examples:
- description: "Place malicious duser.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\duser.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\bdeunlock.exe""
duser.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\bdeunlock.exe (Sideloading)
- %SYSTEM32%\displayswitch.exe (Sideloading)
- %SYSTEM32%\easeofaccessdialog.exe (Sideloading)
- %SYSTEM32%\lockscreencontentserver.exe (Sideloading)
- %SYSTEM32%\mmc.exe (Sideloading)
- %SYSTEM32%\msdt.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\osk.exe (Sideloading)
- %SYSTEM32%\rekeywiz.exe (Sideloading)
- %SYSTEM32%\sessionmsg.exe (Sideloading)
- %SYSTEM32%\taskmgr.exe (Sideloading)
- %SYSTEM32%\utilman.exe (Sideloading)
Acknowledgement: Wietze
Acknowledgement: Chris Spehn