{"id":4621,"date":"2010-08-25T10:52:38","date_gmt":"2010-08-25T08:52:38","guid":{"rendered":"http:\/\/www.corelan.be:8800\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/"},"modified":"2010-08-25T10:52:38","modified_gmt":"2010-08-25T08:52:38","slug":"dll-hijacking-kb-2269637-the-unofficial-list","status":"publish","type":"post","link":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/","title":{"rendered":"DLL Hijacking (KB 2269637) - the unofficial list"},"content":{"rendered":"

\"hijack\"<\/a> This page hosts an unofficial list of applications that are said to be vulnerable to the dll hijacking flaw (or feature or whatever you want to call it). Note that I did not test these applications myself.<\/p>\n

If you have found other applications to be vulnerable and want to add them to the list, send me a mail.<\/p>\n

\n

Please note that I will not list instances where you have to replace<\/span> a dll in the application folders.  I do not consider those examples to be valid cases of dll hijacking. (after all, if you have to replace a dll, you might as well replace the executable itself)<\/p>\n<\/blockquote>\n

You can use the list below to build a GPO \/ custom adm file \/.reg file, and alter the default dll loading behaviour for those applications, as explained here : http:\/\/support.microsoft.com\/kb\/2264107<\/a>. I highly recommend looking at that page & implement the workaround (in conjunction with other suggested workarounds, such as disabling Webclient service, blocking outbound smb traffic, blocking propfind method on proxy servers, etc)<\/p>\n

In addition to this, if you installed the workaround<\/a> suggested by Microsoft, you can now use the Microsoft FixIt<\/a> Tool to further refine settings.  You must have installed the CWDIllegalInDllSearch<\/a> utility prior to using FixIt.<\/p>\n

 <\/p>\n

How to audit ?<\/h3>\n

If you want to test your own applications, have a look at this<\/a> and this<\/a> post on the metasploit blog. Make sure to grab the latest version of the audit package here or use svn update on your metasploit installation (and then copy the zip file from the external\/source folder to the windows system you want to audit)<\/p>\n

b0telh0<\/a> made a small video, demonstrating the use of the audit kit, and how it can lead to an exploit : http:\/\/www.vimeo.com\/14442659<\/a><\/p>\n

Alternatively, you can use DllHijackAuditor<\/a>. It was developed to overcome some of the limitations of the DllHijackAuditkit. More info about this tool can be found here<\/a>.  I highly recommend running this tool on your systems as well.<\/p>\n

