Leveraging DLL search order hijacking and supply chain attacks

The DLL hijacking technique can be used for local privilege escalation on Windows systems. It exploits the way Windows searches for and loads DLLs. When a program is executed, it looks for required DLLs in specific directories, and if they are not found, it searches in predefined locations. The malicious DLL runs with the elevated privileges of the targeted process, potentially providing unauthorized access or control.

Practical example

Let’s observe the practical implementation and demonstration. Let’s say we have a Windows victim machine and suppose that the user is a low-privilege user with access. The objective is to elevate it and spawn a reverse shell with SYSTEM privileges:

> whoami /priv

On Windows 10, it looks like this:

Figure 4.15 – Low-privilege user

For example, a high-privilege user looks like this:

C:\Windows\system32> whoami /priv

On...