editor-In-Chief


View Profile WWW
« Reply #4 on: October 16, 2008, 02:12:51 PM »

I guess it is a cross post. When Craig sent it to me, he said it was an old article, but didn't tell me about the sites you mention. Maybe he didn't know. I'll ask him off-board. Good content either way.

Don
Logged

CISSP, MCSE, CEH, Security+ SME
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.7 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.038 seconds with 24 queries.
 
Sponsors

cwnp_moto__120x90.gif

Polls
How many security events including conferences and training do you attend a year:
 
Support EH-Net


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2009 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.