[mrpassword]

I'm researching on DLL injection right now, and my mind was rambling about some things, so I got curious, googled for a bit, but couldn't find what i needed so my questions are:

1.) Does DLL injection inherit the privileges (like administrative rights) of the process it injects to?
2.) if so; are there default windows processes that run with administrative privileges?
3.) if so; does that mean you could get into any windows machine unnoticed?

thank you in advance,
~MrPassword

[Ligeti]

Very interesting questions indeed, yet confusing lol!

In theory (and I may/could be wrong):

To start with, if we think about the definition of DLL, we can say that it is a shared process (functions/methods + data), and by process we mean a code that is "running" in the memory, OK ... the question is: who started the DLL, this may answer all your questions, because... I think that if the OS is running that DLL as part of the OS (a driver, or an API), then the DLL should has "high privileges", but if it is a part of a program that you run as a regular user/guest then you will get the privilege of that user, this is has a name, but I am not big on terminology.

I hope I was clear with my explanation...

Thanks

[mrpassword]

Very interesting questions indeed, yet confusing lol!

In theory (and I may/could be wrong):

To start with, if we think about the definition of DLL, we can say that it is a shared process (functions/methods + data), and by process we mean a code that is "running" in the memory, OK ... the question is: who started the DLL, this may answer all your questions, because... I think that if the OS is running that DLL as part of the OS (a driver, or an API), then the DLL should has "high privileges", but if it is a part of a program that you run as a regular user/guest then you will get the privilege of that user, this is has a name, but I am not big on terminology.

I hope I was clear with my explanation...

Thanks

so you are not sure either , i had the same guess but still not completely sure

[Ligeti]

lol, well... I am sure, but here how it goes:

If you want to inject a DLL as an admin to gain the privilege of an admin then ... isn't that a useless loop? I mean you are already an admin!

Long time ago (way before the existence of the great wall of China), Microsoft had this problem... anyone can access the memory of anyone else, which was a big problem as you can see, but after sending a man to the moon and the great invention of the vacuum cleaner, Microsoft OS (I think it was DOS) start limiting this access, but assigning a region of memory for each user and a new era was born, the "windows memory access violation" error that puzzled ancient hackers for hours and even days (well couple of days to be exact...)

OK enough comedy, sorry about that, the answer can be found here: http://msdn.microsoft.com/en-us/library/...85%29.aspx

Good luck and please forgive my bad taste of humor!

Thanks

[mrpassword]

don't have to apologize, i've got the same bad taste of humor.

Thanks I'll look into that

[ArkPhaze]

I'm researching on DLL injection right now, and my mind was rambling about some things, so I got curious, googled for a bit, but couldn't find what i needed so my questions are:

1.) Does DLL injection inherit the privileges (like administrative rights) of the process it injects to?
2.) if so; are there default windows processes that run with administrative privileges?
3.) if so; does that mean you could get into any windows machine unnoticed?

thank you in advance,
~MrPassword

1. That depends on what process loaded the DLL, and the permissions of that process
2. You don't have to have your DLL loaded via a default Windows program
3. Depends on how the DLL injection is done

The registry and startup locations for persistence are too easy to detect, and they are also far too common to be undetected by a trained power user as well. DLL injection without leaving a forensic footprint can be done by taking advantage of the DLL search order for when DLL's are loaded.. Look here: http://msdn.microsoft.com/en-us/library/...S.85).aspx

The trivial part of the information embedded in that link is that the first priority is the directory of the executable itself for first search, unless the DLL name is listed within the registry in the KnownDLLs object... However, certain dll's are loaded when these KnownDLLs are loaded by a process, and because they aren't listed in the KnownDLLs object, they can be placed within the directory of the executable which calls to load a dll listed in the registry, and have it load the malicious dll when the program starts. Combine this theory with a startup program and you've got a dangerous combination. This doesn't come without a bit of maintenance though, because you still need to load the proper DLL for the program to function correctly.

Because DLL's are loaded from the System32 directory from the KnownDLLs object, this means that the executables within System32 are not vulnerable to such strategies...

The retarded part about Windows is that not all startup executables that are default for Windows reside under System32; explorer.exe, among others...

The last thing here to note is an obvious one, but the DLL placed in the executable's directory, cannot already exist.

Other than that, the extent of this issue on Windows is phenomenally vast. Vulnerable processes are not limited to Windows executables, however the inherited permissions from the process which is attached to the loaded dll vary.