Summary 

A critical 0-Day vulnerability has been identified in nearly all Microsoft Sysinternals tools, allowing attackers to exploit DLL injection techniques to execute arbitrary code. This presents a significant risk to IT administrators and developers who rely on these utilities for system analysis and troubleshooting.

OEM	Microsoft
Severity	High
Date of Announcement	2025-02-05
CVEs	Not Yet Assigned
Exploited in Wild	No
Patch/Remediation Available	No
Advisory Version	1.0
Vulnerability Name	Zero-Day

Overview 

Despite being reported to Microsoft over 90 days ago, the vulnerability remains unpatched, as Microsoft considers it a “defense-in-depth” issue rather than a critical security flaw. 

Vulnerability Name	CVE ID	Product Affected	Severity	Impact
zero-day	Not Yet Assigned	Microsoft Sysinternals Tools (Process Explorer, Autoruns, Bginfo, and potentially others)	High	Arbitrary Code Execution, Privilege Escalation, Malware Deployment

Technical Summary 

The vulnerability is caused by improper handling of DLL loading paths in affected Sysinternals utilities. When these tools search for required DLLs, they follow a specific search order, which may include untrusted locations such as network shares or user-writable directories. 

The issue arises from how Sysinternals tools prioritize DLL search paths, favoring untrusted directories such as: 

• The Current Working Directory (CWD) 

• Network locations (e.g., shared drives) 

• User-writable paths over secure system directories 

This flaw allows attackers to place a malicious DLL in the same directory as a Sysinternals executable, tricking the application into loading the rogue DLL instead of the legitimate system DLL. 

Exploit Workflow 

1. Attacker crafts a malicious DLL (e.g., cryptbase.dll or TextShaping.dll) containing a payload such as a reverse shell, ransomware, or trojan. 

2. The DLL is placed in the same directory as a vulnerable Sysinternals tool. 

3. The user unknowingly executes the tool (e.g., Bginfo.exe or procexp.exe) from that directory. 

4. The malicious DLL is loaded instead of the legitimate system DLL. 

5. Attackers gains code execution with the privileges of the running process (potentially SYSTEM privileges if run with admin rights). 

Recommendations 

1. Avoid Running Sysinternals Tools from Network Locations 

• Always copy tools to a local trusted directory before execution. 

• Disable execution of .exe files from network drives if feasible. 

2. Restrict DLL Search Paths 

• Use SafeDLLSearchMode to prioritize secure directories. 

• Implement DLL redirection to force tools to load DLLs from trusted paths. 

3. Implement Application Control Policies 

• Use AppLocker or Windows Defender Application Control (WDAC) to block unauthorized DLLs from loading. 

• Restrict execution of Sysinternals tools to trusted admin-only directories. 

4. Verify DLL Integrity Before Execution 

• Use SigCheck (Sysinternals) to ensure all loaded DLLs are digitally signed. 

• Block execution of unsigned or suspicious DLLs in sensitive directories. 

5. Monitor for Suspicious DLL Loading Behavior 

• Enable Sysmon logging to detect anomalous DLL loads (Event ID 7). 

• Monitor for executions of Sysinternals tools from network shares (Event ID 4688). 

Conclusion 

Despite being responsibly disclosed to Microsoft in October 2024, the vulnerability in Sysinternals tools remains unpatched as of February 2025. Microsoft classifies it as a “defense-in-depth” issue, dismissing it as non-critical, while security researchers highlight its severe impact on enterprises, especially those running tools from network shares. This leaves users reliant on manual mitigations to avoid exploitation.

The Sysinternals tools, developed by Microsoft, are a widely-utilized suite of utilities designed to provide in-depth insights into the processes, services, and configurations of Windows systems. 

References: 

• https://cybersecuritynews.com/0-day-vulnerabilities-in-microsoft-sysinternals-tools/ 

• https://www.reddit.com/r/blueteamsec/comments/1igqb8n/dll_hijacking_zeroday_vulnerability_in_microsoft/