Associated Vulnerability
Title:MicroStation 多个不可信搜索路径漏洞 (CVE-2010-5230)Description:Multiple untrusted search path vulnerabilities in MicroStation 7.1 allow local users to gain privileges via a Trojan horse (1) mptools.dll, (2) baseman.dll, (3) wintab32.dll, or (4) wintab.dll file in the current working directory, as demonstrated by a directory that contains a .hln or .rdl file. NOTE: some of these details are obtained from third party information.
Description
Multiple untrusted search path vulnerabilities in MicroStation 7.1 allow local users to gain privileges via a Trojan horse (1) mptools.dll, (2) baseman.dll, (3) wintab32.dll, or (4) wintab.dll file in the current working directory, as demonstrated by a directory that contains a .hln or .rdl file. NOTE: some of these details are obtained from third party information.
Readme
# CVE-2010-5230
Multiple untrusted search path vulnerabilities in MicroStation 7.1 allow local users to gain privileges via a Trojan horse (1) mptools.dll, (2) baseman.dll, (3) wintab32.dll, or (4) wintab.dll file in the current working directory, as demonstrated by a directory that contains a .hln or .rdl file. NOTE: some of these details are obtained from third party information.
Hi folks,
After playing with windows DLL hijack toolkit,I got exploit POC for Pipe
design software Bentaly Microstation 7.1,Nero 8.2.8.0,Quicktime pictureviwer
7.6.5
Bentley Microstation 7.1:
File :Ustation.exe File type:hln Hijack Dll:mptools.dll
File :Ustation.exe File type:rdl Hijack
Dll:baseman.dll,wintab32.dll,wintab.dll
Nero 8.2.8.0
File :nero.exe File type:nab Hijack Dll:bcgpoleacc.dll
Quicktime pictureviwer 7.6.5
File :pictureviewer.exe File type:mac,pct,pic,pict,pnt,pntg,qti,qtif
Hijack Dll:cfnetwork.dll
File :pictureviewer.exe File type:pct,pic,pict,pnt,pntg,qti,qtif
Hijack Dll:corefoundation.dll
Download Link Generated POC's
https://paper.seebug.org/papers/old_sebug_paper/Exploits-Archives/2010-exploits/1008-exploits/Microstation_dllhijact_exploit.rar
https://paper.seebug.org/papers/old_sebug_paper/Exploits-Archives/2010-exploits/1008-exploits/Nero_dllhijack_exploit.rar
https://paper.seebug.org/papers/old_sebug_paper/Exploits-Archives/2010-exploits/1008-exploits/quicktime_pictureviwer_dllhijact_exploit.rar
For test cases-
http://reach2kalyan.blogspot.com/2010/08/playing-with-dll-hijack-bug.html
Kalyan
http://reach2kalyan.blogspot.com/
File Snapshot
[4.0K] /data/pocs/0ae42cd301b445d04e1e852a6f7d6a6ebea9463f
├── [8.9K] Microstation_dllhijact_exploit.rar
├── [2.3K] Nero_dllhijack_exploit.rar
├── [ 34K] quicktime_pictureviwer_dllhijact_exploit.rar
└── [1.5K] README.md
0 directories, 4 files
Remarks
1. It is advised to access via the original source first.
2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →