examples:
- description: "Place malicious ppcore.dll in the search order location"
command: "copy malicious.dll "%PROGRAMFILES%\Microsoft Office\OFFICE%VERSION%\ppcore.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%PROGRAMFILES%\Microsoft Office\OFFICE%VERSION%\Powerpnt.exe""
ppcore.dll
Vendor: Microsoft
Expected Location: %PROGRAMFILES%\Microsoft Office\OFFICE%VERSION%
Vulnerable Executables:
- %PROGRAMFILES%\Microsoft Office\OFFICE%VERSION%\Powerpnt.exe (Sideloading)
- %PROGRAMFILES%\Microsoft Office\Root\OFFICE%VERSION%\Powerpnt.exe (Sideloading)
- %PROGRAMFILES%\Microsoft Office %VERSION%\ClientX86\Root\Office%VERSION%\Powerpnt.exe (Sideloading)
- %PROGRAMFILES%\Microsoft Office %VERSION%\ClientX64\Root\Office%VERSION%\Powerpnt.exe (Sideloading)
Acknowledgement: Swachchhanda Shrawan Poudel