# Arbitrary Code Injection in ownCloud’s Windows Client

ownCloud Windows client loads Qt plugins from a world-writable C:\usr\... path, letting any local user plant a malicious DLL that executes on next launch.

- Payout: hidden
- Severity: high
- Program: ownCloud
- Found by: fbogner
- Disclosed: 2016-11-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/155657
- Library page: https://bugbountylibrary.com/r/h1%3A155657
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:high tech:windows technique:reverse-engineering vuln:command-injection vuln:privilege-escalation

**Target:** ownCloud Windows Desktop client Qt plugin loading path
**Root cause:** The client loads Qt extensions from C:\usr\i686-w64-mingw32\sys-root\mingw\lib\qt5\plugins, a path any authenticated Windows user can create and write to, so a planted DLL is loaded on launch.
**Steps:**
1. Create the folder tree C:\usr\i686-w64-mingw32\sys-root\mingw\lib\qt5\plugins\platforms as a normal user.
2. Disassemble qwindows.dll with Hopper to identify entry points.
3. Generate shellcode: `msfvenom -a x86 --platform windows -p windows/messagebox TEXT="DLL Loaded" EXTIFUNC=process -f raw > shellcode`.
4. Overwrite bytes after an identified entry point in a copy of qwindows.dll with the shellcode.
5. Place the modified DLL in the platforms subfolder.
6. Launch the ownCloud desktop client; shellcode executes.
**How found:** Noticed the client references a MinGW build-tree path for Qt plugins; realized any Windows user can create folders under C:\, making that path attacker-controllable. Attempted to build a fresh Qt imageformats plugin, failed, then pivoted to patching an existing DLL's entry point.
**Exploitation:** Local attacker with any authenticated Windows account creates the expected plugin directory under C:\ and drops a trojanized qwindows.dll; the client loads it on next launch, executing attacker code in the client's context.
**Insight:** Check whether desktop apps load plugins from absolute build-machine paths (MinGW sys-root, /usr/local, etc.) that are writable by low-privileged users; patching an existing signed DLL's entry point is easier than building a plugin from scratch.