Slashdot Mirror

← Back to Stories (view on slashdot.org)

Abusing Symbolic Links Like It's 1999

Posted by timothy on from the time-flies dept.

An anonymous reader writes with this snippet from James Forshaw's recent post at Google's Project Zero, which begins For the past couple of years I've been researching Windows elevation of privilege attacks. This might be escaping sandboxing or gaining system privileges. One of the techniques I've used multiple times is abusing the symbolic link facilities of the Windows operating system to redirect privileged code to create files or registry keys to escape the restrictive execution context. Symbolic links in themselves are not vulnerabilities, instead they're useful primitives for exploiting different classes of vulnerabilities such as resource planting or time-of-check time-of-use. Click through that link to see examples of this abuse in action, but also information about how the underlying risks have been (or can be) mitigated.

6 of 54 comments (clear)

  1. Re:we can fix this by Calydor · · Score: 5, Insightful

    The end of your post combined with your signature is comedy gold, mate.

    --
    -=This sig has nothing to do with my comment. Move along now=-
  2. Re:we can fix this by RabidReindeer · · Score: 4, Funny

    Hey! Our product line is created, maintained and supported by the finest professionals $1.75/hour can buy!

  3. Re:we can fix this by bmo · · Score: 5, Informative

    If it's proprietary, there are implied warranties on it

    Since when?

    Microsoft excludes all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement.

    Bolded in the eula itself.

    --
    BMO

  4. You want me to what now? by Daetrin · · Score: 4, Funny

    [This person is an expert at hacking systems using links!]

    "Click through that link to see examples of this abuse in action"

    o_O

    (And yes, i'm aware that URL links are not the same as symbolic links, but the phrasing is still amusing.)

    .

    --
    This Space Intentionally Left Blank
  5. As the old saying goes... by turbidostato · · Score: 4, Insightful

    On proper time Windows has added symlinks, a (somehow) worthwhile command line, non-graphic environment, the ability to remotely manage, declarative-based configuration management...

    It's only they are reinventing all these things on their own, forgetting about how did they came to be and, of course, not caring about the way those facilities have been used and abused in the past.

    I think it was Henry Spencer the one that said "Those who do not understand Unix are condemned to reinvent it, poorly."

    1. Re:As the old saying goes... by lucm · · Score: 4, Funny

      On proper time systemd has added symlinks, a (somehow) worthwhile command line, non-graphic environment, the ability to remotely manage, declarative-based configuration management...

      It's only they are reinventing all these things on their own, forgetting about how did they came to be and, of course, not caring about the way those facilities have been used and abused in the past.

      I think it was Henry Spencer the one that said "Those who do not understand Unix are condemned to reinvent it, poorly."

      Hehe

      --
      lucm, indeed.