A critical security vulnerability has been identified in nearly all Microsoft Sysinternals tools, presenting a significant risk to IT administrators and developers who rely on these utilities for system analysis and troubleshooting.

This vulnerability, outlining how attackers can exploit DLL injection techniques to execute malicious code, has been meticulously researched, verified, and demonstrated in a detailed video presentation.

Despite disclosure to Microsoft over 90 days ago, the vulnerability remains unresolved.

The Sysinternals tools, developed by Microsoft, are a widely-utilized suite of utilities designed to provide in-depth insights into the processes, services, and configurations of Windows systems. Popular tools in the collection include Process Explorer, Autoruns, and Bginfo.

While these tools are indispensable for IT administration and malware analysis, their lack of integration with the Windows Update system poses a unique challenge.

Security patches and updates for the tools must be manually managed by administrators, leaving room for potential risks when vulnerabilities arise.

Vulnerability Details: DLL Injection Exploit

The discovered vulnerability stems from how Sysinternals tools load DLL files. Specifically, many of these applications prioritize untrusted paths—such as the current working directory (CWD) or network paths over secure system directories when loading DLLs.

This oversight allows attackers to replace legitimate DLLs with malicious ones, enabling the execution of arbitrary code.

The mechanics of the attack are relatively straightforward:

The attacker crafts a malicious DLL, such as cryptbase.dll or TextShaping.dll, embedding harmful payloads.
The malicious DLL is placed in the same directory as the legitimate Sysinternals executable (e.g., Bginfo.exe).
When the user executes the application from this directory, the malicious DLL is loaded instead of the trusted system DLL.
The attacker’s code executes under the user’s privileges, potentially leading to full system compromise.

Real-World Example: Trojan Deployment via Bginfo

The vulnerability’s practical impact was demonstrated using the Bginfo tool, a utility frequently deployed in enterprise environments to display system information on user desktops.

In a simulated attack scenario, an attacker places a malicious DLL file in the same network directory as the legitimate Bginfo.exe.

During system boot, a startup script executes the Bginfo tool directly from this shared network location.

As a result, the tool inadvertently loads the malicious DLL instead of the trusted one, enabling the automatic deployment of a Trojan or other malware across multiple client systems.

“However, if the network path is provided with a prepared DLL, each client can be automatically compromised during the startup process. In this case, the Bginfo tool is loaded from the network drive and the Meterpreter is loaded and started from the DLL” Research stated in his technical writeup.

This example underscores the severe risk posed by this vulnerability, particularly in environments that rely on executing Sysinternals tools from network-based paths.

The vulnerability affects a wide range of Sysinternals applications, including but not limited to:

Process Explorer (procexp.exe, procexp64.exe)
Autoruns (autoruns.exe, autoruns64.exe)
Bginfo (bginfo.exe, bginfo64.exe)

A comprehensive list of vulnerable tools is available in an associated test sheet provided by the researcher.

Communication with Microsoft and Unresolved Status

The vulnerability was responsibly disclosed to Microsoft on October 28, 2024, following standard industry practices. However, Microsoft classified the issue as a “defense-in-depth” enhancement rather than a critical vulnerability.

This classification implies that the problem is addressed within the application’s secure usage best practices and not as a fundamental security flaw.

Microsoft’s view focuses on executable files being run from local program directories, whereas the researcher highlights the dangers of using network drives, where the network location acts as the CWD for the application.

The researcher has pointed out inconsistencies in Microsoft’s stance based on their own guidelines for handling DLL vulnerabilities.

As of the latest Sysinternals blog update from December 2024, the vulnerability remains unpatched, leaving users reliant on workarounds to mitigate risks.

Until Microsoft addresses this vulnerability, administrators and users can take several precautionary steps to reduce exposure to these attacks:

Avoid Running Tools from Network Locations: Always copy Sysinternals executables to local paths before execution.
Verify DLL Integrity: Employ security solutions to load only trusted DLLs.
Audit Your Environment: Use the provided test sheet to identify tools vulnerable to DLL injection and take the necessary safeguards.

Sysinternals tools are commonly used for malware analysis. Tools like Process Explorer help identify potentially malicious DLLs loaded by applications. However, the irony lies in that Sysinternals tools are vulnerable to DLL injection, raising questions about their overall security and robustness.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

The post 0-Day Vulnerabilities in Microsoft Sysinternals Tools Allow Attackers To Launch DLL Injection Attacks on Windows appeared first on Cyber Security News.