 <\/p>\n

Potentially vulnerable applications :<\/h3>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Application<\/span><\/span><\/strong><\/td>\nVersion<\/span><\/span><\/strong><\/td>\n<\/tr>\n
>>> <\/span><\/strong>ADOBE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Adobe Captivate (cp, cpt, cprr, cptl, fcz, rd, rdt)
<\/strong>(winpens.dll)<\/em><\/td>\n		3<\/td>\n<\/tr>\n
Adobe Dreamweaver<\/strong>
(mfc90loc.dll, mfc90ptb.dll(lang-dependent))<\/em><\/td>\n		CS4<\/a> (<= 10.0 build 4117)
CS5<\/a> (<= 11.0 build 4909)<\/td>\n<\/tr>\n
Adobe ExtendedScript Toolkit
<\/strong>(dwmapi.dll)<\/em><\/td>\n		CS5 v3.5.0.52<\/a><\/td>\n<\/tr>\n
Adobe Extension Manager (mxi,mxp)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		CS5 v5.0.298<\/a><\/td>\n<\/tr>\n
Adobe Photoshop<\/strong>
(wintab32.dll)<\/em><\/td>\n		CS2<\/a><\/td>\n<\/tr>\n
Adobe Fireworks<\/strong><\/td>\nCS3, CS4 and CS5<\/td>\n<\/tr>\n
Adobe Device Central<\/strong>
(qtcf.dll)<\/em><\/td>\n		CS5<\/a><\/td>\n<\/tr>\n
Adobe Illustrator (ait, eps)<\/strong>
(aires.dll)<\/em><\/td>\n		CS4 v14.0.0<\/a><\/td>\n<\/tr>\n
Adobe On Location (olproj)
<\/strong>(ibfs32.dll)<\/em><\/td>\n		CS4 build 315<\/a><\/td>\n<\/tr>\n
Adobe Indesign (indl, indp, indt, inx)
<\/strong>(ibfs32.dll)<\/em><\/td>\n		CS4 v6.0<\/a><\/td>\n<\/tr>\n
Adobe Premier (pproj, prfpset, prexport, prm, prmp, prpreset, prproj, prsl, prtl, vpr)
<\/strong>(ibfs32.dll)<\/em><\/td>\n		Pro CS4 314<\/td>\n<\/tr>\n
Adobe Audition (audition.exe) (cdl, cel, dbl, dwd, pcm, sam, ses, smp, svx, vox)<\/strong>
(assist.dll, ff_theora.dll, quserex.dll, skl_drv_mpg.dll)<\/em><\/td>\n		3.0.7283.0 (Win7 x64)<\/td>\n<\/tr>\n
>>> ALLADIN<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Aladdin eToken PKI Client (etc, etcp)
<\/strong>(wintab32.dll)<\/em><\/td>\n		5.0.0.65<\/td>\n<\/tr>\n
>>> AlTools<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
AlZip (all associated archive file formats)
<\/strong>(mfc90*.dll, propsys.dll)<\/em><\/td>\n		<= 8.0.6.3<\/td>\n<\/tr>\n
AlSee (ani, bmp, cal, hdp, jpe, mac, pbm, pcx, pgm, png, psd, ras, tga, tiff)<\/strong>
(patchani.dll)<\/em><\/td>\n		<= 6.20.0.1<\/td>\n<\/tr>\n
>>> <\/span><\/strong>APPLE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Safari<\/strong>
(dwmapi.dll)<\/em><\/td>\n		<= 5.0.1<\/a><\/td>\n<\/tr>\n
Quicktime Player (mac, pic, pntg, qtif)
<\/strong>(cfnetwork.dll, corefoundation.dll)<\/em><\/td>\n		<= 7.64.17.13<\/td>\n<\/tr>\n
>>> <\/span><\/strong>ARCHICAD<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
ArchiCAD
<\/strong>(srcsrv.dll)<\/em><\/td>\n		13.0<\/td>\n<\/tr>\n
>>> <\/span><\/strong>AVAST<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Avast! (license file .avastlic)<\/strong>
(mfc90loc.dll)<\/em><\/td>\n		<= 5.0.594<\/a><\/td>\n<\/tr>\n
>>> <\/span><\/strong>AVISCREEN<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Aviscreen Pro (just a lnk file to the app will do)
<\/strong>(iccvid.dll, ir32_32.dll, yuv_32.dll, msrle32.dll, msvidc32.dll, msyuv.dll, tsbyuv.dll, iacenc.dll, tsbyuv.dll)<\/em><\/td>\n		3.1<\/td>\n<\/tr>\n
>>> BITMANAGEMENT<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
BS Contact VRML\/X3D (bskey, bswrl, bxwrl, j2k, jp2, vrml, wrl, wrz, x3dvz, x3dv, x3dz, x3d)
<\/strong>(d3dref9.dll, siappdll.dll)<\/em><\/td>\n		<= 7.218<\/td>\n<\/tr>\n
>>> <\/span><\/strong>BRAVA<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Brava PDF Reader (csf, pdf, sid, tiff, tif, xdl, xps)<\/strong>
(dwmapi.dll)<\/em><\/td>\n		<= 3.3.0.18<\/td>\n<\/tr>\n
>>> BREAKPOINT<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
HexWorkshop
<\/strong>(pe932d.dll, pe936d.dll, pegrc32d.dll)<\/em><\/td>\n		6.0.1.460.3<\/td>\n<\/tr>\n
>>> BS.Player<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
BS.player (mp3)<\/strong>
(mfc71loc.dll, ehtrace.dll)<\/em><\/td>\n		<= 2.56<\/a><\/td>\n<\/tr>\n
>>> <\/span><\/strong>CAMTASIA<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Camtasia Studio (cmmp,cmmtpl,camproj,camrec)<\/strong>
(dwmapi.dll)<\/em><\/td>\n		<= 6 build 689<\/td>\n<\/tr>\n
Camtasia Studio
<\/strong>(mfc90*.dll)<\/em><\/td>\n		7<\/td>\n<\/tr>\n
>>> <\/span><\/strong>CDISPLAY<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
CDisplay (cba, cbr, cbt, cbz)
(trace32.dll)<\/em><\/td>\n		1.8.10<\/td>\n<\/tr>\n
>>> <\/span><\/strong>CELFRAME<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
CelFrame Office Write (doc)<\/strong>
(java_msci.dll, msci_java.dll)<\/em><\/td>\n		Office Suite 2008<\/td>\n<\/tr>\n
CelFrame Office Spreadsheet (xls)
<\/strong>(java_msci.dll, msci_java.dll)<\/em><\/td>\n		Office Suite 2008<\/td>\n<\/tr>\n
CelFrame Office Publisher (sla)<\/strong>
(wintab32.dll)<\/em><\/td>\n		Office Suite 2008<\/td>\n<\/tr>\n
CelFrame Office Draw (odg)
<\/strong>((java_msci.dll, msci_java.dll)<\/em><\/td>\n		Office Suite 2008<\/td>\n<\/tr>\n
