Jonas L

So if i create a file- I am owner , if then SYSTEM moves it into system32- I am still the owner, no files have been created, so no ACL changes.

There is a special condition here- that is, when this happens, we are not logged in yet... This makes some techniques impossible... So actually for real this calls for some serious creativity. lets ignore nat for now though.....

What we wanna do is to redirect the files desination so in will get moved to a location we could not do our self. That location should then be trusted in a way that allows us to get the file executed under a higher privileged account.

I still think my go to method for that works... when windows error reporting service runs as system it tries to load a not existing phoneinfo.dll from system 32. If not then every fucking gui process still desperately try to load the not existing edgegdi.dll .....

The rename operation do not change the files destination though... How can we redirect the file move to another folder when we cannot transform the folder the existing file is in as it is not empty?

Well... we dont have to! if we intially make the folder point to c:\temp\ the service will try to move c:\temp\file.exe to c:\recovery\file_s.exe

if we then make an oplock on the file it open first- we can time it so that when we get the oplock callback, we know its now to change the junction folder so it now points to system32.