TIL that on windows, cmd.exe /c implements a CVE for you by default, by automagically interpreting any passed *command line* as a *filename with spaces*. You need to pass /s to turn off the free CVE. So cmd /c "ping http://evil.com/../../../../../../windows/calc.exe" pops calc.
Because Windows simplifies ..\ components in paths *before* actually hitting the filesystem.
-
-
Simplifies them to what? It means "go up a directory", but it has to go up starting from somewhere, right?
-
<anything>\..\ gets removed, regardless of whether <anything> exists or not.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.