praetorian-inc / purple-team-attack-automation

Praetorian's public release of our Metasploit automation of MITRE ATT&CK™ TTPs
Other
716 stars 118 forks source link

T1038W #13

Open daniel-infosec opened 5 years ago

daniel-infosec commented 5 years ago

Defense Evasion, Persistence, Privilege Escalation:

Windows systems use a common method to look for required DLLs to load into a program. Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence. Adversaries may perform DLL preloading, also called binary planting attacks, by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program. Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. Adversaries may use this behavior to cause the program to load a malicious DLL. Adversaries may also directly modify the way a program loads DLLs by replacing an existing DLL or modifying a .manifest or .local redirection file, directory, or junction to cause the program to load a different DLL to maintain persistence or privilege escalation.

Utilize PowerSploit's PowerUp and find dll search order hijacking

https://www.harmj0y.net/blog/powershell/powerup-v1-1-beyond-service-abuse/