Hijack Shared Module DLL Search Order

Abuse a Windows DLL search path used by a higher-privileged process: when the process loads a library by name, a same-named DLL placed in a directory searched before the legitimate copy may execute in that process's security context. This requires a user-writable searched directory and a target process that actually performs the vulnerable load. Exact DLL names, search order, service behavior, and triggers depend on the application and Windows configuration; a writable PATH entry alone does not prove a viable elevation path.