v1stra/wbemcomn.md

## wbemcomn.md

      
    Raw
  

              wbemcomn.md
            
          
    wbemcomn.dll

wbemcomn.dll is naturally found in C:\windows\system32, however, some WMI serves run with a working directory of C:\windows\system32\wbem. This means that DLLs might load with a search order hijack by first looking in the working directory.
This DLL hijack appears to at least effect explorer.exe and the following services:

WMI
Windows Update
WMI Performance Adapter
WSL

DLL_PROCESS_ATTACH: (12024) WmiApSrv.exe    -> "C:\Windows\system32\wbem\wbemcomn.dll"
DLL_PROCESS_ATTACH: (2988)  svchost.exe     -> "C:\Windows\system32\wbem\wbemcomn.dll"
DLL_PROCESS_ATTACH: (3452)  svchost.exe     -> "c:\windows\system32\wbem\wbemcomn.dll"
DLL_PROCESS_ATTACH: (4064)  wslservice.exe  -> "C:\Windows\system32\wbem\wbemcomn.dll"
DLL_PROCESS_ATTACH: (6052)  Explorer.EXE    -> "C:\Windows\system32\wbem\wbemcomn.dll"

sc queryex wuauserv

SERVICE_NAME: wuauserv
...
        PID                : 2988
        
sc queryex winmgmt

SERVICE_NAME: winmgmt
...
        PID                : 3452