Exam 312-50v12 topic 1 question 246 discussion

Actual exam question from ECCouncil's 312-50v12

Question #: 246
Topic #: 1

John, a security analyst, is analyzing a server suspected of being compromised. The attacker has used a non admin account and has already gained a foothold on the system. John discovers that a new Dynamic Link Library is loaded in the application directory of the affected server. This DLL does not have a fully qualified path and seems to be malicious. What privilege escalation technique has the attacker likely used to compromise this server?

A. DLL Hijacking
B. Named Pipe Impersonation
C. Spectre and Meltdown Vulnerabilities
D. Exploiting Misconfigured Services

Show Suggested Answer

Suggested Answer: A 🗳️

by DarioReymag at Feb. 6, 2024, 10:38 p.m.

Comments

Submit Cancel

ethacker2

10 months, 1 week ago

A. DLL Hijacking CEHv12 Book Module 6 p.711 Most Windows applications do not use the fully qualified path when loading an external DLL library; instead, they first search the directory from which they have been loaded. Taking this as an advantage, if attackers can place a malicious DLL in the application directory, the application will execute the malicious DLL in place of the real DLL. For example, if an application program “.exe” needs library.dll (usually in the Windows system directory) to install the application, and fails to specify the library.dll path, Windows will search for the DLL in the directory from which the application was launched. If an attacker has already placed the DLL in the same directory as program.exe, then that malicious DLL will load instead of the real DLL, which allows the attacker to gain remote access to the target system.

upvoted 3 times

...