Jonas L

Lets start with why file rename/move is such a strong exploitation primitve: Remember this: A files ACL get set when the file gets created. Its result ACL is depending on creation parent it inherit and creaters default ACL- unless specific ACL is specified on creation

Unpriv users can create folders in C:\ .- they will be owner. There is no Recovery folder , so its easy to set things up so the file rename will be done a file we control

So if i create a file- I am owner , if then SYSTEM moves it into system32- I am still the owner, no files have been created, so no ACL changes.

There is a special condition here- that is, when this happens, we are not logged in yet... This makes some techniques impossible... So actually for real this calls for some serious creativity. lets ignore nat for now though.....

What we wanna do is to redirect the files desination so in will get moved to a location we could not do our self. That location should then be trusted in a way that allows us to get the file executed under a higher privileged account.

I still think my go to method for that works... when windows error reporting service runs as system it tries to load a not existing phoneinfo.dll from system 32. If not then every fucking gui process still desperately try to load the not existing edgegdi.dll .....

The rename operation do not change the files destination though... How can we redirect the file move to another folder when we cannot transform the folder the existing file is in as it is not empty?

Well... we dont have to! if we intially make the folder point to c:\temp\ the service will try to move c:\temp\file.exe to c:\recovery\file_s.exe