Loading DLL failed. Try again.
gearcapitan opened this issue · 2 comments
Same problem here, I've narrowed it down a bit:
The malicious driver is loaded in the driver folder, but the call to reinstall a valid driver (in order to load the malicious one) somehow fail: repository /old is not created, so the "try" part to load the dll receive a "PATH_NOT_FOUND" error, and the program ends with "Loading DLL failed. Try again".
Local DLL still works, but you'll need to first copy the malicious driver out of the driver repo to be able to use it.
Whenever I try to install a new driver dll, I don't see the "Old" repository being created on the machine. However, if I try to install a driver dll that is already in use (one already in the driver repo), it fails and the system logs says something like "couldn't copy the dll file to C:\Windows\system32\spool\drivers\x64\3\Old\1\dllfile.dll". So it does make that repo; but it may disappear right after the copy? No idea what's going on here, if anyone know how to solve it would be great :)
Edit to add: same problem here: cube0x0/CVE-2021-1675#11
A proposed solution is to check the user's privilege. Should work with a lowpriv user but not with an admin user. Same answer here: cube0x0/CVE-2021-1675#27
Correction:
Create a new lowprivilege user. Powershell command: new-localuser -name "test"
prompt for password (care to follow password policy)
relaunch attack using the newly created lowpriv user.
Attack works.
Windows sucks.