2 ms·
Possibly I am missing something, but the use of volume shadow copies or direct (RAW) disk access to retrieve particular files that are "in use" is a long time e
by jaclaz 5y ago
Possibly I am missing something, but the use of volume shadow copies or direct (RAW) disk access to retrieve particular files that are "in use" is a long time established possibility.
Extents and Rawcopy were initially written several years ago:
http://reboot.pro/files/file/316-extents/ http://reboot.pro/files/file/316-extents/
https://github.com/jschicht/RawCopy https://github.com/jschicht/RawCopy
Or is there something new specific to Windows 10?
- praseodym 5y agoThe vulnerability here is that regular non-administrator users can also read sensitive registry hives from the shadow copy. This allows for local privilege escalation exploits.
- jaclaz 5y agoI see, thanks, I never tested the mentioned programs as a non-Admin user, though the mechanism (if the shadow copies are used) is seemingly the same, so if the BUILTIN/USERS are authorized, they may work as well (and not only on Windows 10).
- jesboat 5y agoI guess one way to phrase it would be "the ACLs on the registry files were always overly permissive, but nobody noticed until now because trying to read them the obvious way failed with 'file in use'"