Add content: CVE-2025-1729 - Privilege Escalation Using TPQMAssistant.exe

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://trustedsec.com/blog/cve-2025-1729-privilege-escalation-using-tpqmassistant-exe
• Blog Title: CVE-2025-1729 - Privilege Escalation Using TPQMAssistant.exe
• Suggested Section: windows-privilege-escalation/dll-sideloading

🎯 Content Summary

Technical Analysis: CVE-2025-1729 in Lenovo TrackPoint Quick Menu

Description

The following analysis examines a Windows privilege escalation vulnerability via DLL sideloading in Lenovo’s TrackPoint Quick Menu (TPQMAssistant.exe), tracked as CVE-2025-1729. A scheduled task (Lenovo\TrackPointQuickMenu\Schedule\ActivationDailyScheduleTask) executes C:\ProgramData\Lenovo\TPQM\Assistant\TPQMAssistant.exe daily at 9:30 AM un...

🔧 Technical Details

DLL Sid​​eloading via Writable Directory: When an application installs to a directory with CREATOR OWNER write permissions and loads a required DLL by name (e.g., hostfxr.dll) without a full path, an attacker can drop a malicious DLL into that directory. On execution, Windows’ DLL search order prioritizes the local directory, loading the attacker’s DLL and achieving code execution under the application’s context.

Scheduled Task Context Escalation:🤖 Agent Actions

I’ve updated the DLL Hijacking guide to include a dedicated case study for CVE-2025-1729 (TPQMAssistant.exe), detailing the phantom DLL hijacking scenario, exploit implementation, attack flow, and mitigation. The References section now includes the blog URL and Microsoft Store link. Let me know if any further refinements are needed!

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://trustedsec.com/blog/cve-2025-1729-privilege-escalation-using-tpqmassistant-exe

Content Categories: Based on the analysis, this content was categorized under "windows-privilege-escalation/dll-sideloading".

Repository Maintenance:

• MD Files Formatting: 847 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0