Vault7: CIA Hacking Tools Revealed
Navigation: » Directory » Remote Development Branch (RDB) » RDB Home » Umbrage » Component Library » Persistence
Windows FAX DLL Injection
This is a simple DLL hijacking attack that we have successfully tested against Windows XP,Vista and 7. A DLL named fxsst.dll normally resides in \Windows\System32 and is loaded by explorer.exe. Placing a new DLL with this name in \Windows results in this being loaded into explorer instead of the original DLL. On Windows Vista and above, the DLL‘s reference count must be increased by calling LoadLibrary on itself to avoid being unloaded.
This achieves persistence, stealth, and (in some cases) PSP avoidance.
Issues
On Windows Vista and Windows 7 the \Windows directory is protected by UAC. This requires system privileges to install and/or delete the DLL without triggering a UACUser Account Control prompt.
Source
Public Internet.
Component Use
- Sandshark
- UNKL 2.x
Previous versions:
| 1 |