nerdexam
EC-Council

312-50V12 · Question #264

John, a security analyst, is analyzing a server suspected of being compromised. The attacker has used a non admin account and has already gained a foothold on the system. John discovers that a new Dyn

The correct answer is A. DLL Hijacking. A security analyst discovers a malicious Dynamic Link Library (DLL) loaded without a fully qualified path in an application's directory on a compromised server, indicating a privilege escalation attempt by an attacker. The specific technique used is DLL Hijacking.

Submitted by salim_om· Mar 4, 2026System Hacking Phases and Attack Techniques

Question

John, a security analyst, is analyzing a server suspected of being compromised. The attacker has used a non admin account and has already gained a foothold on the system. John discovers that a new Dynamic Link Library is loaded in the application directory of the affected server. This DLL does not have a fully qualified path and seems to be malicious. What privilege escalation technique has the attacker likely used to compromise this server?

Options

  • ADLL Hijacking
  • BNamed Pipe Impersonation
  • CSpectre and Meltdown Vulnerabilities
  • DExploiting Misconfigured Services

How the community answered

(20 responses)
  • A
    85% (17)
  • C
    5% (1)
  • D
    10% (2)

Why each option

A security analyst discovers a malicious Dynamic Link Library (DLL) loaded without a fully qualified path in an application's directory on a compromised server, indicating a privilege escalation attempt by an attacker. The specific technique used is DLL Hijacking.

ADLL HijackingCorrect

DLL Hijacking occurs when an application attempts to load a DLL using an unqualified path, allowing an attacker to place a malicious DLL in a directory that the application searches before finding the legitimate DLL, such as the application's own directory. By loading the malicious DLL, the attacker can execute code with the application's privileges, facilitating privilege escalation as described by the presence of a new, malicious DLL without a fully qualified path.

BNamed Pipe Impersonation

Named Pipe Impersonation is a privilege escalation technique involving a server impersonating a client's security context over a named pipe, which does not align with the discovery of a malicious DLL in an application directory.

CSpectre and Meltdown Vulnerabilities

Spectre and Meltdown are hardware-level side-channel vulnerabilities that allow information disclosure by exploiting speculative execution, not a software-based technique involving the loading of malicious DLLs.

DExploiting Misconfigured Services

Exploiting Misconfigured Services is a broader category often involving weak permissions on service executables or unquoted service paths; while it can lead to DLL loading issues, the specific scenario of an unqualified malicious DLL points directly to DLL Hijacking as the underlying technical mechanism.

Concept tested: Privilege escalation via DLL Hijacking

Source: https://learn.microsoft.com/en-us/windows/win32/dlls/security-considerations-for-dll-loading

Topics

#DLL Hijacking#privilege escalation#non-admin compromise#malicious DLL

Community Discussion

No community discussion yet for this question.

Full 312-50V12 Practice