examples:
- description: "Place malicious activeds.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\activeds.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\applysettingstemplatecatalog.exe""
activeds.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\applysettingstemplatecatalog.exe (Sideloading)
- %SYSTEM32%\agentservice.exe (Sideloading)
- %SYSTEM32%\dsadd.exe (Sideloading)
- %SYSTEM32%\dsget.exe (Sideloading)
- %SYSTEM32%\dsmod.exe (Sideloading)
- %SYSTEM32%\dsrm.exe (Sideloading)
- %SYSTEM32%\gpfixup.exe (Sideloading)
Acknowledgement: Wietze
Acknowledgement: Chris Spehn