5 ms·

Thank you for the description, I was hesitant to download a .rar just to read something... > So any file that we have read access over as a user and that sys

Thank you for the description, I was hesitant to download a .rar just to read something... > So any file that we have read access over as a user and that system has the write DACL permission for, we can pivot into full control and overwrite it. Doesn't this imply we can use guest access to install any kind of backdoor, since we'll have "read access" to a bunch of programs that start on boot? Seems really bad, maybe I'm misinterpreting (I haven't been on Windows for a while).

tomashertus 8y ago
Yeah, the docs files in the archive seems to be clean based on the multiscan results. Some AVs are already flagging the hash of the rar as an exploit. Metadefender: https://metadefender.opswat.com/results#!/file/YTE4MDgyOHJrWE9GZkFHRDdIMTZiNnZ2YlhQWA/regular/overview https://metadefender.opswat.com/results#!/file/YTE4MDgyOHJrW... VT: https://www.virustotal.com/#/file/0c2cbb5eba3ae0765b1674891262146f57cf177e9e5e0b17f2e78b43dbcac571/detection https://www.virustotal.com/#/file/0c2cbb5eba3ae0765b16748912... Edit: Fixing grammar
- rasz 8y ago
  which just shows what a huge scam AVs are nowadays
  - tomashertus 8y ago
    true that. Not even mentioning the insane amount of telemetry data they are "sending home" on regular basis. You think social network is bad? Well take a look on your AV...
ericnyamu 8y ago
I would download the file and open the doc file with notepad++ other software that too old to excecute macro.