DLL Sideloading
Last updated
Last updated
DLL Sideloading is a method that abuses the which defines the specific order that operating systems search for a DLL at runtime.
Example: a executable test.exe looks for kernel32.dll, if there exists kernel32.dll in the same directory the executable is located in, it will load that. If not, it continues down the search order.
SafeDllSearchMode is a Windows security feature that alters the sequence in which a program looks for DLL's to load. Specifically placing the current directory farther down the search order.
If SafeDllSearchMode is enabled, it can still be beat. This is because the current directory and the directory location of the executable are different:
The folder from which the application is loaded - This refers to the directory where the executable file of the application is located.
The current folder - This refers to the directory in which the application is actively executing or running from. This path can change as the application interacts with the file system during its runtime.
Below is example of the search order and the current directory:
DLL sideloading affects a wide range of legitimate binaries.
DLL sideloading can target the legitimate signed binaries, therefore allowing the payload to be executed from a legitimate binary.
DLL sideloading can be used for persistence, specifically if the targeted application is executed regularly.
