Privilege Escalation and Whitelisting Bypass with Proxy DLLs
summary
Explains a hands‑on method that builds proxy DLLs which export the same functions and forward calls to a renamed legitimate copy, letting attackers persist and escalate by writing a DLL into an app’s install folder (NTFS add‑file permission) and avoiding KnownDLLs. Uses dumpbin to enumerate exports, generates #pragma stubs and a Visual Studio DLL project, places payload in DllMain (often from MSFvenom) and injects into another process. Detection is hard; use Sysinternals DLLList and EDR rules to hunt abnormal DLL loads.
AI-written summary · about
chapters (12)
- 0:00Introduction to proxy DLLs
- 1:07Understanding proxy DLLs
- 3:50Persistence and escalation
- 5:54Exploiting NTFS permissions
- 7:10Windows loader mechanics
- 9:23Avoiding known DLLs
- 11:59Executing the attack
- 16:25Building a proxy DLL
- 20:30Applying and injecting code
- 23:05Red team strategy
- 25:05Blue team defense
- 27:08Closing thoughts
related talks
38mDirty Vanity: A New Approach to Code Injection & EDR Bypass
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
41mUnveiling the Underground World of Anti-Cheats
43mSneaking Past Device Guard
51mSneaking Past Device Guard
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
48m"Sneaking Past Device Guard"
40mIn NTDLL I Trust - Process Reimaging and Endpoint Security Solution Bypass