An application is vulnerable to DLL preloading attack on Windows if it loads a DLL simply by it's name. Windows then goes on to search several folders and loads the first DLL with a matching name.

Given access to a non-administrative user account, is it possible to determine which DLLs a process/service loaded, would load etc.? Or which DLLs it tried to load but failed? This process/service should belong to another user.

  • As a non admin, if the process calls LoadLibrary to load a DLL - then if you run strings.exe (Sysinternals/MS) over the exe with a filter for ".DLL", e.g. strings64 test.exe | find /i ".dll", do you see any DLLs without paths? There is a chance these are loaded without a path. – HelpingHand Aug 12 '19 at 22:38

It’s not possible to predict an applications intention, unless you can ‘see’ into the service.

You may be able to do static code analysis of any services you have source code access to. This would allow you to see for any flaws in which you are looking for.

I don’t believe there is a tool in the OS that shows the dlls that are being referenced from a service in real time and suggesting third party tools is out of scope for answers on here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.