examples:
- description: "Place malicious credui.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\credui.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\efsui.exe""
credui.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\efsui.exe (Sideloading)
- %SYSTEM32%\fxssvc.exe (Sideloading)
- %SYSTEM32%\gpfixup.exe (Sideloading)
- %SYSTEM32%\licmgr.exe (Sideloading)
- %SYSTEM32%\mstsc.exe (Sideloading)
- %SYSTEM32%\netdom.exe (Sideloading)
- %SYSTEM32%\nlbmgr.exe (Sideloading)
- %SYSTEM32%\perfmon.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\rekeywiz.exe (Sideloading)
- %SYSTEM32%\rpcping.exe (Sideloading)
- %SYSTEM32%\runas.exe (Sideloading)
- %SYSTEM32%\systempropertiesadvanced.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\taskmgr.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\wbadmin.exe (Sideloading)
- %SYSTEM32%\wfs.exe (Sideloading)
- %SYSTEM32%\wkspbroker.exe (Sideloading)
- %SYSTEM32%\rasphone.exe (Environment Variable)
Acknowledgement: Wietze
Acknowledgement: Chris Spehn