安全软件
点击放大
openssldir_check - A Windows utility to check for potential insecure
项目说明
openssldir_check
!Build Status
A Windows utility written in C++ to check for potential insecure paths used by the OPENSSLDIR build parameter in OpenSSL libraries. Applications that bundle OpenSSL libraries may ha set to a path that could be writable from a low pri user account. Depending on how the application is written, it may automatically load OPENSSLDIR/openssl.cnf during startup or other specific conditions.
The openssl.cnf configuration file can be le to load a malicious OpenSSL Engine library resulting in the execution of arbitrary code with the authority of the account running the application. For a detailed example of how I obtained SYSTEM with the Private Internet Access Desktop , read Information on how this works is described at
Additional functionality will be added as time permits. Here is functionality I may implement.
* Check permissions on all folders listed in the OPENSSLDIR path
* Check permissions of OPENSSLDIR/openssl.cnf
* Check permissions of OPENSSL_ENGINES_DIR for OpenSSL 1.1+
* Create option to search the file system for OpenSSL libraries
* Logging
* XMl/json output
* TODO: Code-sign released binaries (e Azure Trusted Signing vs. EV cert from a cloud signing service)
Download
The binaries can be downloaded directly from the latest GitHub Actions build. Note: This is a temporary solution. Long term the binaries will be a directly from Github releases.
Usage
> [!WARNING]
> Do not use this on untrusted paths. The utility attempts to load the library and call the OpenSSL function to determine the and OPENSSLDIR path.
> [!NOTE]
> Use openssldir_check_x86.exe for 32-bit libraries, and openssldir_check_x64.exe for 64-bit libraries.
Example
TODO: Add screenshot of example usage
Known OPENSSLDIR
| CVE | Application | References | Credit |
|----------|----------|----------|----------|
| CVE‑2026‑7373 | Metasploit Pro | Metasploit Pro 5.0.0-2026051301 Release Notes | Andrea Intilangelo |
| CVE‑2026‑34054 | Microsoft vcpkg (OpenSSL Windows build) | GHSA-p322- | Xavier DANEST (via Trend Micro ZDI) |
| CVE‑2026‑6482 | Rapid7 Insight Agent (Windows) | Rapid7 Release Notes | Dell Security Assurance |
| CVE‑2026‑3991 | Symantec/Broadcom DLP Agent | InfoGuard Labs Ad | Manuel Feifel (InfoGuard Labs) |
| CVE‑2025‑27237| Zabbix Agent | Zabbix ZBX-27061 | himbeer |
| CVE‑2025‑53841 | Akamai Guardicore Platform Agent | Akamai Ad | SECURITEAM / Beyond Security SSD |
| CVE‑2025‑47161 | Microsoft Defender for Endpoint (MDE) | MSRC<br>Stratascale Blog | Rich Mirch |
| CVE‑2025‑35471 | conda-forge | conda-forge issue #201 | Will Dormann |
| CVE‑2025‑2272 | Forcepoint Endpoint DLP | Triskele Labs Blog | Triskele Labs |
| CVE‑2024‑6975 | Cato Networks SDP Client | AmberWolf Blog | AmberWolf |
| CVE‑2024‑0394 | Rapid7 Miner | Rapid7 Blog | Will Dormann |
| CVE‑2023‑41840 | FortiClient Windows | FortiGuard PSIRT | Undisclosed |
| CVE‑2023‑40596 | Splunk Enterprise for Windows | Splunk S | Will Dormann |
| CVE‑2022‑32223 | Node.js / npm CLI | Aqua Security Blog | Yakir Kadkoda (Aqua Security) |
| CVE‑2022‑29505 | LINE for Windows | — | Undisclosed |
| CVE‑2022‑26872 | Tychon Endpoint | CERT | Will Dormann |
| CVE‑2022‑0166 | McAfee Agent | CERT | Will Dormann |
| CVE‑2021‑2356 | Oracle MySQL for Windows | Oracle CPU July 2021 | Will Dormann |
| CVE‑2021‑2307 | MySQL for Windows | CERT | Will Dormann |
| CVE‑2020‑36169 | NetBackup / OpsCenter (Windows) | | Undisclosed |
| CVE‑2020‑36168 | Resiliency Platform | | Undisclosed |
| CVE‑2020‑36167 | Backup Exec | <br>CERT | Undisclosed |
| CVE‑2020‑36166 | InfoScale / Storage Foundation / VIOM | | Undisclosed |
| CVE‑2020‑36165 | Desktop and Laptop Option (DLO) | | Undisclosed |
| CVE‑2020‑36164 | Enterprise Vault | | Undisclosed |
| CVE‑2020‑36163 | NetBackup / OpsCenter (Windows) | | Undisclosed |
| CVE‑2020‑36162 | CloudPoint (Windows Agent) | | Undisclosed |
| CVE‑2020‑36161 | APTARE IT Analytics | | Undisclosed |
| CVE‑2020‑36160 | System Recovery | | Undisclosed |
| CVE‑2020‑10143 | Macrium Reflect | CERT | Will Dormann |
| CVE‑2020‑10139 | Acronis True Image 2021 | CERT | Will Dormann |
| CVE‑2020‑10138 | Acronis Cyber Backup / Cyber Protect | CERT | Will Dormann |
| CVE‑2020‑8224 | Nextcloud Desktop Client | HackerOne #622170 | l00ph0le |
| CVE‑2020‑7224 | A Open | blog.mirch.io | Rich Mirch |
| CVE‑2019‑12572 | PIA VPN | blog.mirch.io | Rich Mirch |
| CVE‑2019‑10211 | PostgreSQL | PostgreSQL Security | Daniel Gustafsson |
| CVE‑2019‑5443 | curl | curl.se<br>daniel.haxx.se | Rich Mirch |
| CVE‑2019‑2390 | mongoDB | MongoDB SER | Rich Mirch |
| CVE‑2019‑1552 | OpenSSL | OpenSSL Security Ad | Rich Mirch |
| N/A | Monero Wallet GUI (Windows) | HackerOne #630903 | l00ph0le |
| N/A | stunnel | stunnel-announce | Rich Mirch |
项目信息
开发语言：C++
Star 数：8
技术要点
该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Windows utility to check for potential insecure paths used by the OPENSSLDIR build parameter in OpenSSL libraries展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。
| 资源标题 | openssldir_check - A Windows utility to check for potential insecure |
| 所属分类 | 安全软件 |
| 发布作者 | admin |
| 发布时间 | 2026-10-05 23:04:50 |
| 下载权限 | 免费下载 |
| 附件数量 | 2 个下载链接 |
| 浏览次数 | 79 |
| 讨论数量 | 0 |
| 主题状态 | 正常讨论中 |