📖 What is DLL Hijacking?
DLL Hijacking is an attack where a malicious Dynamic Link Library (DLL) is placed in a directory where an application searches for it. When the application launches, it loads the malicious DLL instead of the legitimate one.
"This often relies on the 'DLL search order' in Windows; always check if the application looks in the local directory before the system directory."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of DLL Hijacking?
- ▸ Windows DLL Search Order defines the sequence of directories the OS checks to find a required library, typically starting with the application's own directory.
- ▸ Privilege Escalation occurs when a service running with SYSTEM or Administrator privileges loads a malicious DLL from a directory where the attacker has write access.
- ▸ Phantom DLL Hijacking targets applications that attempt to load libraries that are not present on the system, allowing attackers to provide the missing file.
- ▸ Safe DLL Search Mode is a security feature that modifies the search order to prevent the current working directory from being prioritized over system directories.
- ▸ Persistence is achieved by placing a malicious DLL in an application's path, ensuring the attacker's code executes every time the target application is launched.
🎯 How does DLL Hijacking appear on the PT0-002 Exam?
You may be asked to identify the most effective method for privilege escalation after discovering a third-party application running as SYSTEM that loads a missing DLL from a writable folder.
A scenario might describe a penetration tester using Procmon to observe 'NAME NOT FOUND' results for DLLs, indicating a potential opportunity for a DLL hijacking attack.
Expect questions about the difference between DLL hijacking and DLL injection, specifically focusing on whether the attacker leverages the search path or forces a process to load a library.
❓ Frequently Asked Questions
What is the primary difference between DLL Hijacking and DLL Injection?
Hijacking relies on the OS search order to load a malicious file automatically during startup. Injection involves using API calls, such as CreateRemoteThread, to force a running process to load a specific DLL into its memory space.
Which tools are most useful for identifying DLL hijacking opportunities?
Process Monitor (Procmon) from the Sysinternals suite is the standard tool. By filtering for 'Result: NAME NOT FOUND' and 'Path contains .dll', you can find libraries the application is searching for but cannot locate.