examples:
- description: "Place malicious profapi.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\profapi.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\certreq.exe""
profapi.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\certreq.exe (Sideloading)
- %SYSTEM32%\edpcleanup.exe (Sideloading)
- %SYSTEM32%\immersivetpmvscmgrsvr.exe (Sideloading)
- %SYSTEM32%\manage-bde.exe (Sideloading)
- %SYSTEM32%\mousocoreworker.exe (Sideloading)
- %SYSTEM32%\omadmclient.exe (Sideloading)
- %SYSTEM32%\provtool.exe (Sideloading)
- %SYSTEM32%\rmttpmvscmgrsvr.exe (Sideloading)
- %SYSTEM32%\tpmvscmgrsvr.exe (Sideloading)
- %SYSTEM32%\usocoreworker.exe (Sideloading)
- %SYSTEM32%\wwahost.exe (Sideloading)
- %SYSTEM32%\write.exe (Sideloading)
- %PROGRAMFILES%\Microsoft Deployment Toolkit\Bin\Microsoft.BDD.Catalog35.exe (Sideloading)
Acknowledgement: Chris Spehn
Acknowledgement: Will Summerhill