DLL hijack privileges

Question

DLL hijacking means that malicious software gets admin rights from default or it means you need to elevate your privileges first? Because I tried to change a DLL in Windows/System32 folder, but I can't do it even though I ran my software with admin rights.

Answer 1

DLL hijacking requires an application that is vulnerable and the code in DLL gets the privileges the program calling it has. If the vulnerable program e.g. runs as SYSTEM or with administrator privileges (after the UAC prompt), the DLL gets the administrative privileges, but if the DLL is called from a process running as normal user, it has the same privileges the user has.

You are not supposed nor need to be able to change DLLs inside %SystemRoot%\System32\. You just need to be able to place your malicious DLL in a location that gets searched before the legitimate DLL, abusing the default Dynamic-Link Library Search Order with DLL Search Order Hijacking. For example if a desktop application is using a DLL from System32\, it may first search for the DLL with that name from its own directory. There are also other techniques like phantom DLL hijacking, DLL redirection, relative path DLL hijacking, but essentially the goal is always to trick a trusted application into loading an arbitrary DLL.

The DLL replacement you suggest is also listed on the same article from Wietze Beukema, but if replacing the DLL requires administrative privileges you don't yet have, that's not really privilege escalation, is it?

Of course there are some limitations. The program might check that the DLL is properly signed with a valid signature. The program might also crash, if the DLL doesn't fulfil its needs e.g. if there isn't a function it tries to call or it returns unexpected data. For these reasons all applications aren't vulnerable to DLL hijacking at all, and DLL hijacking might require the malicious DLL to more or less mimic the behaviour of the original legitimate DLL.