DLLHijackHunter - Automated DLL Hijacking Discovery, Validation, and

项目说明

<p align="center">
<img src=" />
<img src=" />
<img src=" />
<img src=" />
<img src=" />
<img src=" />
</p>

<h1 align="center">DLLHijackHunter</h1>
<h4 align="center">By <a href="

<p align="center">
<strong>Automated DLL Hijacking Discovery, , and Confirmation</strong><br/>
<em>Turning local misconfigurations into weaponized, confirmed attack paths.</em>
</p>

---

O

DLLHijackHunter is an automated Windows DLL hijacking detection tool that goes beyond static analysis. It discovers, , and confirms DLL hijacking opportunities using a multi-phase pipeline:

1. Discovery — Enumerates binaries across services, scheduled tasks, startup items, COM objects, and AutoElevate UAC bypass
2. Filtration — Eliminates false positi intelligent hard and soft gates
3. Canary Confirmation — Deploys a harmless canary DLL and triggers the binary to prove the hijack works
4. Scoring & Reporting — Ranks findings by exploitability with a tiered confidence system

> Most DLL hijacking tools stop at “this DLL might be hijackable.” DLLHijackHunter attempts to it, cross-reference it against known exploit intelligence, and confirm real execution paths where possible.

---

Architecture

---

Key Features

Hijack Type Co

| Type | Description | Stealth | Status |
|---|---|---|---|
| Phantom | DLL doesn't exist anywhere on disk | High | Implemented |
| Search Order | Place DLL earlier in the Windows search order | High | Implemented |
| Side-Loading | Abuse legitimate app loading DLLs from its directory | High | Implemented (AutoElevate copy-to-temp path) |
| .local Redirect | Hijack via .local directory redirection | High | Implemented |
| ENV PATH | Weaponization of writable directories in system PATH | High | Implemented (curated service/DLL map) |
| AppInit DLLs | AppInit_DLLs registry abuse | Low | Implemented |
| AppCert DLLs | AppCertDLLs registry abuse (loads into every CreateProcess/WinExec caller) | Low | Implemented |
| CWD | Current Working Directory hijack | Low | Planned — not currently produced by any discovery path |

> IFEO Debugger entries are enumerated and the referenced binary is analyzed for DLL imports, but there is no dedicated IFEO/KnownDLL-bypass hijack type — those are not ad as standalone detections.

UAC Bypass Discovery

DLLHijackHunter includes dedicated UAC bypass discovery:

Targeted Knowledge Base

Filter Pipeline

The pipeline reduces false positi two stages:

Hard Gates

Soft Gates

---

Canary Confirmation

Instead of guessing, DLLHijackHunter attempts to pro work:

The canary DLL:

The bundled binaries are built from the auditable source at src/DLLHijackHunter/Resources/canary_src.c and can be regenerated with Resources/build_canary.bat (requires the MSVC C++ toolchain; the scanner does not).

> Functional-proxy exception: When a search-order hijack targets a DLL that *exists* and exposes exports, keeping the host ali confirmation requires an export-forwarding proxy. DLLHijackHunter generates this proxy at runtime through PE surgery — it grafts a synthesised .edata section onto the precompiled embedded canary entirely in-process, with no compiler required. The correct forwarder strings are computed from the DLL's export table and encoded directly into the binary. Phantom-DLL and other no-export candidates skip this step entirely; no toolchain is e.

> Signing: The embedded canaries are unsigned. Code-signing them (so they load under stricter policies and are attributable) requires a signing certificate and is left as a release-time step for the maintainer.

Export-forwarding proxy canaries

Proxy canaries are generated via runtime PE synthesis (no compiler required) and have been against real targets including services and scheduled tasks running as NT AUTHORITY\SYSTEM. The following edge cases can still cause a proxy canary to report inconclusive even when the underlying hijack is valid:

A failed proxy canary does not mean the hijack path is impossible — it means execution confirmation is inconclusive for that specific target.

