Great blog by @edwardzpeng!
1/2-GetTempFileName API is problematic. It returns a file path and not handle, and as such has a race condition by design (file is opened twice, you can create a link in between). Also it has very low entropy so you can anticipate the returned path byhttps://twitter.com/edwardzpeng/status/1231438418925588480 …
-
Show this thread
-
Replying to @galdeleon @edwardzpeng
You can also replace the parent directory by a junction to \RPC Control\, create a single symlink, and let GetTempFileName iterate for you over the char space. Or predict its output (as
@jonasLyk mentioned), then create a symlink that’s far enough and let GetTempFileName iterate.2 replies 0 retweets 8 likes -
Replying to @clavoillotte @galdeleon and
Or just "symlink spraying "over RPC Control ;-)
2 replies 0 retweets 0 likes -
Replying to @decoder_it @clavoillotte and
I’ve seen this use of GetTempFileName in C:\Windows\Temp but could never figure out how to exploit it given the inability to clear the directory along with the inability to read.
2 replies 0 retweets 0 likes -
Replying to @enigma0x3 @decoder_it and
You can get Change Notifications for the Temp folder by starting it on C:\Windows and requesting all sub tree events. That way you an leak any file modifications to the temp folder including its name. Whether this is a security vulnerability I don't know, maybe :-)
2 replies 2 retweets 10 likes -
Replying to @tiraniddo @enigma0x3 and
Nope. MSRC confirmed via email it's not a security vulnerability.
1 reply 0 retweets 0 likes -
Replying to @FlowerCode_ @enigma0x3 and
I assumed it wouldn't be as it'd be far to complicated to fix which means it's not worth their time :-D For anyone who wants it a simple PS script is https://gist.github.com/tyranid/fa42a686b4cd1a34446d3b5082d6f97c … there's plenty of others I'm sure but hey :-)
1 reply 2 retweets 10 likes
If performance is a priority I recommend this c++ implementation: https://github.com/microsoft/wil/blob/master/include/wil/filesystem.h … example usage: unique_folder_change_reader_nothrow reader; THROW_IF_FAILED(reader.create(folder, true, wil::FolderChangeEvents::All, [](wil::FolderChangeEvent event, PCWSTR fileName) }));
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.