CVE-2010-3143
Microsoft Windows Contacts - Untrusted Search Path and DLL Hijacking via Trojan Horse wab32res.dll
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2010-3143. PoCs published by storm.
AI-analyzed exploit summary This exploit demonstrates a DLL hijacking vulnerability in Microsoft Windows Contacts by creating a malicious wab32res.dll that executes arbitrary code (calc.exe) when loaded by affected file types (.contact, .group, .p7c, .vcf, .wab). The DllMain function triggers the payload upon DLL initialization.
Description
Untrusted search path vulnerability in Microsoft Windows Contacts allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wab32res.dll that is located in the same folder as a .contact, .group, .p7c, .vcf, or .wab file. NOTE: the codebase for this product may overlap the codebase for the product referenced in CVE-2010-3147.
Exploits (3)
This exploit demonstrates a DLL hijacking vulnerability in Microsoft Windows Contacts by creating a malicious wab32res.dll that executes arbitrary code (calc.exe) when loaded by affected file types (.contact, .group, .p7c, .vcf, .wab). The DllMain function triggers the payload upon DLL initialization.
This exploit demonstrates a DLL hijacking vulnerability in Microsoft Windows 7's wab.exe by replacing the legitimate wab32res.dll with a malicious one. When a file with specific extensions is opened, the malicious DLL executes arbitrary code (calc.exe in this case).
This exploit demonstrates a DLL hijacking vulnerability in Microsoft Address Book by creating a malicious wab32res.dll that executes arbitrary code (calc.exe) when a file with a vulnerable extension (.wab, .p7c) is opened. The exploit leverages the insecure DLL loading mechanism in Windows.