4 ms·

What does “unverified protocols” mean? Does Windows have an exe:// url scheme that fetches and runs executable binaries or something?

• gruez 8mo ago
  Yes? ShellExecute opens a url if you pass in a url, opens a file if you pass in a path, and runs an .exe if that file is an .exe. Windows also supports SMB paths, so combine that together and you have a RCE
  • eugenekolo 8mo ago
    But is it running ShellExecute on URIs?
    • electroly 8mo ago
      I believe it is. Just tested it. You can make the link "C:\windows\system32\cmd.exe" and clicking it will launch the Command Prompt. I noticed you can't make it "C:\windows\system32\cmd.exe /c some-nefarious-thing"; it doesn't like the space. Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE.
      • gruez 8mo ago
        >Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE. 1. You can use UNC paths to access remote servers via SMB 2. Even if it's local, it's still more useful than you make it out to be. For instance, suppose you downloaded a .zip file of some github project. The .zip file contains virus.exe buried in some subfolder, and there's a README.md at the root. You open the README.md and see a link (eg. "this project requires [some-other-project](subfolder\virus.exe)". You click on that and virus.exe gets executed.
        • jkrejcha 8mo ago
          > 1. You can use UNC paths to access remote servers via SMB Relevant article from The Old New Thing: https://devblogs.microsoft.com/oldnewthing/20060509-30/?p=31263 https://devblogs.microsoft.com/oldnewthing/20060509-30/?p=31... Programs (this is true for most mainstream operating systems) can become network facing without realizing it. I've sometimes found a bunch of Windows programs sometimes tends to assume that I/O completes "instantly" (even if async I/O has been common on Windows for a very long time) and don't have a good UX for cancelling long running I/O operations
        • electroly 8mo ago
          Definitely; I didn't mean to underplay it. Here's a fun one: [Free AI credits](C:\windows\system32\logoff.exe) It works. This is a real exploit that you could do things with.
      • thwarted 8mo ago
        What if the space is url encoded %20 ?
        • Zenul_Abidin 8mo ago
          That wouldn't work because Windows doesn't understand url-encoded sequences.