CelFrame Office Photo Album (plx)
<\/strong>(wintab32.dll)<\/em><\/td>\n		Office Suite 2008<\/td>\n<\/tr>\n
>>> <\/span><\/strong>CISCO<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Cisco Packet Tracer (pkt, pkz)<\/strong>
(wintab32.dll)<\/em><\/td>\n		5.2<\/a><\/td>\n<\/tr>\n
>>> <\/span><\/strong>CITRIX<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Citrix ICA Client  (ica)<\/strong>
(pncachen.dll, wfapi.dll)<\/td>\n		<= v9.0.32649.0<\/td>\n<\/tr>\n
>>> <\/span><\/strong>COREL<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Corel Draw (cmx,csl)<\/strong>
(crlrib.dll)<\/em><\/td>\n		<= X3 v13.0.0.576<\/a><\/td>\n<\/tr>\n
Corel PhotoPaint (cpt)
<\/strong>(crlrib.dll)<\/em><\/td>\n		<= X3 v13.0.0.576<\/a><\/td>\n<\/tr>\n
>>> <\/span><\/strong>CYBERLINK<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
PowerDirector (iso, pdl, p2g, p2i)
<\/strong>(mfc71*.dll)<\/em><\/td>\n		7<\/a><\/td>\n<\/tr>\n
Power2Go DVD (iso, pdl, p2g, p2i)
<\/strong>(mfc71*.dll)<\/em><\/td>\n		6<\/a><\/td>\n<\/tr>\n
>>> DAEMON TOOLS<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
DAEMON Tools Lite (mdf, mds, mdx)
<\/strong>(mfc80loc.dll)<\/em><\/td>\n		4.35.6.0091<\/a><\/td>\n<\/tr>\n
>>> DVDFAB<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
DVDFab Platinum (dvdfab5, dvdfabplatinum5, dvdfabgold5, dvdfabmobile)<\/strong>
(quserex.dll)<\/em><\/td>\n		5.2.3.2<\/td>\n<\/tr>\n
DVDFab (dvdfab6, dvdfab*2*, dbdfabfilemover)
<\/strong>(dwmapi.dll,mfc90*.dll,nvcuda.dll,quserex.dll)<\/em><\/td>\n		7.0.4.0<\/td>\n<\/tr>\n
>>> <\/span><\/strong>E-PRESS<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
E-Press ONE Office Author (psw)
<\/strong>(java_mcsi.dll, mcsi_java.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
E-Press ONE Office E-NoteTaker (txt)
<\/strong>(mfc71*.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
E-Press ONE Office E-Zip (rar, tar)
<\/strong>(mfc71*.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
>>> <\/span><\/strong>GDOC<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
gDoc Fusion (dwfx, jtx, pdf, xps)
<\/strong>(wintab32.dll, ssleay32.dll)<\/em><\/td>\n		<= 2.5.1<\/td>\n<\/tr>\n
>>> GUIDANCE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Encase (endump)
<\/strong>(rsaenh.dll)<\/em><\/td>\n		<= 6.17.0.90<\/a><\/td>\n<\/tr>\n
>>> ETTERCAP<\/span><\/strong><\/td>\n<= NG 0.7.3<\/a><\/td>\n<\/tr>\n
Ettercap
<\/strong>(wpcap.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
>>> <\/span><\/strong>EZBSYSTEMS<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Ultra ISO
<\/strong>(daemon.dll)<\/em><\/td>\n		Premium 9.36<\/td>\n<\/tr>\n
>>> <\/span><\/strong>FORENSIC TOOLKIT<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Forensic Toolkit (ftk)<\/strong><\/td>\n<= v1.8.1.6<\/a><\/td>\n<\/tr>\n
>>> <\/span><\/strong>FOTOBOOK<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Fotobook Editor (dtp)
<\/strong>(fwpuclnt.dll)<\/em><\/td>\n		5.0 v2.8.0.1<\/td>\n<\/tr>\n
>>> <\/span><\/strong>GFI<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
GFI Backup (gbc,gbt)
<\/strong>(armaccess.dll)<\/em><\/td>\n		2009 Home Edition<\/td>\n<\/tr>\n
>>> <\/span><\/strong>GILLES VOLLANT<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
WinImage (bzw, dsk, img, imz, iso, vfd, wil, wlz)
<\/strong>(wnaspi32.dll)<\/em><\/td>\n		8.0.0.8000 (win7 x64)<\/td>\n<\/tr>\n
>>> <\/span><\/strong>GOOGLE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Google Chrome<\/strong>
(chrome.dll)<\/em><\/td>\n		latest<\/td>\n<\/tr>\n
Google Earth (kmz)
<\/strong>(quserex.dll)<\/em><\/td>\n		<= v5.1.3535.3218<\/a><\/td>\n<\/tr>\n
>>> HTTRACK<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
WinHTTrack Website Copier (whtt)
<\/strong>(mfc71enu.dll, mfc71loc.dll)<\/em><\/td>\n		3.43-7<\/td>\n<\/tr>\n
>>> <\/span><\/strong>IBM<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Lotus Notes client (ndl,ns2,ns3,nsf,nsg,nsh,ntf)
<\/strong>(kernel32.dll)<\/em><\/td>\n		5.0.12<\/td>\n<\/tr>\n
IBM Rational License Key Administrator (upd)
<\/strong>(ibfs32.dll)<\/em><\/td>\n		< 7.0.0.0 (fixed in 7.0.0.0)<\/a><\/td>\n<\/tr>\n
Lotus Symphony Office Suite (odm, odt, otp, stc, stw, sxg, sxw)
<\/strong>(eclipse_1114.dll)<\/em><\/td>\n		<= 3 beta 4<\/td>\n<\/tr>\n
>>> <\/span><\/strong>IDM COMPUTER SOLUTIONS<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
UltraEdit (bin, cpp, css, c, dat, hpp, html, h, ini, java, log, mak, php, prj, txt, xml)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		<= 16.10.0.1036<\/td>\n<\/tr>\n
>>> INKSCAPE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Inkscape (svgz)
<\/strong>(quserex.dll)<\/em><\/td>\n		<= 0.48.0 r9654<\/td>\n<\/tr>\n
>>> <\/span><\/strong>INTERVIDEO<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Intervideo WinDVD
