PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

GOG Galaxy Local Privilege Escalation (LPE) PoC via DLL Search-Order Hijacking

github.com | vulnerability | High | #privilege-escalation | #windows | #lpe | #red-team | #dll-hijacking | #poc | #gog-galaxy
🔗 Original ↗

Summary

# GOG Galaxy Local Privilege Escalation PoC Proof of concept for a DLL search-order hijack in the GOG Galaxy `GalaxyCommunication` service. A local user who can write `IPHLPAPI.DLL` beside...

Why it matters

Demonstrates persistent DLL hijacking vulnerabilities in popular gaming clients, showing how insecure service configurations and missing safe DLL search controls allow standard users to breach SYSTEM privilege boundaries.
Vendor
GOG.com
Product
GOG Galaxy
Affected versions
GalaxyCommunication.exe 2.0.6.28
Published
Collected

📦 Full-Text Content Snapshot

R2 Archive · Full Article Preserved54 lines · 1.7 KB
📄 Raw .md⬇️ Download .md

Author: 0xv1n · Source: github.com/0xv1n/gog-lpe-poc

Proof of concept for a DLL search-order hijack in the GOG Galaxy GalaxyCommunication service. A local user who can write IPHLPAPI.DLL beside GalaxyCommunication.exe and start the service can execute code as NT AUTHORITY\SYSTEM.

Demo

GOG Galaxy SYSTEM command prompt proof of concept
GOG Galaxy SYSTEM command prompt proof of concept

Tested with GalaxyCommunication.exe 2.0.6.28 on Windows 10 Pro 25H2.

Build

Install the Visual Studio C++ x86 build tools, then run:

cmd
.\build.cmd

Run

From a non-elevated PowerShell session, run:

powershell
.\run.ps1

The script deploys the DLL, starts the service, opens a SYSTEM command prompt, removes the DLL, and restores the original service state.

Use only on systems you own or are authorized to test.

📦 Full-Text Markdown Snapshot archived by Phying News · Original source: github.com

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
Medium · vulnerability · github.com
CVE-2026-84636: Apple iOS/macOS SCDynamicStore Wi-Fi SSID Info Disclosure PoC
Wi-Fi SSID data is strictly guarded as sensitive location telemetry on iOS. This PoC shows that third-party applications could bypass sandbox entitlement checks via SCDynamicStore to silently track user network environments and physical locations.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · blog.quarkslab.com
MyReport Updater: From gRPC to SYSTEM
MyReport is a report generation software often used as a component of web-based applications. We describe a privilege escalation and remote code execution vulnerabilities in MyReport Updater 2.1.1 through its update configuration and gRPC service.
tool · github.com
Linux LPE Toolkit: Multi-Architecture Automated Privilege Escalation Tool
Provides penetration testers and red teams with an all-in-one, multi-architecture automated post-exploitation toolkit that simplifies Linux kernel privilege escalation without requiring on-target compilers.
Back