diff --git a/src/SUMMARY.md b/src/SUMMARY.md index 91c0f338a63..27171ab9bf0 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -330,10 +330,10 @@ - [AppendData/AddSubdirectory permission over service registry](windows-hardening/windows-local-privilege-escalation/appenddata-addsubdirectory-permission-over-service-registry.md) - [Create MSI with WIX](windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md) - [COM Hijacking](windows-hardening/windows-local-privilege-escalation/com-hijacking.md) - - [Dll Hijacking](windows-hardening/windows-local-privilege-escalation/dll-hijacking/README.md) - - [Advanced Html Staged Dll Sideloading](windows-hardening/windows-local-privilege-escalation/dll-hijacking/advanced-html-staged-dll-sideloading.md) + - [DLL Hijacking](windows-hardening/windows-local-privilege-escalation/dll-hijacking/README.md) + - [Advanced Html Staged DLL Sideloading](windows-hardening/windows-local-privilege-escalation/dll-hijacking/advanced-html-staged-dll-sideloading.md) - [Windows CPython Build-Landmark and sys.path Hijacking](windows-hardening/windows-local-privilege-escalation/dll-hijacking/windows-cpython-build-landmark-sys-path-hijacking.md) - - [Writable Sys Path +Dll Hijacking Privesc](windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-dll-hijacking-privesc.md) + - [Writable Sys Path +DLL Hijacking Privesc](windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-dll-hijacking-privesc.md) - [DPAPI - Extracting Passwords](windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md) - [From High Integrity to SYSTEM with Name Pipes](windows-hardening/windows-local-privilege-escalation/from-high-integrity-to-system-with-name-pipes.md) - [Integrity Levels](windows-hardening/windows-local-privilege-escalation/integrity-levels.md) diff --git a/src/windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-dll-hijacking-privesc.md b/src/windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-dll-hijacking-privesc.md index 7a54d503daa..135f38633ea 100644 --- a/src/windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-dll-hijacking-privesc.md +++ b/src/windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-dll-hijacking-privesc.md @@ -1,4 +1,4 @@ -# Writable Sys Path +Dll Hijacking Privesc +# Writable Sys Path +DLL Hijacking Privesc {{#include ../../../banners/hacktricks-training.md}} @@ -15,7 +15,7 @@ For more information about **DLL hijacking**, see: ./ {{#endref}} -## Privesc with Dll Hijacking +## Privesc with DLL Hijacking ### Finding a Missing DLL @@ -66,7 +66,7 @@ if ($envPath -notlike "*$folderPath*") { > [!TIP] > **Boot logging is only required for services that start too early** to observe otherwise. If you can **trigger the target service/program on demand** (for example, by interacting with its COM interface, restarting the service, or relaunching a scheduled task), it is usually faster to keep a normal Procmon capture with filters such as **`Path contains .dll`**, **`Result is NAME NOT FOUND`**, and **`Path begins with `**. -### Missed Dlls +### Missed DLLs Running this in a free **virtual (vmware) Windows 11 machine** I got these results: