# GlassWireSetup.exe subject to EXE planting attack

GlassWireSetup.exe invoked CertUtil.exe via an unqualified path, letting a trojaned CertUtil.exe in the Downloads folder execute with the installer's privileges.

- Payout: $100
- Severity: high
- Program: GlassWire
- Credited: ericlaw
- Disclosed: 2016-02-04
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/107213
- Library page: https://bugbountylibrary.com/r/h1%3A107213
- Tags: domain:desktop impact:privesc kind:bounty platform:hackerone sev:high tech:windows technique:incomplete-fix vuln:path-traversal vuln:privilege-escalation

**Target:** GlassWireSetup.exe installer (Windows)
**Root cause:** Installer runs CertUtil.exe using an unqualified relative path, so Windows resolves it against the current working directory (the user's Downloads folder) instead of System32.
**Steps:**
1. Place a malicious `CertUtil.exe` in the user's `\Downloads\` folder.
2. Run `GlassWireSetup.exe` from that folder.
3. Installer resolves `CertUtil.exe` relative to CWD and executes the trojaned binary without a security warning.
**How found:** Follow-up to a previously fixed DLL hijacking in the same installer; researcher checked whether other unqualified executable invocations (CertUtil.exe) remained, and noted the absence of the usual Windows security warning indicating CreateProcess.
**Exploitation:** Attacker plants a trojaned CertUtil.exe in the Downloads directory; when the victim runs GlassWireSetup.exe from there, the installer's CreateProcess call resolves the unqualified name to the attacker binary, executing it with the installer's context.
**Insight:** After a DLL-hijacking fix, audit the same binary for unqualified CreateProcess calls to system EXEs (CertUtil, etc.) resolved via CWD; the missing SmartScreen warning is a tell that CreateProcess was used.