1

On Wikipedia page we can read that "Windows FAX DLL injection" exploit would allow a user with malicious intents to hide its own malware under the DLL of another application.

How does it work exactly? Does popular antiviruses successfully detect such DLL injections of this type?

2

You can find the information at Wikileaks page.

This is a simple DLL hijacking attack that we have successfully tested against Windows XP,Vista and 7. A DLL named fxsst.dll normally resides in \Windows\System32 and is loaded by explorer.exe. Placing a new DLL with this name in \Windows results in this being loaded into explorer instead of the original DLL. On Windows Vista and above, the DLL‘s reference count must be increased by calling LoadLibrary on itself to avoid being unloaded.

This achieves persistence, stealth, and (in some cases) PSP avoidance.

So basically:

  1. Compile your application as .DLL
  2. Place it in C:\WINDOWS as fxsst.dll
  3. It will be loaded by explorer.exe - (perhaps killing is enough)

The original file is located in C:\Windows\System32\fxsst.dll (handles T.30 Fax Protocol), but if you place another DLL called fxsst.dll in C:\WINDOWS this one will be loaded instead.

From Vista and above you need admin rights to install the DLL and you have to call LoadLibrary on your own DLL Loadlibrary("C:\\WINDOWS\\fxsst.dll") to increase the reference count or it will be unloaded with FreeLibrary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.