<\/strong>(cpqdvd.dll)<\/em><\/td>\n		5<\/a><\/td>\n<\/tr>\n
>>> INTUIT<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Quickbooks (des,qbo,qpg)
<\/strong>(dbicudtx11.dll, mfc90enu.dll, mfc90loc.dll)<\/em><\/td>\n		Pro 2010<\/td>\n<\/tr>\n
>>> IZARC<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
IZArc (all archive formats)<\/strong>
(ztv7z.dll)<\/em><\/td>\n		<= 4.1.2<\/td>\n<\/tr>\n
>>> JUNIPER \/ NCP<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
NCP Secure Client (pcf, spd, wge, wgx)
<\/strong>(dvccsabase002.dll, conman.dll, kmpapi32.dll)<\/em><\/td>\n		<= 9.23.017<\/td>\n<\/tr>\n
NCP Secure Entry Client (pcf, spd, wge, wgx)
<\/strong>(conman.dll, dvccsabase002.dll, kmpapi32.dll, ncpmon2.dll)<\/em><\/td>\n		<= 9.23.017<\/td>\n<\/tr>\n
>>> KEEPASS<\/font><\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
KeePass Password Safe (kdb)
<\/strong>(bcrypt.dll)<\/em><\/td>\n		<= 1.15
(fixed in 1.18)<\/font><\/strong><\/td>\n<\/tr>\n
KeePass Password Safe (kdbx)
<\/strong>(dwmapi.dll, bcrypt.dll<\/em>)<\/em><\/td>\n		<= 2.12
(fixed in 2.13)<\/font><\/strong><\/td>\n<\/tr>\n
>>> KINETI<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Kineti Count (kcp)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		1.0 beta<\/td>\n<\/tr>\n
>>> KINGSOFT<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Kingsoft Office Writer (doc, rtf)
<\/strong>(plgpf.dll)<\/em><\/td>\n		2010<\/td>\n<\/tr>\n
Kingsoft Office Presentation (ppt)
<\/strong>(lpgpf.dll)<\/em><\/td>\n		2010<\/td>\n<\/tr>\n
Kingsoft Office Spreadsheets (xls)
<\/strong>(plgpf.dll)<\/em><\/td>\n		2010<\/td>\n<\/tr>\n
>>> MAXTHON<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Maxthon Browser (htm, html, mhtml)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		2.5.15.1000 Unicode<\/td>\n<\/tr>\n
>>> MEDIAMONKEY<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Mediamonkey (apl, fla, m4b, mmip, mp+, mpp)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		3.2.0.1294<\/td>\n<\/tr>\n
>>> MEDIA PLAYER<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Mediaplayer Classic mpc<\/strong> (all formats)
(iacenc.dll)<\/em><\/td>\n		<= 1.3.2189.0<\/a><\/td>\n<\/tr>\n
Media Player Classic (3gp, 3gp2, flv, m4b, m4p, m4v, mp4, spl)
<\/strong>(ehtrace.dll, iacenc.dll)<\/em><\/td>\n		<= v6.4.9.x<\/a><\/td>\n<\/tr>\n
>>> <\/span><\/strong>MICROCHIP<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
mplab IDE (mcp,mcw)
<\/strong>(mfc71*.dll)<\/em><\/td>\n		8.43<\/td>\n<\/tr>\n
>>> <\/span><\/strong>MICROSOFT<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
MS Powerpoint (odp,pot,potm,pptx,ppt,ppa,pps,ppsm,ppsx,pptm,pwz,sldm,sldx)
<\/strong>(2003 : ophookse4.dll)
(pptimpconv.dll, pp7x32.dll,rpawinet.dll) - verified on 32 & 64bit<\/em><\/td>\n		2003
2007<\/a>
2010<\/a><\/td>\n<\/tr>\n
MS Word (docx)
<\/strong>(rpawinet.dll)<\/em><\/td>\n		2007<\/td>\n<\/tr>\n
MS Virtual PC<\/strong> (vmc)<\/strong>
(midimap.dll)<\/em><\/td>\n		2007<\/td>\n<\/tr>\n
Ms Visio (vtx - 2003, vss - 2010)
<\/strong>(2003 - mfc71enu.dll, 2010 - dwmapi.dll)<\/em><\/td>\n		2003<\/a>
2010<\/td>\n<\/tr>\n
MS Office Groove (wav, p7c)
<\/strong>(mso.dll)<\/em><\/td>\n		2007<\/a><\/td>\n<\/tr>\n
MS Windows Mail (nws)
<\/strong>(wab32res.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
MS Windows Live Email (eml,rss)
<\/strong>(dwmapi.dll, peerdist.dll)<\/em><\/td>\n		<= 14.0.8089.726<\/a><\/td>\n<\/tr>\n
MS Movie Maker (flv, icon, mkv, mqv, mswmn, ogg, qt, wlmp)<\/strong>
(hhctrl.ocx)<\/em><\/td>\n		<= 2.6.4038.0<\/a><\/td>\n<\/tr>\n
MS Vista Backup Manager (.wbcat)<\/strong>
(fveapi.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
MS Internet Connection Signup Wizard<\/strong>
(smmscrpt.dll)<\/em><\/td>\n		latest<\/a><\/td>\n<\/tr>\n
MS Internet Communication Settings (isp)
<\/strong>(schannel.dll)<\/em><\/td>\n		latest<\/a><\/td>\n<\/tr>\n
MS Group Convertor (grp)
<\/strong>(imm.dll)<\/em><\/td>\n		latest<\/a><\/td>\n<\/tr>\n
MS Clip Organizer (mpf)
<\/strong>(twcgst.dll)<\/em><\/td>\n		<= 11.8164.8324 (XP SP3)<\/td>\n<\/tr>\n
MS Clip Book Viewer
<\/strong>(mfaphook.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
MS Snapshot viewer (snp)<\/strong>
(mfc71enu.dll, mfc71loc.dll)<\/em><\/td>\n		11<\/td>\n<\/tr>\n
Windows Program Group \/ grpconv.exe (grp)<\/strong>
(imm.dll)<\/em><\/td>\n		latest<\/a><\/td>\n<\/tr>\n
MS Windows Address Book wab.exe\/Contacts (wab, p7c, contact, group, vcf)
<\/strong>(wab32res.dll)<\/em><\/td>\n		XP<\/a>, Vista<\/a>
silently patched on Win7<\/td>\n<\/tr>\n
MS RDP Client (rdp)
<\/strong>(dwmapi.dll - Win7, ieframe.dll - XPSP3)<\/em><\/td>\n		v6.1.7600.16385 (Win7)
v6.0.6001.18000 (XP SP3)<\/td>\n<\/tr>\n
MS Visual Studio devenv.exe (cur, rs, rct, res)
<\/strong>(NULL.dll)<\/em><\/td>\n		2008<\/td>\n<\/tr>\n
wscript (jse) \/ (js, vbs)
