CVE-2010-5230 PoC — MicroStation 多个不可信搜索路径漏洞

Source

https://github.com/otofoto/CVE-2010-5230

Associated Vulnerability

Title:MicroStation 多个不可信搜索路径漏洞 (CVE-2010-5230)
Description:MicroStation 7.1版本中存在多个不可信搜索路径漏洞。本地攻击者可利用该漏洞通过当前目录（如包含.hln或.rdl文件的目录）下的Trojan木马(1)mptools.dll(2)baseman.dll(3) wintab32.dll或(4)wintab.dll文件，获取特权。

Description

Multiple untrusted search path vulnerabilities in MicroStation 7.1 allow local users to gain privileges via a Trojan horse (1) mptools.dll, (2) baseman.dll, (3) wintab32.dll, or (4) wintab.dll file in the current working directory, as demonstrated by a directory that contains a .hln or .rdl file. NOTE: some of these details are obtained from third party information.

Readme

# CVE-2010-5230
Multiple untrusted search path vulnerabilities in MicroStation 7.1 allow local users to gain privileges via a Trojan horse (1) mptools.dll, (2) baseman.dll, (3) wintab32.dll, or (4) wintab.dll file in the current working directory, as demonstrated by a directory that contains a .hln or .rdl file. NOTE: some of these details are obtained from third party information.

Hi folks,

After playing with windows DLL hijack toolkit,I got exploit POC for Pipe
design software Bentaly Microstation 7.1,Nero 8.2.8.0,Quicktime pictureviwer
7.6.5

 Bentley Microstation 7.1:

File :Ustation.exe  File type:hln  Hijack Dll:mptools.dll
File :Ustation.exe  File type:rdl   Hijack
Dll:baseman.dll,wintab32.dll,wintab.dll

Nero 8.2.8.0

File :nero.exe  File type:nab Hijack Dll:bcgpoleacc.dll

Quicktime pictureviwer 7.6.5

File :pictureviewer.exe   File type:mac,pct,pic,pict,pnt,pntg,qti,qtif
Hijack Dll:cfnetwork.dll
File :pictureviewer.exe   File type:pct,pic,pict,pnt,pntg,qti,qtif
Hijack Dll:corefoundation.dll

Download Link Generated POC's

https://paper.seebug.org/papers/old_sebug_paper/Exploits-Archives/2010-exploits/1008-exploits/Microstation_dllhijact_exploit.rar

https://paper.seebug.org/papers/old_sebug_paper/Exploits-Archives/2010-exploits/1008-exploits/Nero_dllhijack_exploit.rar

https://paper.seebug.org/papers/old_sebug_paper/Exploits-Archives/2010-exploits/1008-exploits/quicktime_pictureviwer_dllhijact_exploit.rar


For test cases-
http://reach2kalyan.blogspot.com/2010/08/playing-with-dll-hijack-bug.html


Kalyan
http://reach2kalyan.blogspot.com/

File Snapshot


 [4.0K]  /data/pocs/0ae42cd301b445d04e1e852a6f7d6a6ebea9463f
├── [8.9K]  Microstation_dllhijact_exploit.rar
├── [2.3K]  Nero_dllhijack_exploit.rar
├── [ 34K]  quicktime_pictureviwer_dllhijact_exploit.rar
└── [1.5K]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!