{"id":1768,"date":"2025-02-05T10:03:35","date_gmt":"2025-02-05T10:03:35","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/02\/05\/0-day-vulnerabilities-in-microsoft-sysinternals-tools-allow-attackers-to-launch-dll-injection-attacks-on-windows\/"},"modified":"2025-02-05T10:03:35","modified_gmt":"2025-02-05T10:03:35","slug":"0-day-vulnerabilities-in-microsoft-sysinternals-tools-allow-attackers-to-launch-dll-injection-attacks-on-windows","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/02\/05\/0-day-vulnerabilities-in-microsoft-sysinternals-tools-allow-attackers-to-launch-dll-injection-attacks-on-windows\/","title":{"rendered":"0-Day Vulnerabilities in Microsoft Sysinternals Tools\u00a0Allow Attackers To Launch DLL Injection Attacks on Windows"},"content":{"rendered":"

0-Day Vulnerabilities in Microsoft Sysinternals Tools\u00a0Allow Attackers To Launch DLL Injection Attacks on Windows
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical 0-Day vulnerability has been identified in nearly all Microsoft Sysinternals tools, presenting a significant risk to IT administrators and developers who rely on these utilities for system analysis and troubleshooting.<\/p>\n

This vulnerability, outlining how attackers can exploit DLL injection techniques<\/a> to execute malicious code, has been meticulously researched, verified, and demonstrated in a detailed video presentation. <\/p>\n

Despite disclosure to Microsoft over 90 days ago, the vulnerability remains unresolved.<\/p>\n

The Sysinternals tools, developed by Microsoft, are a widely-utilized suite of utilities designed to provide in-depth insights into the processes, services, and configurations of Windows systems. Popular tools in the collection include Process Explorer<\/strong>, Autoruns<\/strong>, and Bginfo<\/strong>.<\/p>\n

While these tools are indispensable for IT administration and malware analysis<\/a>, their lack of integration with the Windows Update system poses a unique challenge. <\/p>\n

Security patches and updates for the tools must be manually managed by administrators, leaving room for potential risks when vulnerabilities arise.<\/p>\n

Vulnerability Details: DLL Injection Exploit<\/strong><\/h2>\n

The discovered vulnerability stems from how Sysinternals tools load DLL files. Specifically, many of these applications prioritize untrusted paths\u2014such as the current working directory (CWD) or network paths over secure system directories when loading DLLs. <\/p>\n

This oversight allows attackers to replace legitimate DLLs with malicious ones, enabling the execution of arbitrary code.<\/p>\n

The mechanics of the attack are relatively straightforward:<\/p>\n

    \n
  1. The attacker crafts a malicious DLL, such as cryptbase.dll<\/code> or TextShaping.dll<\/code>, embedding harmful payloads.<\/li>\n
  2. The malicious DLL is placed in the same directory as the legitimate Sysinternals executable (e.g., Bginfo.exe<\/code>).<\/li>\n
  3. When the user executes the application from this directory, the malicious DLL is loaded instead of the trusted system DLL.<\/li>\n
  4. The attacker\u2019s code executes under the user\u2019s privileges, potentially leading to full system compromise.<\/li>\n<\/ol>\n

    Real-World Example: Trojan Deployment via Bginfo<\/strong><\/h2>\n

    The vulnerability\u2019s practical impact was demonstrated using the Bginfo tool, a utility frequently deployed in enterprise environments to display system information on user desktops. <\/p>\n

    \n
    \n