05. Bring Your Own Module and Enjoy the Ride by Stefan Đurašković
Outlines 05. Bring Your Own Module and Enjoy the Ride by Stefan Đurašković and evaluates key implications for security practitioners.
Summary
## Overview Stefan Đurašković explains DLL hijacking and proxying ("Bring Your Own Module") for red teams and defenders at x33fcon.
## Windows Loader Basics DLLs extend applications via import and export address tables. The loader resolves function names and ordinals, patching the importing module's IAT before execution proceeds.
## Hijack vs. Proxy Placing a malicious DLL on the search path can work, but incomplete export implementations crash apps. Proxy DLLs forward calls (e.g., GetFileVersionInfoA) to the legitimate version.dll while injecting malicious code on load.
## Takeaways BYOM remains viable because many applications load DLLs predictably. Defenders should monitor unusual module loads; red teams gain stealthy execution without patching binaries.
Related talks
x33fcon·40 min
Engineers explore architecture and security mechanisms for 13. Erkan Ekici and Shanti Lindström: Offensive SIEM: When the Blue Team Switches Perspective.
x33fcon·43 min
12. Guillaume Couchard & Erwan Chevalier: Leveraging Landlock telemetry for Linux detection enginee.
Security researchers examine technical aspects of 12. Guillaume Couchard & Erwan Chevalier: Leveraging Landlock telemetry for Linux detection enginee..
x33fcon·45 min
Presenters detail vulnerability discovery and exploitation in 10. Levi Cailleret: EDR Introspection.