examples:

• description: "Place malicious dbghelp.dll in the search order location" command: "copy malicious.dll "%PROGRAMFILES%\windows kits\10\debuggers\arm\dbghelp.dll""
• description: "Execute the vulnerable binary to trigger the hijack" command: ""%SYSTEM32%\bootim.exe""

dbghelp.dll

Vendor: Microsoft

Expected Location: %PROGRAMFILES%\windows kits\10\debuggers\arm

Vulnerable Executables:

• %SYSTEM32%\bootim.exe (Sideloading)
• %SYSTEM32%\dxcap.exe (Sideloading)
• %SYSTEM32%\taskkill.exe (Sideloading)
• %SYSTEM32%\tasklist.exe (Sideloading)
• %SYSTEM32%\tracerpt.exe (Sideloading)
• %SYSTEM32%\werfault.exe (Sideloading)
• %SYSTEM32%\bdehdcfg.exe (Environment Variable)
• %SYSTEM32%\deploymentcsphelper.exe (Environment Variable)
• %SYSTEM32%\djoin.exe (Environment Variable)
• %SYSTEM32%\dnscacheugc.exe (Environment Variable)
• %SYSTEM32%\ieunatt.exe (Environment Variable)
• %SYSTEM32%\muiunattend.exe (Environment Variable)
• %SYSTEM32%\netbtugc.exe (Environment Variable)
• %SYSTEM32%\netiougc.exe (Environment Variable)
• %SYSTEM32%\pnpunattend.exe (Environment Variable)
• %SYSTEM32%\reagentc.exe (Environment Variable)
• %SYSTEM32%\setupugc.exe (Environment Variable)

Acknowledgement: Wietze

Acknowledgement: Chris Spehn