Microsoft Sysinternals 0-Day Vulnerabilities Allow Attackers to Execute DLL Injection on Windows

A critical zero-day vulnerability has been identified in Microsoft’s Sysinternals tools, widely used by IT administrators and developers for system analysis and troubleshooting.

The flaw allows attackers to exploit DLL injection techniques to execute malicious code, posing a significant risk to Windows systems.

Despite being disclosed to Microsoft over 90 days ago, the vulnerability remains unpatched, raising concerns about the security of these essential utilities.

DLL Injection Exploit

The vulnerability stems from how Sysinternals tools handle the loading of Dynamic Link Libraries (DLLs).

Many of these applications prioritize untrusted paths such as the current working directory (CWD) or network paths over secure system directories when loading DLLs.

This oversight enables attackers to replace legitimate DLLs with malicious ones, leading to arbitrary code execution.

For instance, an attacker can craft a malicious DLL file (e.g., cryptbase.dll or TextShaping.dll) and place it in the same directory as a legitimate Sysinternals executable, such as Bginfo.exe.

When the application is executed from this location, the malicious DLL is loaded instead of the trusted system file.

This allows the attacker’s code to run with the user’s privileges, potentially compromising the entire system.

Trojan Deployment via Bginfo

The practical implications of this vulnerability were demonstrated using the Bginfo tool, commonly employed in enterprise environments to display desktop system information.

In a simulated attack scenario, an attacker placed a malicious DLL alongside Bginfo.exe in a network-shared directory.

When executed during system boot via a startup script, the tool inadvertently loaded the malicious DLL, enabling automatic deployment of malware such as Trojans across multiple client systems.

This example highlights the severe risks posed by executing Sysinternals tools directly from network-based paths a common practice in many organizations.

Microsoft’s Response and Mitigation Efforts

The vulnerability was responsibly disclosed to Microsoft on October 28, 2024. However, Microsoft classified it as a “defense-in-depth” issue rather than a critical flaw.

This classification implies that mitigation relies on secure usage practices rather than addressing it as a fundamental security defect.

While Microsoft emphasizes running executables from local program directories, researchers argue that network drives where the CWD becomes the application’s execution path pose significant risks.

Administrators and users are advised to implement precautionary measures to mitigate risks:

• Avoid Running Tools from Network Locations: Copy Sysinternals executables to local paths before execution.
• Verify DLL Integrity: Use security solutions that ensure only trusted DLLs are loaded.
• Audit Vulnerable Tools: Leverage available test sheets to identify affected applications and apply safeguards.

The discovery of zero-day vulnerabilities in Microsoft Sysinternals tools underscores the importance of securing even trusted utilities against potential exploits.

While these tools are indispensable for IT administration and malware analysis, their susceptibility to DLL injection attacks makes them attractive targets for adversaries.

Until Microsoft addresses these vulnerabilities, users must remain vigilant and adopt best practices to minimize exposure.

Also Read:

Chinese Hackers Target Linux Devices with New SSH Backdoor

See more