TIL that on windows, cmd.exe /c implements a CVE for you by default, by automagically interpreting any passed *command line* as a *filename with spaces*. You need to pass /s to turn off the free CVE. So cmd /c "ping http://evil.com/../../../../../../windows/calc.exe" pops calc.
But it's inconsistent. You can put quotes around a command line with space separated arguments and it'll interpret it as a command line, if an executable of the same name as the whole doesn't exist. Its different from how the normal interactive parsing works.
-
-
sure, but those cases are it allowing unnecessary quotes. as far as I can tell there aren't any cases where quotes that aren't meant as part of the command are helpful.
-
But what if the quotes *are* necessary then, and you want to start a program with spaces in the filename? Then if that file does not exist it'll fall back to potentially running something else. Either way you look at it, this automagic behavior is wrong.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.