rattler icon indicating copy to clipboard operation
rattler copied to clipboard

Published 20 hours ago • verified publisher icon sensepost

Does not seem to work

Open CaledoniaProject opened this issue 7 years ago • 3 comments

I just did a simple test with JDK 1.8

Since all java applications depends on the jli.dll,

screen 2017-10-09 at 20 01 01

rattler should easily find this DLL hijack point, but it didn't ...

screen 2017-10-09 at 20 02 35

Am I using this tool incorrectly?

CaledoniaProject avatar Oct 09 '17 12:10 CaledoniaProject

hi there, It appears that Rattler did not identify any DLL's to enumerate(first green line of text) so that's why it was not able to detect the vulnerable DLL's. This could be due to multiple reasons, what permissions did you run Rattler with and secondly, did you use the 32 or 64 bit version?

brompwnie avatar Oct 10 '17 07:10 brompwnie

Hmm, I'm on Windows 7 x86, using 32 bit JDK with 32 bit rattler (downloaded from https://github.com/sensepost/rattler/releases)

Running CMD as elevated administrator

CaledoniaProject avatar Oct 10 '17 08:10 CaledoniaProject

Thanks for the info, ill try replicate the issue. In the meantime I',m going to mark this as a bug

brompwnie avatar Oct 11 '17 08:10 brompwnie