examples:
- description: "Place malicious iphlpapi.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\iphlpapi.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\arp.exe""
iphlpapi.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\arp.exe (Sideloading)
- %SYSTEM32%\colorcpl.exe (Sideloading)
- %SYSTEM32%\datausagelivetiletask.exe (Sideloading)
- %SYSTEM32%\dcdiag.exe (Sideloading)
- %SYSTEM32%\devicecensus.exe (Sideloading)
- %SYSTEM32%\dnscacheugc.exe (Sideloading)
- %SYSTEM32%\fxscover.exe (Sideloading)
- %SYSTEM32%\fxssvc.exe (Sideloading)
- %SYSTEM32%\fxsunatd.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\ipconfig.exe (Sideloading)
- %SYSTEM32%\mousocoreworker.exe (Sideloading)
- %SYSTEM32%\msra.exe (Sideloading)
- %SYSTEM32%\mstsc.exe (Sideloading)
- %SYSTEM32%\nbtstat.exe (Sideloading)
- %SYSTEM32%\net.exe (Sideloading)
- %SYSTEM32%\netbtugc.exe (Sideloading)
- %SYSTEM32%\netiougc.exe (Sideloading)
- %SYSTEM32%\netsh.exe (Sideloading)
- %SYSTEM32%\netstat.exe (Sideloading)
- %SYSTEM32%\omadmclient.exe (Sideloading)
- %SYSTEM32%\pathping.exe (Sideloading)
- %SYSTEM32%\printbrmui.exe (Sideloading)
- %SYSTEM32%\printui.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\rdpclip.exe (Sideloading)
- %SYSTEM32%\route.exe (Sideloading)
- %SYSTEM32%\tracert.exe (Sideloading)
- %SYSTEM32%\w32tm.exe (Sideloading)
- %SYSTEM32%\wfs.exe (Sideloading)
- %SYSTEM32%\wifitask.exe (Sideloading)
- %SYSTEM32%\wpnpinst.exe (Sideloading)
- %LOCALAPPDATA%\microsoft\onedrive\onedrive.exe (Search Order)
- %LOCALAPPDATA%\microsoft\onedrive\OneDriveStandaloneUpdater.exe (Search Order)
- %LOCALAPPDATA%\microsoft\teams\current\teams.exe (Search Order)
- %SYSTEM32%\dpiscaling.exe (Environment Variable)
- %SYSTEM32%\rasphone.exe (Environment Variable)
- %SYSTEM32%\slui.exe (Environment Variable)
- %PROGRAMFILES%\Minecraft Launcher\MinecraftLauncher.exe (Sideloading)
- %PROGRAMFILES%\Microsoft Deployment Toolkit\Bin\Microsoft.BDD.Catalog35.exe (Sideloading)
- %LOCALAPPDATA%\Microsoft\OneDrive\Update\OneDriveSetup.exe (Sideloading)
- %PROGRAMFILES%\WindowsApps\Microsoft.MicrosoftOfficeHub_%VERSION%\WebViewHost\WebViewHost.exe (Sideloading)
Acknowledgement: Wietze
Acknowledgement: Samir
Acknowledgement: Chris Spehn
Acknowledgement: Andrew Oliveau
Acknowledgement: Tim Peck
Acknowledgement: Will Summerhill
Acknowledgement: Josh Allman