If you have Hyper-V on, good chances you are vulnerable to an easy two-line BSoD that works on the latest version of Windows from a restricted user. P.S it was reported to MSRC.pic.twitter.com/ZsK3Xi6fFy
-
i cannot test right now- but that device have some interesting properties. If flag for directory creation is set- it still create a file :O
that is interesting for path hijack attacks where a privelegied service for example get redirected by a junction folder dont know if still like this- but last i checked: create %userprofile%\http://ntuser.man junction folder targetting c:\windows\windows\system32\wtf
-
-
now log out and in again- user profile service will try to open the folder while impersonating you- if no access though it stop impersonating you and now as local service open path without file_directory or file flag
-
with that combination of flags the junction folder will get followed- and it will then create what the folder targets. But it will create a folder- using this maybe its possible to make it create a file instead :)
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.