3

I am reading about process injection techniques on Windows machines (originally came to this from privilege escalation research). Although I used Windows for the majority of my life, I feel like I understand the Linux privilege/permissions schemes better, and I would appreciate a clarification about the assumption for some of the common methods.

  1. Process hollowing - a program needs to start a different one, common examples are explorer.exe or svhosts.exe, which are located under Windows folder
  2. DLL hijacking - make a different process load some DLL or write it on a high folder in the search path
  3. Others similar

Those methods usually depend on calling system APIs and allocating and copying memory in strategic locations. It doesn't seem like a standard low-privilege user can perform this attack or can they? (an example of "low-privilege" would be a standard corporate user). I mean if they can, wouldn't it be a design flaw in the operating system or it just much harder than the manuals show?

Reference: Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques , the text and diagrams show a process easily manipulating another process's memory.

1
  • If I start both a firefox process and an outlook process, both processes are owned by me and can be injected. – Nomad Sep 28 '18 at 7:37
2

Do not think of privileges in terms of users accounts here, the permissions that are required are SeDebug. SeDebug is granted to the administrator / root account the the account the process is running under.

As a normal user you are not going to be able to inject into a process running as SYSTEM. As an attacker you are only going to be able to initial inject into a process same context.

Process hollowing you start a thread as an initial process but in a paused state. You then clear memory and replace it with a process that you want to hide. The entire time you have control of this process, you're just hiding another one under the guise of the original.

Dll hijacking requires you can create a folder and write a binary to disk - as the path will be loaded by the calling process when its searching for libraries to load. So potentially if this is a service you will need permissions to start/stop it.

0

From what I remember (I might be wrong) to do this you must have an administrative account. Normal users can't do it. I wrote a Trojan a while ago which used process hallowing but it must be run as admin to work.

3
  • 2
    Wouldn't it make sense that it's determined by a multitude of factors? Such as; if the victim program is currently running at non-administrative privileges, what kind of protections the program has in place for such attacks, and so on? – xorist Aug 28 '18 at 16:26
  • would it be correct, in such case, to say that process hollowing is used for evasion rather than privilege escalation in the scenario you described? (as local admin can do a bunch of stuff out of the process initially opened) – Anton.P Aug 29 '18 at 6:20
  • Yes it is for evasion but like xorist wrote it depends on the type of program. – Adrian Rudy Dacka Aug 29 '18 at 6:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.