Jonas L

or maybe I do....maybe I do. What about a vuln that enables setting acl everyone read on an arb file, only requirement is having writeaccess to it :)

The IP helper service teredo component do unsafe file creation in user writeable directory and set + everyone read on the file. It can be exploited by creating a hardlink from a given file to c:\windows\temp\teredo.txt Then run: netsh interface teredo show state

The hardlinked file will now get the ACL appllied. I just did a sandboxie :)

why do i suddenly feel crawing for putting on a dress and moving to Canada?