If you symlink to \??\globalroot\device\mup\;webdavredirector\candcip\davwwwroot\ and make the payload create a symlink \??\globalroot -> \??\nul It will only get executed when not already loaded, on termination \??\globalroot resolves through to shadow \global??\globalroot
-
This Tweet is unavailable.
-
Show this thread
so, a dead mans switch like protection that will load payload by default- but by keeping handle to symlink open will not create noise in traffic nor files.
4:35 AM - 26 Oct 2020
0 replies
0 retweets
4 likes
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.