Contents
What is DLL hijacking vulnerability?
DLL hijacking is a method of injecting malicious code into an application by exploiting the way some Windows applications search and load Dynamic Link Libraries (DLL). For a DLL hijack to be successful, a victim needs to load an infected DLL file from the same directory as the targeted application.
What is the purpose of DLL hijacking?
The objective of DLL hijacking is for the attacker to place their bogus DLL higher in the operating system or application’s search path than any better alternatives, so that it loads successfully into the targeted program.
What is DLL sideloading?
Abstract. Dynamic-link library (DLL) side-loading is an increasingly popular cyber attack method that takes advantage of how Microsoft Windows applications handle DLL files.
How could a DLL be used maliciously?
DLL Search Order Hijacking If a developer allows LoadLibrary to resolve the path of a library dynamically then that PE will also look in the current directory for the library DLL. This behavior can be used for malicious purposes by copying a legitimate PE to a directory where the attacker has write access.
What is Safe DLL search mode?
Safe DLL search mode places the user’s current directory later in the search order. Safe DLL search mode is enabled by default. To disable this feature, create the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode registry value and set it to 0.
How to escalate privileges via DLL hijacking?
In order to be able to escalate privileges via DLL hijacking the following conditions needs to be in place: 1 Write Permissions on a system folder 2 Software installation in a non-default directory 3 A service that is running as system and is missing a DLL 4 Restart of the service More
Is there a way to hijack a DLL?
The last step is to generate the hijackable DLL into one of the folders that have been identified above with Modify (M) permissions. In order to be able to escalate privileges via DLL hijacking the following conditions needs to be in place:
Can a DLL hijacking session open a meterpreter?
As it can be see below when the service restarted a Meterpreter session opened with SYSTEM privileges through DLL hijacking.
Is it possible to load a malicious DLL?
If these DLL’s doesn’t exist or are implemented in an insecure way (DLL’s are called without using a fully qualified path) then it is possible to escalate privileges by forcing the application to load and execute a malicious DLL file. It should be noted that when an application needs to load a DLL it will go through the following order: