Hector Martin

TIL that on windows, cmd.exe /c implements a CVE for you by default, by automagically interpreting any passed *command line* as a *filename with spaces*. You need to pass /s to turn off the free CVE. So cmd /c "ping http://evil.‌com/../../../../../../windows/calc.exe" pops calc.

why doesn't it just fail if it doesn't find a directory named "ping http://evil.‌com" ?

Because Windows simplifies ..\ components in paths *before* actually hitting the filesystem.

Simplifies them to what? It means "go up a directory", but it has to go up starting from somewhere, right?

<anything>\..\ gets removed, regardless of whether <anything> exists or not.

So is the "ping http://evil,com" part there just to give it "something" before the \..\ or is it actually doing something?

The "ping http://evil.com " is there because if it were "ping 1.2.3.4" it would actually work as a proper ping command, and passing vaguely-sanitized user data after a ping command to cmd /c would be a common use case.