UwAmp Arbitrary Code Execution

UwAmp Arbitrary Code Execution

Platform: Windows 10 version 1904

Impact: Arbitrary Code Execution and Privilege Escalation

Product: UwAmp.exe
Version: 3.0.2

Summary:
A malicous user can perform arbitrary code execution and priviledge escalation on victim machine by hijacking DLLs.
DLL Hijacking vulnerability occurs when some DLLs are missing from same directory of vulnerable binary.
Crafted Malicous DLLs are used to replace missing dlls and perform malicious actions


Missing DLL : shfolder.dll

Steps to reproduce:
1. Use ProcMon to listen on events
2. ProcMon shows shfolder.dll is missing from current directory 
2. Place malicious DLL naming shfolder.dll to current directory of installer
3. Now run UwAmp.exe and installer will try to load malicous dll which leads to arbitrary code execution and privilege escalation.

Impact:
1. Privilege Escalation
2. Arbitrary Code Execution

Mitigation:
1. Avoid loading DLLs from current location