CVE-2010-3147

This exploit demonstrates a DLL hijacking vulnerability in Microsoft Windows Contacts by creating a malicious wab32res.dll that executes arbitrary code (calc.exe) when loaded by affected file types (.contact, .group, .p7c, .vcf, .wab). The DllMain function triggers the payload upon DLL initialization.

This exploit leverages DLL hijacking in Microsoft Address Book by renaming a malicious DLL to 'wab32res.dll' and placing it in a directory with a '.wab' or '.p7c' file. The DLL executes arbitrary code (e.g., 'calc.exe') when the vulnerable application loads it.

This exploit demonstrates a DLL hijacking vulnerability in Microsoft Windows 7's wab.exe by replacing the legitimate wab32res.dll with a malicious one. When a file with specific extensions is opened, the malicious DLL executes arbitrary code (calc.exe in this case).