examples:
- description: "Place malicious cryptbase.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\cryptbase.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\alg.exe""
cryptbase.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\alg.exe (Sideloading)
- %SYSTEM32%\calc.exe (Sideloading)
- %SYSTEM32%\compmgmtlauncher.exe (Sideloading)
- %SYSTEM32%\computerdefaults.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\disksnapshot.exe (Sideloading)
- %SYSTEM32%\dpiscaling.exe (Sideloading)
- %SYSTEM32%\efsui.exe (Sideloading)
- %SYSTEM32%\filehistory.exe (Sideloading)
- %SYSTEM32%\fodhelper.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\ie4uinit.exe (Sideloading)
- %SYSTEM32%\lpksetup.exe (Sideloading)
- %SYSTEM32%\mfpmp.exe (Sideloading)
- %SYSTEM32%\mshta.exe (Sideloading)
- %SYSTEM32%\mstsc.exe (Sideloading)
- %SYSTEM32%\net1.exe (Sideloading)
- %SYSTEM32%\netplwiz.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\netsh.exe (Sideloading)
- %SYSTEM32%\presentationhost.exe (Sideloading)
- %SYSTEM32%\quickassist.exe (Sideloading)
- %SYSTEM32%\rdpclip.exe (Sideloading)
- %SYSTEM32%\rekeywiz.exe (Sideloading)
- %SYSTEM32%\resmon.exe (Sideloading)
- %SYSTEM32%\rmactivate.exe (Sideloading)
- %SYSTEM32%\rmactivate_ssp_isv.exe (Sideloading)
- %SYSTEM32%\sdclt.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\slui.exe (Sideloading)
- %SYSTEM32%\sppextcomobj.exe (Sideloading)
- %SYSTEM32%\stordiag.exe (Sideloading)
- %SYSTEM32%\tzsync.exe (Sideloading)
- %SYSTEM32%\uevappmonitor.exe (Sideloading)
- %SYSTEM32%\useraccountcontrolsettings.exe (Sideloading)
- %SYSTEM32%\workfolders.exe (Sideloading)
- %SYSTEM32%\write.exe (Sideloading)
- %SYSTEM32%\wscadminui.exe (Sideloading)
- %PROGRAMFILES%\Minecraft Launcher\MinecraftLauncher.exe (Sideloading)
- %PROGRAMFILES%\Microsoft Deployment Toolkit\Bin\Microsoft.BDD.Catalog35.exe (Sideloading)
- winbox64.exe (Sideloading)
Acknowledgement: Wietze
Acknowledgement: Chris Spehn
Acknowledgement: Andrew Oliveau
Acknowledgement: Will Summerhill
Acknowledgement: ice-wzl