312-50V12 · Question #264
John, a security analyst, is analyzing a server suspected of being compromised. The attacker has used a non admin account and has already gained a foothold on the system. John discovers that a new Dyn
The correct answer is A. DLL Hijacking. A security analyst discovers a malicious Dynamic Link Library (DLL) loaded without a fully qualified path in an application's directory on a compromised server, indicating a privilege escalation attempt by an attacker. The specific technique used is DLL Hijacking.
Question
Options
- ADLL Hijacking
- BNamed Pipe Impersonation
- CSpectre and Meltdown Vulnerabilities
- DExploiting Misconfigured Services
How the community answered
(20 responses)- A85% (17)
- C5% (1)
- D10% (2)
Why each option
A security analyst discovers a malicious Dynamic Link Library (DLL) loaded without a fully qualified path in an application's directory on a compromised server, indicating a privilege escalation attempt by an attacker. The specific technique used is DLL Hijacking.
DLL Hijacking occurs when an application attempts to load a DLL using an unqualified path, allowing an attacker to place a malicious DLL in a directory that the application searches before finding the legitimate DLL, such as the application's own directory. By loading the malicious DLL, the attacker can execute code with the application's privileges, facilitating privilege escalation as described by the presence of a new, malicious DLL without a fully qualified path.
Named Pipe Impersonation is a privilege escalation technique involving a server impersonating a client's security context over a named pipe, which does not align with the discovery of a malicious DLL in an application directory.
Spectre and Meltdown are hardware-level side-channel vulnerabilities that allow information disclosure by exploiting speculative execution, not a software-based technique involving the loading of malicious DLLs.
Exploiting Misconfigured Services is a broader category often involving weak permissions on service executables or unquoted service paths; while it can lead to DLL loading issues, the specific scenario of an unqualified malicious DLL points directly to DLL Hijacking as the underlying technical mechanism.
Concept tested: Privilege escalation via DLL Hijacking
Source: https://learn.microsoft.com/en-us/windows/win32/dlls/security-considerations-for-dll-loading
Topics
Community Discussion
No community discussion yet for this question.