Corelan Cybersecurity Research

This page hosts an unofficial list of applications that are said to be vulnerable to the dll hijacking flaw (or feature or whatever you want to call it). Note that I did not test these applications myself.

If you have found other applications to be vulnerable and want to add them to the list, send me a mail.

Please note that I will not list instances where you have to replace a dll in the application folders.  I do not consider those examples to be valid cases of dll hijacking. (after all, if you have to replace a dll, you might as well replace the executable itself)

You can use the list below to build a GPO / custom adm file /.reg file, and alter the default dll loading behaviour for those applications, as explained here : http://support.microsoft.com/kb/2264107. I highly recommend looking at that page & implement the workaround (in conjunction with other suggested workarounds, such as disabling Webclient service, blocking outbound smb traffic, blocking propfind method on proxy servers, etc)

In addition to this, if you installed the workaround suggested by Microsoft, you can now use the Microsoft FixIt Tool to further refine settings.  You must have installed the CWDIllegalInDllSearch utility prior to using FixIt.

How to audit ?

If you want to test your own applications, have a look at this and this post on the metasploit blog. Make sure to grab the latest version of the audit package here or use svn update on your metasploit installation (and then copy the zip file from the external/source folder to the windows system you want to audit)

b0telh0 made a small video, demonstrating the use of the audit kit, and how it can lead to an exploit : http://www.vimeo.com/14442659

Alternatively, you can use DllHijackAuditor. It was developed to overcome some of the limitations of the DllHijackAuditkit. More info about this tool can be found here.  I highly recommend running this tool on your systems as well.

Potentially vulnerable applications :

Want to contribute ?

If you want to contribute, send the application name, version,  and file extension to peter.ve[at] corelan.be

Thanks to the people who have contributed so far : EdiStrosar, 0xjudd, xanda, Dinosn, saintanthony, PieterDanhieux, Lofi, Mark Crowther, h4ck3r#47,_coreDump, ikki, diwr, LiquidWorm, Nikhil Mittal, Chris Anderson, FInverse, Chris John Riley, nullthreat, Aung Khant, SafetyFirstXL125, spot, Classity, Jacky Jack, guelfoweb, Kervala, m1k3, Glafkos Charalambous, extraexploit, Nagareshwar Talekar, Anastasios Monachos, Antisecurity, Oliver Wege

Other info

http://support.microsoft.com/kb/2389418

http://www.microsoft.com/technet/security/advisory/2269637.mspx

http://support.microsoft.com/kb/2264107

  Copyright secured by Digiprove © 2010 Peter Van Eeckhoutte

© 2010 – 2021, Peter Van Eeckhoutte (corelanc0d3r). All rights reserved.

Similar/Related posts:

WATOBO – the unofficial manual Free tool : Windows 2003/2008 Certificate Authority Certificate List Utility for pending requests and about-to-expire certificates Setting up InfoExpress CyberArmor Suite 3.5 Exchange 2010 Certificates Juniper : Netscreen/ScreenOS to HTML (ns2html) + audit your firewall config (nipper)