Security News New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections

[silversurfer]

Content source

https://thehackernews.com/2024/01/new-variant-of-dll-search-order.html

Security researchers have detailed a new variant of a dynamic link library (DLL) search order hijacking technique that could be used by threat actors to bypass security mechanisms and achieve execution of malicious code on systems running Microsoft Windows 10 and Windows 11.

The approach "leverages executables commonly found in the trusted WinSxS folder and exploits them via the classic DLL search order hijacking technique," cybersecurity firm Security Joes said in a new report exclusively shared with The Hacker News.

 

[Andy Ful]

It can be especially dangerous when combined with DLL dropped via HTML Smuggling. Next, the attacker may convince the user to download and execute an innocent loader (EXE file, script, document, etc.) that executes a (vulnerable) legal system executable from the WinSxS system folder. The loader does not do anything wrong/malicious, so it can hardly be detected by the AV. In the home environment, the attacks via DLL hijacking have an advantage when the AV does not check DLLs (loaded by benign EXEs) against the cloud backend.

 

[NoVirusThanks]

Interesting method, thanks for sharing it.

Tried to reproduce the scenario and OSA blocked it in "Basic Protection Profile" (tested with a custom exe loader, a .bat script and from PS):

 

[Sandbox Breaker]

Wh

Interesting method, thanks for sharing it.

Tried to reproduce the scenario and OSA blocked it in "Basic Protection Profile" (tested with a custom exe loader, a .bat script and from PS):

View attachment 280667

View attachment 280668

View attachment 280669

Where did you get the POC files?

 

[NoVirusThanks]

@Sandbox Breaker

I just recreated the scenario and PoCs based on the details provided in the article:

The idea, in a nutshell, is to find vulnerable binaries in the WinSxS folder (e.g., ngentask.exe and aspnet_wp.exe) and combine it with the regular DLL search order hijacking methods by strategically placing a custom DLL with the same name as the legitimate DLL into an actor-controlled directory to achieve code execution.

As a result, simply executing a vulnerable file in the WinSxS folder by launching a command line from a shell with the custom folder containing the rogue DLL as the current directory location is enough to trigger the execution of the DLL's contents without having to copy the executable from the WinSxS folder to it.

 

[NoVirusThanks]

For those interested, have made a blog post with some more details here:

New DLL Search Order Hijacking via System Processes on WinSxS Folder | OSArmor Blog

Recently security researchers from Security Joes have reported a new variant of DLL search order hijacking technique that affects system processes located

blog.osarmor.com