---

Load-Order (--)

An opt-in, standard-user that sits between the filter pipeline and canary phase. For each applicable candidate it briefly writes a benign probe DLL to the writable hijack position, then asks the real Windows loader — in a short-li process — to resolve the DLL by name. Where the loader resol the :

Design and safety notes:

---

Comparison

| Feature | DLLHijackHunter | Robber | DLLSpy | WinPEAS | Procmon |
|---|:---:|:---:|:---:|:---:|:---:|
| Automated discovery | ✅ | ✅ | ✅ | ✅ | ❌ |
| Phantom DLL detection | ✅ | ❌ | ✅ | ❌ | ✅ |
| Search order analysis | ✅ | ❌ | ❌ | ❌ | ❌ |
| ACL-based writability check | ✅ | Partial | ❌ | Basic | ❌ |
| ETW real-time monitoring | ✅ | ❌ | ❌ | ❌ | ✅ |
| Canary confirmation | ✅¹ | ❌ | ❌ | ❌ | ❌ |
| Pri escalation check | ✅ | ❌ | ❌ | ❌ | ❌ |
| UAC bypass discovery | ✅ | ❌ | ❌ | ❌ | ❌ |
| False positi | ✅² | None | Basic | None | None |
| Reboot persistence check | ✅³ | ❌ | ❌ | ❌ | ❌ |
| Proxy DLL generation | ✅⁴ | ❌ | ❌ | ❌ | ❌ |
| Confidence scoring | ✅ | ❌ | ❌ | ❌ | ❌ |
| Auto trigger (svc/task/COM) | ✅⁵ | ❌ | ❌ | ❌ | ❌ |
| HTML/JSON reporting | ✅ | ❌ | ❌ | TXT | ❌ |
| Threat intel correlation | ✅⁶ | ❌ | ❌ | ❌ | ❌ |
| Automated PATH exploits | ✅ | ❌ | ❌ | ❌ | ❌ |
| Target-specific scanning | ✅ | ❌ | ❌ | ❌ | ✅ |
| Self-contained binary | ✅ | ❌ | ❌ | ✅ | ❌ |

_{¹ Precompiled dual-arch canaries are embedded — no compiler needed to confirm a load. Export-forwarding proxies are also generated at runtime via PE surgery — no compiler required; MSVC is a stripped-build fallback only when the embedded precompiled canary binary is absent from the assembly resources.<br/>
² ACL writability (see Filter Pipeline). It reduces — it does not eliminate — false positives; soft-gate heuristics (manifest/SxS/LoadLibraryEx) still carry uncertainty. Un static findings are now capped below the High tier.<br/>
³ Derived from auto-start status, not a reboot test.<br/>
⁴ Export-forwarding proxies are generated PE synthesis (no compiler required); edge cases such as ordinal-only exports or decorated names may limit confirmation on specific targets.<br/>
⁵ Service/Task/COM triggers only; UAC-bypass findings are not canary-triggered.<br/>
⁶ Backed by a bundled snapshot of the HijackLibs dataset (~590 entries); refreshable from hijacklibs.net.}

---

Usage

Prerequisites

Build

Quick Start

CLI Options

> Note: --min-confidence is only treated as an o when you explicitly pass it. Otherwise the selected profile's threshold is used (e.g. safe = 50%, strict = 80%).

Scan Profiles

| Profile | Use Case | Canary | ETW | UAC Bypass | Min Confidence | Triggers |
|---|---|:---:|:---:|:---:|:---:|---|
| aggressive | Full audit, lab en | ✅ | ✅ | ✅ | 15% | Services, Tasks, COM |
| strict | High-confidence findings only | ✅ | ✅ | ❌ | 80% | Services, Tasks |
| safe | Production systems, read-only | ❌ | ❌ | ❌ | 50% | None |
| redteam | Confirmed exploitable only | ✅ | ✅ | ❌ | 50% | Services, Tasks, COM |
| uac-bypass | UAC bypass only | ❌ | ❌ | ✅ | 20% | AutoElevate only |

---

Scoring

Each finding recei and impact signals that are combined into a final prioritization tier.

Typical impact considerations include:

Confirmed canary execution should be treated as the strongest signal.

Tier gating: the High and Confirmed tiers are reserved for findings backed by a proof signal — a fired canary, an ETW runtime load obser, or a documented knowledge-base match. A purely static search-order match, howe, is capped at the top of the Medium tier and annotated as Static-only so un heuristics ne as high-confidence.

Recommended triage configuration

Because writability is e attacker-relative, both elevated and standard-user runs are meaningful:

---

Safety

DLLHijackHunter is designed for defensi research, lab , auditing, and red-team simulation in authorized en.

Use it only on systems and networks you own or are explicitly authorized to assess.

Operational notes

---

Output

DLLHijackHunter supports:

Recommended workflow:
1. run a broad scan
2. review high-confidence findings
3. use canary confirmation selectively on high-value paths
4. preserve JSON/HTML output for reporting and triage

---

License

MIT

---

Credits

Built by ProjectMerai.

项目信息

开发语言：C#

Star 数：406

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Automated DLL Hijacking Discovery, Validation, and Confirmation. Turning local misconfigurations into weaponized, confirmed attack paths.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。