I see the pascal code below on another forum. How can this code be possible?
Doesn't windows allow user to create a filename with colon?
However, this code only work when you create a file with name contains colon in root directory of drive (Ex: D:, C:, E:, etc). And when the file is created, it's completely invisible.
uses crt, sysutils;
var
f, f1: file of char;
c:char;
begin
clrscr;
assign(f, 'D:\src\payload.exe');
reset(f);
assign(f1, 'D:\:malware.exe');
rewrite(f1);
while not eof(f) do
begin
read(f, c);
write(f1, c);
end;
close(f1);
close(f);
executeprocess('D:\:malware.exe', ''); //here
readln;
erase(f1);
end.
You can compile the code above with free pascal
fpc [filename].pas
Thank you.
EDIT:
For more detail:
You can execute D:\:malware.exe
from CreateProcess (WinAPI)
You can't execute D:\:malware.exe
from command line, path, etc
I use process explorer to find D:\:malware.exe
path/contain folder. However, when I pressed explore button, it takes me to %UserProfile%
It only work for D:\:malware.exe
, D:\\malware.exe
, D:\/malware.exe
DefineDosDevice
and accessed with either the "\\.\" or "\\?\" prefix. The "\\.\" prefix still entails some path normalization of slash and dot characters, but "\\?\" bypasses all normalization.