Exploiting WinSxS: DLL Hijacking Techniques by Security Joes
Channel: FluxSec
Date: 2024-01-09

Here we take a look at DLL Search Order Hijacking as per the research done by Security Joes on 1st Jan 2024, Hide and Seek in Windows' Closet: Unmasking the WinSxS Hijacking Hideout. Full credit to Security Joes for the research! @securityjoes3114 

https://www.securityjoes.com/post/hide-and-seek-in-windows-closet-unmasking-the-winsxs-hijacking-hideout

Here we use a home built reflective DLL injector to use the technique, showing how OSINT research can benefit a strong red team.

I'd love you to come visit my blog, and don't forget to like and subscribe! https://fluxsec.red/

Legal disclaimer:

This project, including all associated source code and documentation, is developed and shared solely for educational, research, and defensive purposes in the field of cybersecurity. It is intended to be used exclusively by cybersecurity professionals, researchers, and educators to enhance understanding, develop defensive strategies, and improve security postures.

Under no circumstances shall this project be used for criminal, unethical, or any other unauthorized activities. This is meant to serve as a resource for learning and should not be employed for offensive operations or actions that infringe upon any individual's or organization's rights or privacy.

The author of this project disclaims any responsibility for misuse or illegal application of the material provided herein. By accessing, studying, or using this project, you acknowledge and agree to use the information contained within strictly for lawful purposes and in a manner that is consistent with ethical guidelines and applicable laws and regulations.