How Windows FAX DLL injection works?

Question

On Wikipedia page we can read that "Windows FAX DLL injection" exploit would allow a user with malicious intents to hide its own malware under the DLL of another application.

How does it work exactly? Does popular antiviruses successfully detect such DLL injections of this type?

Answer 1

You can find the information at Wikileaks page.

This is a simple DLL hijacking attack that we have successfully tested against Windows XP,Vista and 7. A DLL named fxsst.dll normally resides in \Windows\System32 and is loaded by explorer.exe. Placing a new DLL with this name in \Windows results in this being loaded into explorer instead of the original DLL. On Windows Vista and above, the DLL‘s reference count must be increased by calling LoadLibrary on itself to avoid being unloaded.

This achieves persistence, stealth, and (in some cases) PSP avoidance.

So basically:

1. Compile your application as .DLL
2. Place it in C:\WINDOWS as fxsst.dll
3. It will be loaded by explorer.exe - (perhaps killing is enough)

The original file is located in C:\Windows\System32\fxsst.dll (handles T.30 Fax Protocol), but if you place another DLL called fxsst.dll in C:\WINDOWS this one will be loaded instead.

From Vista and above you need admin rights to install the DLL and you have to call LoadLibrary on your own DLL Loadlibrary("C:\\WINDOWS\\fxsst.dll") to increase the reference count or it will be unloaded with FreeLibrary.