Robber is a free open source tool developed using Delphi XE2 without any 3rd party dependencies.
Windows has a search path for DLLs in its underlying architecture. If you can figure out what DLLs an executable requests without an absolute path (triggering this search process), you can then place your hostile DLL somewhere higher up the search path so it’ll be found before the real version is, and Windows will happily feed your attack code to the application.
So, let’s pretend Windows’s DLL search path looks something like this:
and some executable “Foo.exe” requests “bar.dll”, which happens to live in the syswow64 (D) subdir. This gives you the opportunity to place your malicious version in A), B) or C) and it will be loaded into executable.
As stated before, even an absolute full path can’t protect against this, if you can replace the DLL with your own version.
Microsoft Windows protect system pathes like System32 using Windows File Protection mechanism but the best way to protect executable from DLL hijacking in entrprise solutions is :
And of course, this isn’t really limited to Windows either. Any OS which allows for dynamic linking of external libraries is theoretically vulnerable to this.
Also ReadADModule – Microsoft Signed ActiveDirectory PowerShell Module
Robber use simple mechanism to figure out DLLs that prone to hijacking :
Have you ever come across a picture on the internet and wondered where it came…
Overview WhatsMyName is a free, community-driven OSINT tool designed to identify where a username exists…
Managing disk usage is a crucial task for Linux users and administrators alike. Understanding which…
Efficient disk space management is vital in Linux, especially for system administrators who manage servers…
Knowing how to check directory sizes in Linux is essential for managing disk space and…
Managing user accounts is a core responsibility for any Linux administrator. Whether you’re securing a…