Some programs can be downloaded to the drive-by download directory through the browser , the easy way is to unpack the program on the /download directory (It is the default path if the user doesn't specify a custom path to extract the program) , the scan online will report the malicious.dll as vulnerable.

To more understand the situation , the program isn't installed yet (never) on the system and the malicious.dll isn't loaded .:

Can the malicious.dll placed on the /download directory be remotely exploited?

  • 1
    Check OWASP Binary Planting if you specifically mean the dll file. But unloaded, I don't think so. – Aria Oct 9 '17 at 11:18
  • 1
    To clarify you're asking if a standalone application can be hijacked by replacing the dll in the Download folder? If the standalone executable and original DLL are there then overwriting the original DLL (assuming unsigned / no other checks before loading) will cause the program to load it where it would ordinarily load the original DLL. But most browsers would automatically rename the second file rather than overwrite the original. – Hector Oct 9 '17 at 12:01
  • @Hector The system doesn't contain any application which used an unsigned (known) .dll . Only the /download folder contain a program ( e,g: game + patch to activate it illegally with a modified SHFolder.dll) , this program is download and unpacked without to be installed. – GAD3R Oct 9 '17 at 12:19
  • 1
    Yes - so in your downloads folder you've got a file.exe and library.dll where when you launch file.exe it loads library.dll as part of its execution? If you were to replace library.dll with a malicious dll then the next time file.exe attempted to load library.dll it would get the malicious version. Assuming it ran no checks (one of which could be checking a signature on library.dll) then file.exe would not know it had loaded the malicious code. However replacing library.dll from the browser without user cooperation isn't trivial. – Hector Oct 9 '17 at 12:23
  • 1
    If you are talking about running an installer (exe/msi) from the Downloads directory then as a general rule of thumb as long as you trust the installer at the time of running this action should be safe. You would nor ordinarily expect any software to check the Downloads directory for library files unless that happened to be their working directory (of course there is nothing to stop a developer writing into their code "go check ~/Downloads for loadme.dll"). If by install you simply mean running a standalone exe from ~/Downloads then there is a higher risk depending on library search order. – Hector Oct 9 '17 at 12:48

Following on from communication in comments you seem to be asking about standalone executables. I.e. if a user has downloaded a zip file containing an application, extracted it directly to the Downloads folder (i.e. not in ~/Downloads/Program/).

Assuming a loaded dll is in the same directory then if it were to be replaced with a malicious copy odds are that the exe would load it without realizing. There are mechanisms - such as signing - to avoid this risk. Its also worth noting that to replace the file from most mainstream browsers without user consent should not be possible. Not to mention if you can replace the library why can't you just replace the exe?

When an executable attempts to load a library if an explicit path/manifest is not given the system is going to search a list of potential locations in a somewhat standardised order. This is documented for windows here - https://msdn.microsoft.com/en-us/library/windows/desktop/ms682586(v=vs.85).aspx

If for some reason an executable attempts to load a non-system shared DLL that it isn't shipped with then there may be a higher risk. The directory the executable is in would usually be the first search location. This means that should this DLL be injected into the downloads directory then it would be picked up. I suppose an example might be a program that only offers certain features if another software package is installed - for example offering Microsoft Work integration if Office is installed.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.