Hey everyone,

We just pushed v1.2.0 of DLLHijackHunter, our automated (and zero-false-positive) DLL hijacking discovery tool.

For those unfamiliar, DLLHijackHunter doesn't just statically analyze missing DLLs; it uses a canary and a named pipe to actually prove the execution and report the exact privilege level gained (SYSTEM, High Integrity, etc.).

What's new in v1.2.0: We've built out a completely new UAC Bypass Module. Finding standard service hijacks is great, but we wanted to automate the discovery of silent UAC bypasses

.COM AutoElevation Scanning: The tool now rips through HKLM\SOFTWARE\Classes\CLSID hunting for COM objects with Elevation\Enabled=1. It checks both InprocServer32 (DLLs) and LocalServer32 (EXEs) to find bypass vectors akin to Fodhelper or CMSTPLUA.

Manifest AutoElevate: Scans System32 and SysWOW64 for binaries with the <autoElevate>true</autoElevate> XML node.

Copy & Drop Side-Load Simulation: If it finds an AutoElevate binary that doesn't call SetDllDirectory or SetDefaultDllDirectories to protect its search order, it simulates a realistic attack path where the execution is moved to a writable folder (like %TEMP%) to achieve the silent bypass.

New Profile: You can run DLLHijackHunter.exe --profile uac-bypass to exclusively hunt for these vectors.

You can grab the self-contained binary from the latest release: https://github.com/ghostvectoracademy/DLLHijackHunter