search

Wh04m1001 / CVE-2023-20178

90 stars 17 forks source link

Permissions on C:\Windows\temp #1

Closed linhlhq closed 1 year ago

linhlhq commented 1 year ago

Hi,

By default, do you have permission to monitor the C:\Windows\temp folder? As far as I know, Windows doesn't allow us to do that.

Thanks.

ThisGuyNeedsABeer commented 1 year ago

Running as a standard user was fine for me on Windows 10 1909, 21H2, and 22H2.

linhlhq commented 1 year ago

By default you will not have permission to monitor the C:\Windows\temp folder. I don't think Cisco needs to patch this vulnerability. Because for the exploit, I'm sure you have given the user full permissions on the C:\Windows\temp folder.

Wh04m1001 commented 1 year ago

That is not true @linhlhq . Yeah you can't directly monitor on c:\windows\temp but you open handle on c:\windows and set bWatchSubtree to TRUE and you will be able to monitor creation of files/directories in temp directory.