5 ms·

But is it running ShellExecute on URIs?

electroly 7mo ago
I believe it is. Just tested it. You can make the link "C:\windows\system32\cmd.exe" and clicking it will launch the Command Prompt. I noticed you can't make it "C:\windows\system32\cmd.exe /c some-nefarious-thing"; it doesn't like the space. Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE.
- gruez 7mo ago
  >Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE. 1. You can use UNC paths to access remote servers via SMB 2. Even if it's local, it's still more useful than you make it out to be. For instance, suppose you downloaded a .zip file of some github project. The .zip file contains virus.exe buried in some subfolder, and there's a README.md at the root. You open the README.md and see a link (eg. "this project requires [some-other-project](subfolder\virus.exe)". You click on that and virus.exe gets executed.
  - jkrejcha 7mo ago
    > 1. You can use UNC paths to access remote servers via SMB Relevant article from The Old New Thing: https://devblogs.microsoft.com/oldnewthing/20060509-30/?p=31263 https://devblogs.microsoft.com/oldnewthing/20060509-30/?p=31... Programs (this is true for most mainstream operating systems) can become network facing without realizing it. I've sometimes found a bunch of Windows programs sometimes tends to assume that I/O completes "instantly" (even if async I/O has been common on Windows for a very long time) and don't have a good UX for cancelling long running I/O operations
  - electroly 7mo ago
    Definitely; I didn't mean to underplay it. Here's a fun one: [Free AI credits](C:\windows\system32\logoff.exe) It works. This is a real exploit that you could do things with.
- thwarted 7mo ago
  What if the space is url encoded %20 ?
  - Zenul_Abidin 7mo ago
    That wouldn't work because Windows doesn't understand url-encoded sequences.

I believe it is. Just tested it. You can make the link "C:\windows\system32\cmd.exe" and clicking it will launch the Command Prompt. I noticed you can't make it "C:\windows\system32\cmd.exe /c some-nefarious-thing"; it doesn't like the space. Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE.

gruez 7mo ago
>Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE. 1. You can use UNC paths to access remote servers via SMB 2. Even if it's local, it's still more useful than you make it out to be. For instance, suppose you downloaded a .zip file of some github project. The .zip file contains virus.exe buried in some subfolder, and there's a README.md at the root. You open the README.md and see a link (eg. "this project requires [some-other-project](subfolder\virus.exe)". You click on that and virus.exe gets executed.
- jkrejcha 7mo ago
  > 1. You can use UNC paths to access remote servers via SMB Relevant article from The Old New Thing: https://devblogs.microsoft.com/oldnewthing/20060509-30/?p=31263 https://devblogs.microsoft.com/oldnewthing/20060509-30/?p=31... Programs (this is true for most mainstream operating systems) can become network facing without realizing it. I've sometimes found a bunch of Windows programs sometimes tends to assume that I/O completes "instantly" (even if async I/O has been common on Windows for a very long time) and don't have a good UX for cancelling long running I/O operations
- electroly 7mo ago
  Definitely; I didn't mean to underplay it. Here's a fun one: [Free AI credits](C:\windows\system32\logoff.exe) It works. This is a real exploit that you could do things with.
thwarted 7mo ago
What if the space is url encoded %20 ?
- Zenul_Abidin 7mo ago
  That wouldn't work because Windows doesn't understand url-encoded sequences.