Which escalation method involves loading a malicious DLL to be used by an application?

Which escalation method involves loading a malicious DLL to be used by an application?

• A. DLL hijacking
• B. Buffer overflow
• C. Cross-site scripting
• D. SQL injection

Answer: (A)

DLL hijacking involves loading a malicious DLL to be used by an application. This happens when an app loads a library by name without a fully qualified path, so the system searches multiple locations for the DLL. An attacker can place a counterfeit DLL in a directory that the application will search first or provide a side-loaded DLL in the app’s working directory. When the application loads the library, it ends up executing the attacker’s code within the app’s process and privileges, enabling code execution and potential escalation. Buffer overflow, cross-site scripting, and SQL injection are different attack avenues: a buffer overflow overflows memory to corrupt control data, cross-site scripting injects scripts into web pages, and SQL injection manipulates database queries.

DLL hijacking involves loading a malicious DLL to be used by an application. This happens when an app loads a library by name without a fully qualified path, so the system searches multiple locations for the DLL. An attacker can place a counterfeit DLL in a directory that the application will search first or provide a side-loaded DLL in the app’s working directory. When the application loads the library, it ends up executing the attacker’s code within the app’s process and privileges, enabling code execution and potential escalation.

Buffer overflow, cross-site scripting, and SQL injection are different attack avenues: a buffer overflow overflows memory to corrupt control data, cross-site scripting injects scripts into web pages, and SQL injection manipulates database queries.