WerEnc.dll: A Microsoft library as an attacker-controlled encryption primitive

Researcher Mr.Z (0xsp) demonstrated how to turn a signed Microsoft library WerEnc.dll into an attacker-controlled payload encryption mechanism — without implementing cryptography from scratch.

WerEnc.dll ships with Windows 10 1607+ and Windows 11 and exports the undocumented EncryptDumpFile and EncryptDumpStream. The library generates a random 32-byte AES-256 key and a 16-byte IV, encrypts the data with AES-CBC, and separately wraps the key and IV with Microsoft's built-in RSA-4096 public key. Since the resulting session material cannot be decrypted without the corresponding private key, the author implemented BYOK (Bring Your Own Key) by replacing the built-in RSA public key directly in process memory.

The library's .rdata section contains a 539-byte BCRYPT_RSAKEY_BLOB holding an RSA-4096 public key. BCryptImportKeyPair reads it directly from the mapped image, so the PoC locates the blob using the RSA1 magic, uses VirtualProtect to make the region writable, and replaces the 539-byte blob with one containing the operator's own RSA-4096 public key.

After that, WerEnc.dll continues to perform cryptographic operations through Windows CNG, but the AES key and IV are now RSA-encrypted with the operator's key. The corresponding private key can then be used to recover them from the container and decrypt the payload with AES-256-CBC.

The author also reconstructed the container format: a 64-byte header, a 539-byte RSA blob, two 512-byte RSA blocks containing the wrapped AES key and IV, followed by the ciphertext. RSA wrapping in EncryptDumpFile uses PKCS#1 padding, while the stream path uses OAEP-SHA256.

The practical PoC supports pre-encrypted .byok.enc files, encrypting a raw payload through WerEnc.dll in memory, and a beacon mode in which the stager receives BYOK keys from an HTTP C2, keeps them in memory, and patches the library after launch.

The researcher thus demonstrated the abuse of a legitimate Windows cryptographic component: AES/RSA operations are performed by a Microsoft DLL through native CNG rather than by custom cryptographic code in the loader.

Article: https://0xsp.com/research/turning-werenc-dll-lolbin-into-an-attacker-controlled-encryption-primitive-byok/

PoC: https://github.com/0xsp-SRD/0xsp.com/tree/main/Research/WerEnc