DLL Hijack

[Thomas717]

DLL Hijack

[Thomas717]

Most of them are related to delay-loading and dependecies and discovered by auto program.

[jaimecbernardo]

Can you please go into more details? /needinfo

[Thomas717]

Sorry for the delay. We've got a pretty busy schedule these days.

We discovered PowerToys to load these DLLs directly from CWD which leads to DLL hijack that can enable attacker to load their malicious DLL at startup or use M$ signed exe to load their own malicious DLL. However, the PowerToys.exe is located at Program Files so it should be considered as a minor issue.

It was caught by our own proprietary security program during a regular check.

[Thomas717]

By the way, some of them should be caused by unintended hard-coded LoadLibrary introduced by runtime linking to several API like Remote Desktop Services API (wtsapi32.dll). Just use LoadLibrary manually with proper path set and then everything should be fine.