@renniepak You should be able to RCE by hosting a webdav / SMB server and using an url like file://host-ip/share/path/to/file.exe
Windows does however prompt the user about running an external program, but if the user has e.g java installed you can use a .jar file with no warnings.
@Oddvarmoe Also this may not be exactly on topic but you can also specify the streams in the directory and file:
c:\temp:$I30:$INDEX_ALLOCATION\file.exe::$DATA
@Oddvarmoe c|/test/file.exe (works in file URIs and somewhere else I think? not sure so maybe not a proper path)
\??\c:\temp\file.exe
\??\UNC\localhost\c$\temp\file.exe (UNC thing also works with \\?\ and \\.\)
Recently had the pleasure of participating in my second @Hacker0x01 LHE, #h14420. We actually ended up winning the bonus for the best desktop bug on Zoom with @NahamSec and @ajxchapman!
Huge thanks to them and everyone else involved with the event!