<\/strong>(wshfra.dll) (traceapp.dll)<\/em><\/td>\n		XP version<\/a><\/td>\n<\/tr>\n
MS Windows Media Encoder (prx)
<\/strong>(wmerrorenu.dll, winietenu.dll, asferrorenu.dll)<\/em><\/td>\n		9.00.00.2980<\/td>\n<\/tr>\n
MS ATL Trace Tool (atltracetool8.exe) (trc)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		10.0.30319.1<\/td>\n<\/tr>\n
MS DirectShow SDK Filter Graph Editor (grf)
<\/strong>(ehtrace.dll, measure.dll)<\/em><\/td>\n		10.0.0.0 (Win7 x64)<\/td>\n<\/tr>\n
MS Help & Support Center
<\/strong>(wshfra.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
MS Live Writer (wpost)
<\/strong>(peerdist.dll)<\/em><\/td>\n		<= 14.0.8089.726<\/td>\n<\/tr>\n
>>> MOOVIDA<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Moovida Media Player (f4v, flv, img, dv)
<\/strong>(libc.dll, quserex.dll)<\/em><\/td>\n		<= 2.0.0.15<\/td>\n<\/tr>\n
>>> MOZILLA<\/font><\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Firefox (htm, html, jtx, mfp, shtml, xaml)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		<= 3.6.8<\/a>
(fixed in 3.6.9 and 3.5.12)<\/font><\/strong><\/td>\n<\/tr>\n
Mozilla Thunderbird (eml,html)<\/strong>
(dwmapi.dll)<\/em><\/td>\n		3.1.2 (fixed in 3.1.3)<\/font><\/strong><\/td>\n<\/tr>\n
>>> MUVEE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Muvee Reveal (rvl)
<\/strong>(peerdist.dll)<\/em><\/td>\n		7.0.43 build 11502<\/td>\n<\/tr>\n
>>> NETSTUMBLER<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
NetStumbler (ns1)
<\/strong>(mfc71enu.dll, mfc71loc.dll)<\/em><\/td>\n		0.4.0<\/td>\n<\/tr>\n
>>> <\/span><\/strong>NITRO<\/span><\/strong><\/font><\/td>\n <\/td>\n<\/tr>\n
Nitro PDF Reader (pdf)
<\/strong>(dwmapi.dll, nprender.dll)<\/em><\/td>\n		fixed in 1.3<\/font><\/strong><\/td>\n<\/tr>\n
>>> <\/span><\/strong>NOKIA<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Nokia Suite ContentCopier
<\/strong>(wintab32.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
Nokia Suite Communication Centre<\/strong>
(wintab32.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
>>> NOTEPAD++<\/font><\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Notepad++ (shtml, css, inc, inf, ini, log, scp, wtx, shtml)
<\/strong>(scinlexer.dll)<\/em><\/td>\n		5.7 (fixed in 5.8)<\/font><\/strong><\/td>\n<\/tr>\n
>>> <\/span><\/strong>NUANCE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Nuance PDF (pdf)
<\/strong>(dwmapi.dll, exceptiondump.dll)<\/em><\/td>\n		<= 6.0<\/td>\n<\/tr>\n
>>> NULLSOFT<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Winamp (669,aac,aiff,amf,au,avr,b4s,caf,cda)
<\/strong>(wnaspi32.dll, dwmapi.dll)<\/em><\/td>\n		5.581<\/a><\/td>\n<\/tr>\n
Winamp (b4s, m3u8, m3u, pls)
<\/strong>(wnaspi32.dl)<\/em><\/td>\n		5.5.8.2985 (Win7 x64)<\/td>\n<\/tr>\n
>>> NVIDIA<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
NVidia Driver (tvp)<\/strong>
(nview.dll)<\/em><\/td>\n		latest<\/a><\/td>\n<\/tr>\n
>>> <\/span><\/strong>OMNIPEEK<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Omnipeek Personal (pkt, wac)
<\/strong>(mfc71loc.dll)<\/em><\/td>\n		4.1<\/td>\n<\/tr>\n
>>> <\/span><\/strong>OPERA<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Opera (htm, html, mht, mhtml, xht, xhtm, xhtl)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		<= 10.61<\/a><\/td>\n<\/tr>\n
Opera widgets (wgt)<\/strong><\/td>\n <\/td>\n<\/tr>\n
>>> <\/span><\/strong>ORACLE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Java Web Start (javaw.exe) (jnlp<\/strong>)
(schannel.dll)<\/em><\/td>\n		1.6 update 21<\/td>\n<\/tr>\n
>>> P<\/span><\/strong>GP<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
PGP Desktop (pgp)
<\/strong>(credssp.dll)<\/em><\/td>\n		<= 9.8<\/a><\/td>\n<\/tr>\n
PGP Desktop (p12,pem,pgp,prk,prvkr,pubkr,rnd,skr)
<\/strong>(tsp.dll, tvttsp.dll)<\/em><\/td>\n		<= 9.10
<= 10.0.0<\/td>\n<\/tr>\n
>>> <\/span><\/strong>PIXIA<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Pixia (pxa)<\/strong>
(wintab32.dll)<\/em><\/td>\n		3.1j<\/td>\n<\/tr>\n
>>> <\/span><\/strong>PUTTY<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
putty
<\/strong>(winmm.dll)<\/em><\/td>\n		0.60<\/a><\/td>\n<\/tr>\n
>>> <\/span><\/strong>QT WEB<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
QtWeb (htm, html, mhtml, xml)
<\/strong>(wintab32.dll)<\/em><\/td>\n		<= 3.3 b043<\/td>\n<\/tr>\n
>>> <\/span><\/strong>QCCIS<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Forensic CaseNotes (notes)
<\/strong>(credssp.dll)<\/em><\/td>\n		<= 1.3.2010.6<\/a><\/td>\n<\/tr>\n
>>> <\/span><\/strong>REAL<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Real Player<\/strong>
(wnaspi32.dll)<\/em><\/td>\n		<= 1.1.5 build 12.0.0.879<\/td>\n<\/tr>\n
>>> <\/span><\/strong>RIM \/ BLACKBERRY<\/span><\/strong><\/font><\/td>\n <\/td>\n<\/tr>\n
Blackberry Desktop Manager
