Hector Martin

TIL that on windows, cmd.exe /c implements a CVE for you by default, by automagically interpreting any passed *command line* as a *filename with spaces*. You need to pass /s to turn off the free CVE. So cmd /c "ping http://evil.‌com/../../../../../../windows/calc.exe" pops calc.

Wine implements it too, here's the pile of automagic nonsense that you need to explicitly turn off: https://github.com/wine-mirror/wine/blob/master/programs/cmd/wcmdmain.c#L2586 … Yes it literally is taking the entire command, spaces and all, and trying it as a single space-containing file path before actually trying it as a command