POJIA破甲
地图 / DLL hijacking in Monero GUI for Windows 0.17.3.0 would allow an attacker to perform remote command execution

DLL hijacking in Monero GUI for Windows 0.17.3.0 would allow an attacker to perform remote command execution

代码执行 / 代码注入 / #1437942

厂商
Monero
严重程度
低危
赏金
—
弱点
代码注入
研究员
@fukuyama
披露日期
2021-12-30
资产
—
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(2422 字符中的一小部分)
Summary: Monero for windows contains a DLL hijacking vulnerability that allows to get a meterpreter command (metasploit remote shell), The moment the victim runs the program it will execute our payload (malicious .dll) that will give an attacker a meterpreter console. This will allow the attacker …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Monero 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @fukuyama · 版权归作者与 Monero 所有

同类报告

RCE via npm misconfig -- installing internal libraries from the public registryPayPal · 2021-02-09 · $30,000Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' ApplicationPlayStation · 2020-12-04 · $15,000[phpobject in cookie] Remote shell/command executionPornhub · — · $20,000RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Starbucks · 2019-04-10Remote Code Execution in Slack desktop apps + bonusSlack · 2020-08-28RCE when removing metadata with ExifToolGitLab · 2021-05-14 · $20,000