I have a bug where a user can create a file anywhere.
This file:
1.can have any name/ext
2.will be empty
3.must not exist. E.g you can't create c:\windows\win.ini
4. You can't edit it
I can DOS.Other ideas you would like to share?
/cc: @SandboxBear , @decoder_it , @tiraniddo
-
-
I Just got an idea.... You can create an alternative data stream on the primary hard drive root C:\:stream:$data - then afterwards you can open the file with FILE_APPEND_DATA because of FILE_APPEND_DATA S-1-5-11 (NT AUTHORITY\Authenticated Users)
-
Since the file is empty you now control 100% the content of a file that have a location that is likely to be unexspected. Create an symbolic link in NT Object Namespace with .exe targetting it to execute the file. That is a persistence technique thats easy to miss :)
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.