{"uuid": "ada52d78-0330-40a9-935c-b52dbe45b998", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22000", "type": "seen", "source": "https://t.me/hacking_Attack/16746", "content": "Exploit Collector\nVMware ThinApp DLL Hijacking\n\nhttps://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png \nVMware ThinApp suffered from a dll hijacking vulnerability.\n\nMD5 | 1db2c7bddddb880c8aa2c4669670dd84\n\nDownload\nA few months ago I disclosed IBM(R) Db2(R) Windows client DLL\nHijacking Vulnerability(0day) I found:\nhttps://seclists.org/fulldisclosure/2021/Feb/73\n\nIn that post I mentioned the vulnerability did not get fully patched.\n\nAfter I told IBM on hackerone that I disclosed it, hackerone asked me\nto delete the post, IBM apologized and fully patched the\nvulnerability.\nBut this is not the point today. I found a similar problem in\nVMware-ThinApp-Enterprise-5.2.9-17340778.exe.\n\nAfter install the software create C:\\DummyTLS and rename a dll you\nwant to load to dummyTLS.dll and put it to C:\\DummyTLS\\dummyTLS.dll.\n\nRun \"C:\\Program Files (x86)\\VMware\\VMware ThinApp\\Setup Capture.exe\"\nand C:\\DummyTLS\\dummyTLS.dll will be loaded.\n(other exe like log_monitor.exe/snapshot.exe vulnerable too).\nThis is also because they use code like:\nLoadLibraryExW(L\"\\\\DummyTLS\\\\dummyTLS.dll\", 0, 0);\n\nIn short, Windows will treat relative path in LoadLibrary(and many\nother functions) as the path rooted relative to the current disk\ndesignator.\n\nLet us look into code in ntdll.dll. The logic here is:\nKernelBase!LoadLibraryExW->ntdll!LdrpLoadDll->ntdll!LdrpPreprocessDllName.\nIn LdrpPreprocessDllName after calling\nRtlDetermineDosPathNameType_Ustr it will return 4(RtlPathTypeRooted).\n\nAnd after calling LdrpGetFullPath we get \"C:\\DummyTLS\\dummyTLS.dll\"!\n\nYou should not call LoadLibrary with the relative path. In fact, using\nrelative path is dangerous in many cases.\nThis was fixed in 2021-07-13 as CVE-2021-22000 and the advisory is\nhere : https://www.vmware.com/security/advisories/VMSA-2021-0015.html.\nFor these vulnerabilities I will post a summary at https://houjingyi233.com.\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:33.604690Z"}