DLL Hijacking » THOVITI SIDDHARTH

DLL Hijacking

March 9, 2024

AppSanity – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec ASPX, chisel, DLL Hijacking, dnSpy, ffuf, HackTheBox, HTB, JWT, metasploit, meterpreter, Session Hijacking, SSRF, Windows 0

Machine Name: AppSanity
IP: 10.10.11.238
Difficulty: Hard

Summary

AppSanity is a hard difficulty machine that starts with subdomain enumeration and manipulation of the registration process. Utilizing JWT for session hijacking, the journey led to SSRF and finally gaining a user shell through bypassing file-type restrictions. For privilege escalation, analysis of the ExaminationManagement.dll revealed a registry key, providing user credentials. Reverse port forwarding via Chisel unveiled the service on port 100, enabling exploitation of DLL hijacking to escalate privileges and eventually access administrator shell and root flag.

April 16, 2022

DLL Hijacking for Privilege Escalation and Persistence

Thoviti Siddharth Infosec DLL Hijacking, Persistence, Privilege Escalation, Windows Privilege Escalation 0

Is DLL Hijacking a vulnerability?
Read until the end to find out!

In this blog-post, I introduce DLL Hijacking, how this method can be exploited to achieve privilege escalation and persistence, and demonstrate the same through three lab simulations. I also list some defenses against DLL Hijacking at the end. To understand DLL Hijacking, it is important to understand what DLLs are and how the DLL Search Order works.