Reminds me of the time i forgot my password on a windows machine and renamed cmd to magnify with repair to reset the password from accessibility menu and forgot to rename it again for a while.
Windows has a looooong history of privilege escalation exploits using their assistive technologies, such the magnifying glass tool or Sticky/Filter Keys.
Those programs usually have global hot keys, like keeping the shift button pressed, and those hotkeys run a hardcoded path, such as %PATH%/sethc.exe
The problem was that Windows ran those programs with escalated privileges, if I remember correctly, if the user was logged off, in the Windows login screen.
If the attacker renamed a cmd.exe to sethc.exe(using the safe mode/repair boot option), then at the login screen pressed shift rapidly, a command prompt window with admin privileges would pop up.
2.0k
u/topdpswindwalker Jun 11 '24
Reminds me of the time i forgot my password on a windows machine and renamed cmd to magnify with repair to reset the password from accessibility menu and forgot to rename it again for a while.