The DLL search order hijacking/DLL planting technique is one of my favorite persistence-gaining methods in achieving long-time access while evading the eyes of the administrators. Let's talk about this technique in the next section.
Maintaining access using vulnerabilities in common software
DLL search order hijacking
As the name suggests, the DLL search order hijacking vulnerability allows an attacker to hijack the search order of DLLs loaded by a program and will enable them to insert a malicious DLL instead of a legit one.
Mostly, software, once executed, will look for DLL files in its current folder and System32 folder. However, sometimes the DLLs, which are not found in its current directory, are then searched in the System32...
