Just sent this zero-day to @msftsecresponse :->pic.twitter.com/wBCeEs619k
-
-
Replying to @steventseeley @msftsecresponse
Isn't MSC known to be inherently dangerous, though? Users get warnings before allowing downloads, the MSC handler in Windows obeys the MoTW, and there are public examples that run code via MSC files. I modified it to just run calc.exe in this case.pic.twitter.com/8tgqV65ecQ
2 replies 0 retweets 9 likes -
Replying to @wdormann
Awesome POC, Will! Do you mind sharing the resource on poisoning msc file? Couldn't seem to find. Thanks heap!
1 reply 0 retweets 0 likes
Replying to @CyberSecKB
Since it's already public, sure. 1) Start with https://github.com/hfiref0x/UACME/blob/master/Source/Kamikaze/Kamikaze.msc … 2) Change the URI inside it to one that does what you want. Easy peasy.
4:40 AM - 22 Jul 2019
0 replies
0 retweets
1 like
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.