CVE-2024-48605

This repository demonstrates a DLL hijacking vulnerability in Helakuru Desktop 1.1v, where the application attempts to load the non-existent wow64log.dll, allowing arbitrary code execution via a malicious DLL. The PoC includes a simple DLL that launches calc.exe upon loading.

This exploit leverages DLL search order hijacking in Hubstaff 1.6.13/1.6.14 by placing a malicious wow64log.dll in system32, which is loaded by the application during installation, resulting in remote code execution via a reverse shell.