I am reading about process injection techniques on Windows machines (originally came to this from privilege escalation research). Although I used Windows for the majority of my life, I feel like I understand the Linux privilege/permissions schemes better, and I would appreciate a clarification about the assumption for some of the common methods.
- Process hollowing - a program needs to start a different one, common examples are explorer.exe or svhosts.exe, which are located under Windows folder
- DLL hijacking - make a different process load some DLL or write it on a high folder in the search path
- Others similar
Those methods usually depend on calling system APIs and allocating and copying memory in strategic locations. It doesn't seem like a standard low-privilege user can perform this attack or can they? (an example of "low-privilege" would be a standard corporate user). I mean if they can, wouldn't it be a design flaw in the operating system or it just much harder than the manuals show?
Reference: Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques , the text and diagrams show a process easily manipulating another process's memory.