<\/strong>(mapi32x.dll)<\/em><\/td>\n		<= 6.0.0 (fixed in 6.0.0.43)<\/strong><\/font><\/td>\n<\/tr>\n
>>> <\/span><\/strong>ROXIO<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Roxio Photosuite
<\/strong>(homeutils9.dll)<\/em><\/td>\n		9<\/a><\/td>\n<\/tr>\n
Roxio MyDVD (dmsd,dmsm)
<\/strong>(homeutils9.dll)<\/em><\/td>\n		9<\/a><\/td>\n<\/tr>\n
Roxio Creator DE<\/strong>
(homeutils9.dll)<\/em><\/td>\n		<= 9.0.116<\/a><\/td>\n<\/tr>\n
Roxi Central (c2d,cue,gi,iso,roxio)
<\/strong>(homeutils10.dll, dlaapi_w.dll, sonichttpclient10.dll, tfswapi.dll)<\/em><\/td>\n		3.6<\/td>\n<\/tr>\n
>>> <\/span><\/strong>SEAMONKEY<\/span><\/strong><\/font><\/td>\n <\/td>\n<\/tr>\n
SeaMonkey (html, xml, txt, jpg)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		<= 2.0.6 (fixed in 2.0.7)<\/font><\/strong><\/td>\n<\/tr>\n
>>> <\/span><\/strong>SI SOFTWARE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
SiSoft Sandra
<\/strong>(dwmapi.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
>>> <\/span><\/strong>SMPLAYER<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
SMPlayer
<\/strong>(wintab32.dll)<\/em><\/td>\n		0.6.9<\/td>\n<\/tr>\n
>>> <\/span><\/strong>STEAM<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Steam Games
<\/strong>(steamgamesupport.dll)<\/em><\/td>\n		 <\/td>\n<\/tr>\n
>>> <\/span><\/strong>SOMUD<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
SoMud P2P (torrent)
<\/strong>(wintab32.dll)<\/em><\/td>\n		<= 1.2.8<\/td>\n<\/tr>\n
>>> <\/span><\/strong>SONY<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Sound Forge Pro<\/strong>
(mtxparhvegaspreview.dll)<\/em><\/td>\n		10.0<\/td>\n<\/tr>\n
>>> <\/span><\/strong>SORAX<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Sorax PDF Reader (pdf)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		<= 2.0<\/td>\n<\/tr>\n
>>> <\/span><\/strong>SKYPE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Skype<\/strong>
(wab32.dll)<\/em><\/td>\n		<= 4.2.0.169<\/a><\/td>\n<\/tr>\n
>>> SWEETSCAPE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
010 Editor (lsc,bt,hex,s19,s28,s37)
<\/strong>(wintab32.dll)<\/em><\/td>\n		3.1.2<\/td>\n<\/tr>\n
>>> <\/span><\/strong>TEAMMATE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Teammate audit mgmt software suite
<\/strong>(mfc71enu.dll)<\/em><\/td>\n		v8<\/a><\/td>\n<\/tr>\n
>>> TEAMVIEWER<\/font><\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Teamviewer (tvc, tvs)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		<= 5.0.8703<\/a>
(patched in 5.1.9072)<\/font><\/strong><\/td>\n<\/tr>\n
>>> <\/span><\/strong>TECHSMITH<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
TechSmith Snagit (.snag)
<\/strong>(dwmapi.dll)<\/em><\/td>\n		<= 10 build 788<\/a><\/td>\n<\/tr>\n
TechSmith Snagit accessories (results)<\/strong><\/td>\nlatest<\/td>\n<\/tr>\n
TechSmith Snagit profiles (snagprof)<\/strong><\/td>\nlatest<\/td>\n<\/tr>\n
>>> <\/span><\/strong>TORTOISE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Tortoise SVN (all registered filetypes)<\/strong>
(dwmapi.dll)<\/em><\/td>\n		v1.6.10 (b19898)<\/td>\n<\/tr>\n
>>> <\/span><\/strong>TRACKER SOFTWARE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
PDFXChange Viewer (pdf)<\/strong>
(wintab32.dll)<\/em><\/td>\n		<= 2.0 (b54.0)<\/td>\n<\/tr>\n
>>> <\/span><\/strong>ULTRA<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Ultra VNC Viewer (vnc)
<\/strong>(vnclang.dll)<\/em><\/td>\n		<= 1.0.6.4<\/td>\n<\/tr>\n
>>> uTORRENT<\/font><\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
uTorrent
<\/strong>(userenv.dll, shfolder.dll, dnsapi.dll, dwmapi.dll, iphlpapi.dll,
dhcpcsvc.dll, dhcpcsvc6.dll, rpcrtremote.dll)
<\/em>.torrent <\/strong>(plugin_dll.dll)<\/em><\/td>\n		<= 2.0.3<\/a> \/ <= 2.0.3<\/a>
(fixed in <\/span><\/strong>2.0.4<\/span><\/strong><\/a> (b21431))<\/span><\/strong><\/td>\n<\/tr>\n
>>> VIDEOLAN<\/font><\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
VLC media player (mp3)
<\/strong>(wintab32.dll)<\/em><\/td>\n		<= 1.1.3<\/a>
(fixed in 1.1.4<\/font>)<\/span><\/strong><\/td>\n<\/tr>\n
>>> <\/span><\/strong>VIRTUAL DJ<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Virtual DJ (mp3)
<\/strong>(hdjapi.dll)<\/em><\/td>\n		6.1.2<\/td>\n<\/tr>\n
>>> <\/span><\/strong>WINMERGE<\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
WinMerge
<\/strong>(mfc71*.dll)<\/em><\/td>\n		2.12.4<\/td>\n<\/tr>\n
>>> WIRESHARK<\/font><\/span><\/strong><\/td>\n <\/td>\n<\/tr>\n
Wireshark (5vw, acp, apc, atc,bfr,cap,enc,erg,fdc,pcap,...)<\/strong>
(airpcap.dll, tcapi.dll)<\/em><\/td>\n		<= 1.2.10<\/a>
(patched in 1.4)<\/font><\/strong><\/td>\n<\/tr>\n
dumpcap (5vw, acp, apc, atc,bfr,cap,enc,erg,fdc,pcap,...)<\/strong> <\/em>
(airpcap.dll, tcapi.dll)<\/em><\/td>\n		<= 1.2.10
(patched in 1.4)<\/font><\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Want to contribute ?<\/h3>\n

