Privilege Escalation Using DLL Hijacking

• Most Windows applications do not use the fully qualified path when loading an external DLL library
  • They first search the directory from which they have been loaded
  • If attackers can place a malicious DLL in the application directory
    • The application will execute the malicious DLL in place of the real DLL
• An application program “.exe” may need library.dll (usually in the Windows system directory) to install the application
  • In case of the application failing to specify the library.dll path Windows will search for the DLL in the directory from which the application was launched
• If an attacker has already placed the DLL in the same directory as program.exe
  • then that malicious DLL will load instead of the real DLL
  • which allows the attacker to gain remote access to the target system.

Tools

• Spartacus (DLL Hijacker)

Dylib Hijacking

Dynamic Library (dylib) Hijacking is a technique used for privilege escalation in macos and similar Unix-like operating systems, analogous to DLL Hijacking in Windows.

Based on the sources, here is a detailed explanation of the nature of the vulnerability, how it is exploited, and tools used for defense:

The Nature of the Weakness (dylib Hijacking)

The weakness originates in how macOS handles Dynamic Libraries (dylib) during the execution of an application.

• Similar to Windows applications not using the fully qualified path for loading external DLLs, macos applications load an external dynamic library (dylib), and the loader searches for the dylib in multiple directories.

• The system may search the current directory first, or rely on environment variables (like DYLD_INSERT_LIBRARIES) that define locations where dynamic libraries are searched for during loading.

• Attackers exploit this flawed search order to place a weak dylib in a specified location that precedes the path of the legitimate library.

Exploitation and Impact (Privilege Escalation)

Exploiting a weak or hijackable dylib allows an attacker to inject and execute malicious code, typically resulting in privilege escalation.

• The attacker can inject a malicious dylib into one of the primary directories, or simply load the malicious dylib at runtime.

• When the target application runs, the loader automatically loads the malicious library dynamically.

• This malicious dylib loads instead of the original, allowing the attacker to gain remote access to the system.

• Attackers may use this method to perform various malicious loads, such as stealthy persistence, runtime process injection, and bypassing Gatekeeper security mechanisms.

This process is a prime example of an Application Flaw leading to a security threat, specifically falling under the category of DLL injection (or dylib injection in this context).

Tools for Detection and Defense

Security professionals and ethical hackers use specific tools designed to counter this threat:

• Dylib Hijack Scanner (DHS): This is a simple utility that can scan your computer for applications that are either susceptible to dylib hijacking or have been hijacked. DHS is used by security professionals to detect applications that have been hijacked or are vulnerable to attacks.

• Dependency Walker: Although primarily used for Windows DLLs, tools like Dependency Walker can help troubleshoot system errors related to loading and executing modules by checking common application problems such as missing modules or circular dependency errors. In the context of macOS, security professionals use tools like Dylib Hijack Scanner to detect these issues.

• Mitigation: Programmers should prevent this vulnerability by never loading untrusted DLLs/dylibs from user input and by always invoking them using the full path of the file location.