Phantom Libraries: DLL Hijacking in OfficePort Scheduler

Wed, 21 Feb 2024 00:00:00 +0000

Prologue — The Ghost in the Folder
#

DLL hijacking never really died. It’s just waiting for the right developer to forget a LoadLibrary call. That’s exactly what happened with OfficePort Scheduler, a scheduling utility built for enterprise task planning on Windows 11.

Signed Once, Loaded Twice: Plugin Signature Bypass in CodeWorks IDE

Tue, 11 Apr 2023 00:00:00 +0000

Signature Bypass in CodeWorks IDE Plugin Loader
#

Prologue: Not All Checks Are Made Equal
#

It started with curiosity, like it usually does. I wasn’t even targeting CodeWorks specifically. I was just bouncing around dev tools I had lying around — checking how they loaded plugins, how they validated them, and if they did anything… out of order.

DLL Injection on

Phantom Libraries: DLL Hijacking in OfficePort Scheduler

Prologue — The Ghost in the Folder #

Signed Once, Loaded Twice: Plugin Signature Bypass in CodeWorks IDE

Signature Bypass in CodeWorks IDE Plugin Loader #

Prologue: Not All Checks Are Made Equal #

Prologue — The Ghost in the Folder
#

Signature Bypass in CodeWorks IDE Plugin Loader
#

Prologue: Not All Checks Are Made Equal
#