0

I'm doing an educational project and I need an executable to try different DLL hijacking techniques in Windows 10.

Obviously, there are no such vulnerabilities in Windows 10 by default, so I thought about creating an executable in C and compiling it just to try this kind of attack, but I am not sure how to do it cause I need it to be with elevated privileges.

The other option I was thinking about is finding some old program with this kind of known vulnerability, but I am not sure which one to use so that I can explain almost everything related to DLL hijacking.

Any ideas for any of the two proposed ideas?

1 Answer 1

1

Obviously, there are no such vulnerabilities in Windows 10 by default...

Not so fast. This list have 287 applications shipped in Windows 10 v1909 that are vulnerable to DLL Hijacking. Just grab one of those, put a rogue DLL on its path, and run the executable. This is one good DLL to use. It spawns a calculator and shows a message box saying if the application got admin privileges or not.

3
  • And how or where can I download that specific version metioned on that list? Cause I hace the 20H2 19042.572 and the example shown in that article does not work
    – P00
    Commented Sep 5, 2023 at 18:16
  • Grab a copy of Process Explorer (it should be on the Sysinternals Suite), run a program from that list and check the DLL files it tried to import but failed. Rename the DLL to match the missing file and try. It's a "relative path" issue, so you will need to start the vulnerable application from the directory you saved the DLL.
    – ThoriumBR
    Commented Sep 5, 2023 at 20:01
  • Yeah, I already did that but the proccess find the dll, so it looks like in this version those vulnerabilities have been patched
    – P00
    Commented Sep 6, 2023 at 17:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .