Easy sam file dump- bypass file locks:pic.twitter.com/jKPjuIfCPZ
-
This Tweet is unavailable.
-
you do symlink- change codepage, get secrets? Whats to explain`? The process seems quite obvious
just kidding- each process have an associated codepage for mapping of characters to visual representation. That are the c_CODEPAGE.nls files- when codepage changes windows kernel will automaticly create a section in \nls and map that into the process
-
-
This Tweet is unavailable.
-
One that already has the privilege to do so; it is a nice file lock bypass
End of conversation
-
-
-
For those wanting more details as I did:
@tiraniddo wrote about this in 2017 on Google Project Zero Blog: https://googleprojectzero.blogspot.com/2017/08/windows-exploitation-tricks-arbitrary.html … -
Thanks
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.