360 Total Security 2016 DLL Hijacking
Posted on 09 July 2016
Aloha, *360TSE_Setup_8.2.0.1039.exe* loads and executes WindowsCodecs.dll from its "application directory". For software downloaded with a web browser the applicationdirectory is typically the user's "Downloads" directory: see < https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html >, <http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html > and <http://seclists.org/fulldisclosure/2012/Aug/134> for "prior art" about this well-known and well-documented vulnerability. If an attacker places one of the above named DLL in the user's "Downloads" directory (for example per "drive-by download" or "social engineering") this vulnerability becomes a remote code execution. Proof of concept/demonstration: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1. Create malicious dll file and save it as WindowsCodecs.dll in your "Downloads" directory. 2. Download 360 Total Security 2016 installer from https://www.360totalsecurity.com/en/ and save it in your "Downloads" directory. 3. Execute 360TSE_Setup_8.2.0.1039.exe from your "Downloads" directory. 4. Malicious dll file gets executed. Chao!! Thanks & Regards, Himanshu Mehta
