The Wiert Corner - irregular stream of stuffSave the Environment (Variable)
For my link archive as this is environment variable override trick to override DLL loading is not just limited to executables shipping with Windows, but also with other products (likely: virus scanners that run privileged); another alternative is running a local process serving the WebDAV protocol.
TL;DR β By manipulating environment variables on process level, it is possible to let trusted applications load arbitrary DLLs and execute malicious code. This post lists nearly 100 executables vulnerable to this type of DLL Hijacking on Windows 11 (21H2); it is demonstrated how this can achieved with just three lines of VBScript.
[Wayback/Archive] Save the Environment (Variable)
Via:
- [Wayback/Archive] Wietze on Twitter: βMany applications appear to rely on Environment Variables such as
%SYSTEMROOT%to load DLLs from protected locations. By changing these variables on process level, it is possible to let a legitimate program load arbitrary DLLs. Full blog post here πwietzebeukema.nl/blog/save-the-environment-variablesβ - [Wayback/Archive] Wietze on Twitter: βThis research was first presented at #DEFCON30. The slides for this talk can be found below, a video recording will be made available at a later date.
media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Wietze%20Beukema%20-%20Save%20The%20Environment%20%28Variable%29%20Hijacking%20Legitimate%20Applications%20with%20a%20Minimal%20Footprint.pdfβ - [Wayback/Archive] Jonas L on Twitter: β@Wietze but you dont need the program to use any env vars at all. you can already redirect loading of any dll as I demonstrate in my poc @ β
- [Wayback/Archive] Jonas L on Twitter: β
github.com/jonaslyk/temp/blob/main/dav.cppMy webdav based reflective loader/per process devicemap based dll injector POC is by now usable. I would really like to have a OOP wrapper for NT- designing such is surprisingly difficult, but this approach shows potential especially considering simpleβ - [Wayback/Archive] Wietze on Twitter: β@jonasLyk Youβre absolutely right, network paths including WebDav are supported, eliminating even the βplantingβ of the DLL. It should be noted however that loading DLLs from such paths is more likely to set off defensive solutions.β
- [Wayback/Archive] Jonas L on Twitter: β
βjeroen
Jelle Haandrikman πͺπΊπΊπ¦π΅πΈ
DEF CON Arsenal Tools
Blacks In Cybersecurity HQ 
BIC Village & CTF