If you want to contribute, send the application name, version,  and file extension to peter.ve[at] corelan.be<\/p>\n

Thanks to the people who have contributed so far : EdiStrosar<\/a>, 0xjudd<\/a>, xanda<\/a>, Dinosn<\/a>, saintanthony<\/a>, PieterDanhieux<\/a>, Lofi<\/a>, Mark Crowther, h4ck3r#47,_coreDump<\/a>, ikki<\/a>, diwr, LiquidWorm<\/a>, Nikhil Mittal<\/a>, Chris Anderson, FInverse, Chris John Riley<\/a>, nullthreat, Aung Khant<\/a>, SafetyFirstXL125, spot, Classity<\/a>, Jacky Jack, guelfoweb<\/a>, Kervala<\/a>, m1k3<\/a>, Glafkos Charalambous, extraexploit<\/a>, Nagareshwar Talekar, Anastasios Monachos, Antisecurity, Oliver Wege<\/p>\n

Other info<\/h3>\n

http:\/\/support.microsoft.com\/kb\/2389418<\/a><\/p>\n

http:\/\/www.microsoft.com\/technet\/security\/advisory\/2269637.mspx<\/p>\n

http:\/\/support.microsoft.com\/kb\/2264107<\/a><\/p>\n

\n

\"\"\/  Copyright secured by Digiprove © 2010 Peter Van Eeckhoutte<\/span><\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

