DLL hijacking means that malicious software gets admin rights from default or it means you need to elevate your privileges first? Because I tried to change a DLL in Windows/System32 folder, but I can't do it even though I ran my software with admin rights.
-
I tried to interpret your question. Please let me know if I got it wrong. As for your second question, that's too open-ended, so I removed it.– schroeder ♦Jul 11, 2020 at 8:06
-
@schroeder, no. i mean: dll hijcaking is means only 1) getting admin rights or 2) getting all possible rights, like "TrustedInstaller" if it's possible)?– BalabolJul 11, 2020 at 8:18
-
@schroeder, In this forum an example with malicious code is not allowed?– BalabolJul 11, 2020 at 8:20
-
Yes, examples are allowed, but that didn't seem like that's what you asked for– schroeder ♦Jul 11, 2020 at 8:39
-
@schroeder, ok.– BalabolJul 11, 2020 at 18:34
1 Answer
DLL hijacking requires an application that is vulnerable and the code in DLL gets the privileges the program calling it has. If the vulnerable program e.g. runs as SYSTEM
or with administrator privileges (after the UAC prompt), the DLL gets the administrative privileges, but if the DLL is called from a process running as normal user, it has the same privileges the user has.
You are not supposed nor need to be able to change DLLs inside %SystemRoot%\System32\
. You just need to be able to place your malicious DLL in a location that gets searched before the legitimate DLL, abusing the default Dynamic-Link Library Search Order with DLL Search Order Hijacking. For example if a desktop application is using a DLL from System32\
, it may first search for the DLL with that name from its own directory. There are also other techniques like phantom DLL hijacking, DLL redirection, relative path DLL hijacking, but essentially the goal is always to trick a trusted application into loading an arbitrary DLL.
The DLL replacement you suggest is also listed on the same article from Wietze Beukema, but if replacing the DLL requires administrative privileges you don't yet have, that's not really privilege escalation, is it?
Of course there are some limitations. The program might check that the DLL is properly signed with a valid signature. The program might also crash, if the DLL doesn't fulfil its needs e.g. if there isn't a function it tries to call or it returns unexpected data. For these reasons all applications aren't vulnerable to DLL hijacking at all, and DLL hijacking might require the malicious DLL to more or less mimic the behaviour of the original legitimate DLL.
-
yes, you are right. when my soft reach victim computer, we need to get admin rights from default user rights.About limitations: what about DLL proxying in that article in you message? is it better way to get privileges?– BalabolJul 11, 2020 at 14:34
-
If it were always generally possible, without finding a vulnerability, the whole rights management would be pointless. Sorry, I won't help you getting into the system of your victim. Jul 11, 2020 at 14:39
-
-
Those are just techniques that exploits certain vulnerabilities. None of them is generally better than the others, as it depends entirely on the circumstances. You have to find a vulnerable dependency, first. Knowing these methods simply give you some advice on where to look. Also, Dependency Walker might be useful. Jul 11, 2020 at 14:48
-
thank for useful links. one more question: it's big difference betwen "SYSTEM" rights and "Admin"?– BalabolJul 11, 2020 at 15:03