I kinda didnt wanna spend more time on project asus my ass- except just removing it. it nagged me though- cuz the shit was def vulnerable....b Now i fire up a recording of my pc booted and see .... an easily exploitable move operation by asus crapware
-
-
Well... we dont have to! if we intially make the folder point to c:\temp\ the service will try to move c:\temp\file.exe to c:\recovery\file_s.exe
Show this thread -
if we then make an oplock on the file it open first- we can time it so that when we get the oplock callback, we know its now to change the junction folder so it now points to system32.
Show this thread -
We could also point the folder at "\RPC Control\" and in there make one symlink for source and one for destion. like this:pic.twitter.com/vqccARCQHA
Show this thread -
But this is all a crazy fantasy because in realitity it is impossible to create those symlinks or those oplocks- cuz they dont survive a reboot and we are not logged in yet.....
Show this thread -
This Tweet is unavailable.
-
We could also create the ntfs symbolic links on the recovery partition... Still needs admin though
Show this thread
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.