This page hosts an unofficial list of applications that are said to be vulnerable to the dll hijacking flaw (or feature or whatever you want to call it). Note that I did not test these applications myself. If you have found other applications to be vulnerable and want to add them to the list, send … Continue reading \"DLL Hijacking (KB 2269637) - the unofficial list\"<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[245,127],"tags":[1828,1824],"class_list":["post-4621","post","type-post","status-publish","format-standard","hentry","category-exploits","category-security","tag-overflow","tag-metasploit"],"yoast_head":"\nDLL Hijacking (KB 2269637) - the unofficial list - Corelan | Exploit Development & Vulnerability Research<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DLL Hijacking (KB 2269637) - the unofficial list - Corelan | Exploit Development & Vulnerability Research\" \/>\n<meta property=\"og:description\" content=\"This page hosts an unofficial list of applications that are said to be vulnerable to the dll hijacking flaw (or feature or whatever you want to call it). Note that I did not test these applications myself. If you have found other applications to be vulnerable and want to add them to the list, send … Continue reading "DLL Hijacking (KB 2269637) - the unofficial list"\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/\" \/>\n<meta property=\"og:site_name\" content=\"Corelan | Exploit Development & Vulnerability Research\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/corelanconsulting\" \/>\n<meta property=\"article:published_time\" content=\"2010-08-25T08:52:38+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png\" \/>\n<meta name=\"author\" content=\"corelanc0d3r\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@corelanc0d3r\" \/>\n<meta name=\"twitter:site\" content=\"@corelanc0d3r\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/\"},\"author\":{\"name\":\"corelanc0d3r\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/person\\\/3be5542b9b0a0787893db83a5ad68e8f\"},\"headline\":\"DLL Hijacking (KB 2269637) - the unofficial list\",\"datePublished\":\"2010-08-25T08:52:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/\"},\"wordCount\":2275,\"publisher\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/#primaryimage\"},\"thumbnailUrl\":\"http:\\\/\\\/www.digiprove.com\\\/images\\\/dp_seal_trans_16x16.png\",\"keywords\":[\"overflow\",\"metasploit\"],\"articleSection\":[\"Exploits\",\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/\",\"name\":\"DLL Hijacking (KB 2269637) - the unofficial list - Corelan | Exploit Development & Vulnerability Research\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/#primaryimage\"},\"thumbnailUrl\":\"http:\\\/\\\/www.digiprove.com\\\/images\\\/dp_seal_trans_16x16.png\",\"datePublished\":\"2010-08-25T08:52:38+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/#primaryimage\",\"url\":\"http:\\\/\\\/www.digiprove.com\\\/images\\\/dp_seal_trans_16x16.png\",\"contentUrl\":\"http:\\\/\\\/www.digiprove.com\\\/images\\\/dp_seal_trans_16x16.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/08\\\/25\\\/dll-hijacking-kb-2269637-the-unofficial-list\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.corelan.be\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"DLL Hijacking (KB 2269637) – the unofficial list\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#website\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/\",\"name\":\"Corelan CyberSecurity Research\",\"description\":\"Corelan publishes in-depth tutorials on exploit development, Windows exploitation, vulnerability research, heap internals, reverse engineering and security tooling used by professionals worldwide.\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.corelan.be\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\",\"name\":\"Corelan CyberSecurity Research\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/corelanlogo2_small-20.png\",\"contentUrl\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/corelanlogo2_small-20.png\",\"width\":200,\"height\":200,\"caption\":\"Corelan CyberSecurity Research\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/corelanconsulting\",\"https:\\\/\\\/x.com\\\/corelanc0d3r\",\"https:\\\/\\\/x.com\\\/corelanconsulting\",\"https:\\\/\\\/instagram.com\\\/corelanconsult\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/person\\\/3be5542b9b0a0787893db83a5ad68e8f\",\"name\":\"corelanc0d3r\",\"pronouns\":\"he\\\/him\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"caption\":\"corelanc0d3r\"},\"description\":\"Peter Van Eeckhoutte is the founder of Corelan and a globally recognized expert in exploit development and vulnerability research. With over two decades in IT security, he built Corelan into a respected platform for deep technical research, hands-on training, and knowledge sharing. Known for his influential exploit development tutorials, tools, and real-world training, Peter combines a strong research mindset with a passion for education\u2014helping security professionals understand not just how exploits work, but why.\",\"sameAs\":[\"https:\\\/\\\/www.corelan-training.com\",\"https:\\\/\\\/instagram.com\\\/corelanc0d3r\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/petervaneeckhoutte\\\/\",\"https:\\\/\\\/x.com\\\/corelanc0d3r\"],\"url\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/author\\\/admin0\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DLL Hijacking (KB 2269637) - the unofficial list - Corelan | Exploit Development & Vulnerability Research","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/","og_locale":"en_US","og_type":"article","og_title":"DLL Hijacking (KB 2269637) - the unofficial list - Corelan | Exploit Development & Vulnerability Research","og_description":"This page hosts an unofficial list of applications that are said to be vulnerable to the dll hijacking flaw (or feature or whatever you want to call it). Note that I did not test these applications myself. If you have found other applications to be vulnerable and want to add them to the list, send … Continue reading \"DLL Hijacking (KB 2269637) - the unofficial list\"","og_url":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/","og_site_name":"Corelan | Exploit Development & Vulnerability Research","article_publisher":"https:\/\/www.facebook.com\/corelanconsulting","article_published_time":"2010-08-25T08:52:38+00:00","og_image":[{"url":"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png","type":"","width":"","height":""}],"author":"corelanc0d3r","twitter_card":"summary_large_image","twitter_creator":"@corelanc0d3r","twitter_site":"@corelanc0d3r","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/#article","isPartOf":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/"},"author":{"name":"corelanc0d3r","@id":"https:\/\/www.corelan.be\/#\/schema\/person\/3be5542b9b0a0787893db83a5ad68e8f"},"headline":"DLL Hijacking (KB 2269637) - the unofficial list","datePublished":"2010-08-25T08:52:38+00:00","mainEntityOfPage":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/"},"wordCount":2275,"publisher":{"@id":"https:\/\/www.corelan.be\/#organization"},"image":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/#primaryimage"},"thumbnailUrl":"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png","keywords":["overflow","metasploit"],"articleSection":["Exploits","Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/","url":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/","name":"DLL Hijacking (KB 2269637) - the unofficial list - Corelan | Exploit Development & Vulnerability Research","isPartOf":{"@id":"https:\/\/www.corelan.be\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/#primaryimage"},"image":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/#primaryimage"},"thumbnailUrl":"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png","datePublished":"2010-08-25T08:52:38+00:00","breadcrumb":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/#primaryimage","url":"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png","contentUrl":"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.corelan.be\/index.php\/2010\/08\/25\/dll-hijacking-kb-2269637-the-unofficial-list\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.corelan.be\/"},{"@type":"ListItem","position":2,"name":"DLL Hijacking (KB 2269637) – the unofficial list"}]},{"@type":"WebSite","@id":"https:\/\/www.corelan.be\/#website","url":"https:\/\/www.corelan.be\/","name":"Corelan CyberSecurity Research","description":"Corelan publishes in-depth tutorials on exploit development, Windows exploitation, vulnerability research, heap internals, reverse engineering and security tooling used by professionals worldwide.","publisher":{"@id":"https:\/\/www.corelan.be\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.corelan.be\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.corelan.be\/#organization","name":"Corelan CyberSecurity Research","url":"https:\/\/www.corelan.be\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.corelan.be\/#\/schema\/logo\/image\/","url":"https:\/\/www.corelan.be\/wp-content\/uploads\/2026\/03\/corelanlogo2_small-20.png","contentUrl":"https:\/\/www.corelan.be\/wp-content\/uploads\/2026\/03\/corelanlogo2_small-20.png","width":200,"height":200,"caption":"Corelan CyberSecurity Research"},"image":{"@id":"https:\/\/www.corelan.be\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/corelanconsulting","https:\/\/x.com\/corelanc0d3r","https:\/\/x.com\/corelanconsulting","https:\/\/instagram.com\/corelanconsult"]},{"@type":"Person","@id":"https:\/\/www.corelan.be\/#\/schema\/person\/3be5542b9b0a0787893db83a5ad68e8f","name":"corelanc0d3r","pronouns":"he\/him","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","url":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","caption":"corelanc0d3r"},"description":"Peter Van Eeckhoutte is the founder of Corelan and a globally recognized expert in exploit development and vulnerability research. With over two decades in IT security, he built Corelan into a respected platform for deep technical research, hands-on training, and knowledge sharing. Known for his influential exploit development tutorials, tools, and real-world training, Peter combines a strong research mindset with a passion for education\u2014helping security professionals understand not just how exploits work, but why.","sameAs":["https:\/\/www.corelan-training.com","https:\/\/instagram.com\/corelanc0d3r","https:\/\/www.linkedin.com\/in\/petervaneeckhoutte\/","https:\/\/x.com\/corelanc0d3r"],"url":"https:\/\/www.corelan.be\/index.php\/author\/admin0\/"}]}},"views":47799,"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts\/4621","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/comments?post=4621"}],"version-history":[{"count":0,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts\/4621\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/media?parent=4621"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/categories?post=4621"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/tags?post=4621"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}