Jonas L

What we wanna do is to redirect the files desination so in will get moved to a location we could not do our self. That location should then be trusted in a way that allows us to get the file executed under a higher privileged account.

I still think my go to method for that works... when windows error reporting service runs as system it tries to load a not existing phoneinfo.dll from system 32. If not then every fucking gui process still desperately try to load the not existing edgegdi.dll .....

The rename operation do not change the files destination though... How can we redirect the file move to another folder when we cannot transform the folder the existing file is in as it is not empty?

Well... we dont have to! if we intially make the folder point to c:\temp\ the service will try to move c:\temp\file.exe to c:\recovery\file_s.exe

if we then make an oplock on the file it open first- we can time it so that when we get the oplock callback, we know its now to change the junction folder so it now points to system32.

But this is all a crazy fantasy because in realitity it is impossible to create those symlinks or those oplocks- cuz they dont survive a reboot and we are not logged in yet.....