This document discusses DLL hijacking, which involves tricking applications into loading a malicious DLL instead of the intended one. It describes DLLs and their search order, how to find vulnerable applications, and techniques like using msfvenom to generate a payload DLL to open a reverse shell. While some protection schemes exist like SafeDllSearchMode, none are fully effective. DLL hijacking helps attackers escalate privileges stealthily without creating new processes and by abusing trust in signed applications.

1. DLL Hijacking
- Rashid Feroz

2. About me?
• A college grad
• Love to break into things
• Python lover

3. DLL?
• Dynamic Link Library
• Similar to exe files
• Code sharing between applications.
• Loaded at runtime only

4. Types of Dll

5. Dll Search order
• The directory from which the application is loaded
• The current directory
• The system directory, usually C:WindowsSystem32
• The 16-bit system directory
• The Windows directory
• The directories that are listed in the PATH environment
variable

6. Working

7. Finding vulnerable apps?
• Find the search order for Dlls.
• Generally custom dlls are searched for.
• Target an unavailable dll.
• Target an available dll where you can place your dll to load
first.
• Rename malicious dll and place it in the search directory.

8. SafeDllSearchMode = On
• The directory from which the application loaded
• The 16-bit system directory
• The Windows directory
• The current directory
• The directories that are listed in the PATH environment variable.

9. DllHIjacking to meterpreter
• Custom code a dll to open a reverse shell back – bypasses
AV 
• Msfvenom can already generate payloads with extension as
dll.
• Holy-grail in post exploitation phase.

10. Protection schemes?
• SafeDllSearchMode – On
• Hardcode the dll path in the program.
• Create the application with Manifest file included.
• Sadly None of them are effective. 

11. How this helps an Attacker?
• No new processes are created.
• AV’s as well as users trust signed and commonly used
applications.
• Can be used for privilege escalation.

12. Thanks 
rashid.2008feroz@gmail.com
fb.com/rashid.feroz1