DLL hijacking is a technique where a malicious DLL (Dynamic Link Library) is placed in a directory that a vulnerable application searches before the legitimate one.
When the application is launched, it unknowingly loads the malicious DLL instead, allowing attackers to:-
- Execute arbitrary code
- Compromise the system
Recently, the cybersecurity researchers at a multi-layered incident response company, Security Joes, discovered a new DLL hijacking technique that enables threat actors to bypass Windows mechanisms.
New DLL Hijacking Technique
This new technique exploits trusted WinSxS executables using DLL Search Order Hijacking.Â
This enables threat actors to execute malicious code within Windows folders, which eliminates the need for extra binaries.
Besides this, it’s compatible with both Windows 10 and 11, as it bypasses high privilege requirements.
The DLL Search Order Hijacking exploits how Windows apps load DLLs, taking advantage of those without specified file paths.
Threat actors manipulate apps depending on predefined search orders that place a malicious DLL in a prioritized directory.
Many methods for this require apps not to specify full paths, often due to development oversights.
Knowing how Windows loads DLLs and executables is one of the key things, and the system follows a sequence during the loading process.
This ensures efficient operation by locating necessary components like DLLs. Not only that even, it also provides an alternative method for finding resources.
Besides this, the Windows OS flow for searching and loading resources includes the following things:-
- Application’s launch directory
- C:\Windows\System32
- C:\Windows\System
- C:\Windows
- Current working directory
- Directories in the system’s
- User’s PATH variables
Exploiting the loading process lets threat actors inject unauthorized code into the trusted processes, which helps in deceiving the:-
- Security tools
- Security experts/analysts
This new malicious technique is completely sophisticated and stealthy as it enables threat actors to achieve several types of malicious goals like:-
- Compromise systems
- Evade detection
The WinSxS folder is a critical component in Windows OS at “C:\Windows\WinSxS.” This vital component crucially maintains multiple versions of system files.
Not only that even, it also preserves previous versions during updates, which causes the folder to grow with each update for the Windows operating system.
Here below, we have mentioned all the key purposes of the WinSxS folder:-
- Version Management
- System Integrity
- Dynamic Activation
Advantages New DLL hijacking technique
Here below, we have mentioned all the key advantages of this new DLL hijacking technique:-
- Circumventing High Privilege Requirements
- Eliminating the Need for Additional Binaries
- Enhancing Stealth
PoC
Here below, we have mentioned the Proof-of-Concept video:-
