iscsicpl_bypassUAC discloses a DLL Search Order Hijacking vulnerability affecting the iscsicpl.exe process on x64 Windows systems. This project demonstrates how a malicious DLL can be placed in a location searched by iscsicpl.exe, enabling code execution with elevated privileges. The core problem is leveraging the binary's reliance on searching %Path% for iscsiexe.dll to inject malicious DLLs.
This project provides a practical demonstration of a real-world UAC bypass technique. It's notable for exploiting a vulnerability inherent in how iscsicpl.exe handles DLL loading in 64-bit environments. The simplicity of the exploit allows for rapid understanding and potential adaptation for various scenarios.
- Exploit Mechanism: DLL Search Order Hijacking via a malicious DLL.
- Target Architecture: x64 Windows systems, specifically those running 32-bit processes.
- Prerequisites: Requires a 64-bit Windows system with UAC enabled.
- Dependency: Relies on iscsicpl.exe's behavior of searching %Path% for iscsiexe.dll.
- Ease of Use: Minimal setup; primarily involves placing a malicious DLL in the correct location.
- Attack Vector: Can be leveraged through various methods, including malicious software or targeted attacks.
- Compatibility: Tested and validated on Windows 11 and Windows 8.1 x64 desktop versions.
The project is a proof-of-concept demonstrating a known vulnerability, with no ongoing maintenance indicated. The code is relatively concise, suggesting a focused development effort. The limited information available implies it is not a widely adopted or actively supported solution.
This project is valuable to security researchers seeking to understand DLL Search Order Hijacking vulnerabilities and potential exploitation techniques. It serves as a demonstration of how to bypass UAC in specific Windows environments, highlighting the risks associated with legacy software and vulnerable system configurations. It provides insight into attack vectors that can lead to privilege escalation.