shmoul

21 year old full-time bug bounty hunter from Finland

[shmoul @shm0ul]

@ArchAngelDDay Congrats! Best of luck, although I'm certain you'll do great

[shmoul @shm0ul]

@renniepak Shouldn't have mentioned SMB in the earlier reply 😅
It's not really a good way to go unless you're stealing NTLM creds

[shmoul @shm0ul]

@renniepak Use a webdav server instead. SMB is such a pain and so inconsistent outside a local network.

[shmoul @shm0ul]

@renniepak You should be able to RCE by hosting a webdav / SMB server and using an url like file://host-ip/share/path/to/file.exe

Windows does however prompt the user about running an external program, but if the user has e.g java installed you can use a .jar file with no warnings.

[shmoul @shm0ul]

@NahamSec Full time on bug bounty here

[shmoul @shm0ul]

@Oddvarmoe Also this may not be exactly on topic but you can also specify the streams in the directory and file:

c:\temp:$I30:$INDEX_ALLOCATION\file.exe::$DATA

[shmoul @shm0ul]

@Oddvarmoe c|/test/file.exe (works in file URIs and somewhere else I think? not sure so maybe not a proper path)
\??\c:\temp\file.exe
\??\UNC\localhost\c$\temp\file.exe (UNC thing also works with \\?\ and \\.\)

[shmoul @shm0ul]

@NahamSec @Hacker0x01 @alicanact60 @ajxchapman Thanks for the shout out! Let's find some more crazy bugs in Vegas

[shmoul @shm0ul]

Recently had the pleasure of participating in my second @Hacker0x01 LHE, #h14420. We actually ended up winning the bonus for the best desktop bug on Zoom with @NahamSec and @ajxchapman!

Huge thanks to them and everyone else involved with the event!