Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
UwAmp Arbitrary Code Execution
Platform: Windows 10 version 1904
Impact: Arbitrary Code Execution and Privilege Escalation
Product: UwAmp.exe
Version: 3.0.2
A malicous user can perform arbitrary code execution and priviledge escalation on victim machine by hijacking DLLs.
DLL Hijacking vulnerability occurs when some DLLs are missing from same directory of vulnerable binary.
Crafted Malicous DLLs are used to replace missing dlls and perform malicious actions
Missing DLL : shfolder.dll
Steps to reproduce:
1. Use ProcMon to listen on events
2. ProcMon shows shfolder.dll is missing from current directory
2. Place malicious DLL naming shfolder.dll to current directory of installer
3. Now run UwAmp.exe and installer will try to load malicous dll which leads to arbitrary code execution and privilege escalation.
1. Privilege Escalation
2. Arbitrary Code Execution
1. Avoid loading DLLs from current location
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment