search

Neo23x0 / Raccine

A Simple Ransomware Vaccine
The Unlicense
942 stars 123 forks source link

Don't attempt to run yara64.exe from the current directory #46

Closed wdormann closed 3 years ago

wdormann commented 3 years ago

When running a program from a command prompt on a system with Raccine installed, yara64.exe will be attempted to be executed from the current directory. This can allow for unexpected code execution on a system with Raccine installed.

Steps to reproduce:

  1. Make a directory called c:\tmp and go there in a command prompt.
  2. Copy c:\windows\system32\calc.exe to c:\tmp\yara64.exe
  3. In the CMD prompt in the c:\tmp directory, type: powershell

Actual results: calc.exe spawns

Expected results: yara64.exe should only be executed from the known directory where it is installed. Not from the current directory, nor from other directories that happen to be in the PATH.

Neo23x0 commented 3 years ago

Trying to fix this with this commit https://github.com/Neo23x0/Raccine/commit/940b69d031c4cc4080cd7ba748683f1a71857293