DLL ForwardSideLoading

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.hexacorn.com/blog/2025/08/19/dll-forwardsideloading/
• Blog Title: DLL ForwardSideLoading
• Suggested Section: Windows -> Persistence/Execution -> DLL Hijacking & Sideloading (add subsection: Abusing Forwarded Exports / ForwardSideLoading)

🎯 Content Summary

DLL ForwardSideLoading: Abusing Forwarded Exports to Achieve Code Execution

This post introduces “DLL ForwardSideLoading”, a Windows DLL sideloading variant that abuses forwarded exports to achieve code execution via an attacker-controlled DLL loaded under a benign, signed chain. It explains how forwarded exports work, identifies a concrete non‑KnownDLL forward on Windows 11, and demonstrates a copy‑paste PoC.

How Forwarded Exports Work (PE/Loader Behavior)🔧 Technical Details

Abusing forwarded exports for indirect sideloading: Identify a signed DLL whose exported function forwards to a target module that is not a KnownDLL (e.g., keyiso.dll KeyIsoSetAuditingInterface -> NCRYPTPROV.SetAuditingInterface). Place that signed DLL and a malicious DLL named exactly as the forwarded target module (e.g., NCRYPTPROV.dll) in the same directory. Invoke the forwarded export (e.g., via rundll32.exe <path\dll>, <ExportName...

🤖 Agent Actions

I analyzed the blog and HackTricks repo, searched for existing DLL hijacking/sideloading coverage, and read these relevant files:

• src/windows-hardening/av-bypass.md
• src/windows-hardening/windows-local-privilege-escalation/dll-hijacking.md
• src/windows-hardening/windows-local-privilege-escalation/dll-hijacking/README.md
• src/windows-hardening/windows-local-privilege-escalation/README.md
• src/generic-hacking/reverse-shells/windows.md

Decision and implementation:

• Best fit for this technique is the existing “DLL Sideloading & Proxying” section within av-bypass.md, which already covers Windows DLL sideloading holistically (not only LPE). I added a dedicated subsection on abusing forwarded exports (ForwardSideLoading) that:
  • Explains how PE forwarded exports work (TargetDll.TargetFu...

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.hexacorn.com/blog/2025/08/19/dll-forwardsideloading/

Content Categories: Based on the analysis, this content was categorized under "Windows -> Persistence/Execution -> DLL Hijacking & Sideloading (add subsection: Abusing Forwarded Exports / ForwardSideLoading)".

Repository Maintenance:

• MD Files Formatting: 871 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge