Exploitation Summary
EIP tracks 2 public exploits for CVE-2010-3142. PoCs published by storm, TheLeader.
AI-analyzed exploit summary This exploit leverages DLL hijacking in Microsoft Office PowerPoint 2007 by replacing the legitimate 'rpawinet.dll' with a malicious version. The malicious DLL exports functions that trigger a call to 'WinExec' to launch 'calc.exe' when loaded by PowerPoint.
Description
Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse rpawinet.dll that is located in the same folder as a .odp, .pothtml, .potm, .potx, .ppa, .ppam, .pps, .ppt, .ppthtml, .pptm, .pptxml, .pwz, .sldm, .sldx, and .thmx file.
Exploits (2)
This exploit leverages DLL hijacking in Microsoft Office PowerPoint 2007 by replacing the legitimate 'rpawinet.dll' with a malicious version. The malicious DLL exports functions that trigger a call to 'WinExec' to launch 'calc.exe' when loaded by PowerPoint.
This exploit leverages DLL hijacking in Microsoft PowerPoint 2010 by replacing the legitimate pptimpconv.dll with a malicious version. When a user opens a PowerPoint file with specific extensions, the malicious DLL executes arbitrary code (e.g., launching calc.exe).