CPU-Z

DLL Sideloading via version.dll in WinSCP: Search Order Exploitation, Rust Proxy and Payload Interception

WinSCP loads version.dll from its own directory because Windows searches for DLLs in a specific order starting with the application folder. Researchers demonstrated how to identify this library through the import table, Known DLLs exclusion, and Procmon monitoring to observe the loader attempting the AppDir path before falling back to SysWOW64. The same technique was recently used in campaigns targeting FileZilla via a fake domain and CPUID supply-chain compromises involving cryptbase.dll. A Rust-based proxy DLL forwards 14 exports via linker-level redirection while implementing three hijacked functions that trigger a MessageBox payload immediately upon WinSCP startup. The PoC was built for 32-bit WinSCP on Windows 11 using cargo and a generated .def file that adapts to x86 or x64 targets. This attack remains effective because version.dll is not listed in KnownDLLs and is directly imported by WinSCP, guaranteeing early execution before the main application window appears.