Jonas L

Not yet, but someone knows a place where the assumption of a running file mapping to its matching file on disk have security consequences. Maybe something like antivirus, drm, anti cheating, authenticode.... I dont wanna drop stuff that directly could damage stuff.

And one of the next days new methods for Local Service -> SYSTEM will get dropped so...... thats all

or maybe I do....maybe I do. What about a vuln that enables setting acl everyone read on an arb file, only requirement is having writeaccess to it :)

The IP helper service teredo component do unsafe file creation in user writeable directory and set + everyone read on the file. It can be exploited by creating a hardlink from a given file to c:\windows\temp\teredo.txt Then run: netsh interface teredo show state

The hardlinked file will now get the ACL appllied. I just did a sandboxie :)

why do i suddenly feel crawing for putting on a dress and moving to Canada?