TIL that on windows, cmd.exe /c implements a CVE for you by default, by automagically interpreting any passed *command line* as a *filename with spaces*. You need to pass /s to turn off the free CVE. So cmd /c "ping http://evil.com/../../../../../../windows/calc.exe" pops calc.
<anything>\..\ gets removed, regardless of whether <anything> exists or not.
-
-
So is the "ping http://evil,com" part there just to give it "something" before the \..\ or is it actually doing something?
-
The "ping http://evil.com " is there because if it were "ping 1.2.3.4" it would actually work as a proper ping command, and passing vaguely-sanitized user data after a ping command to cmd /c would be a common use case.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.