Full Disclosure mailing list archives

Re: Window's O/S


From: "Dave Korn" <davek_throwaway () hotmail com>
Date: Thu, 24 Nov 2005 14:52:17 -0000


pagvac wrote in 
news:b7a807650511240317n2eed488dr604e8e8f3cbd22d7 () mail gmail com
Confirmed on Windows XP SP2 (English Version).

I still can't understand why that happens. I tried doing the same
thing using different folder names of default Windows application
executables (wordpad, iexplore, etc...) but it doesn't work.


  Because iexplore.exe implements "View source" by storing the source in a 
temp file and then launching the command line "notepad <temp_file_name>", 
and in the case above, the current directory of the iexplore.exe process 
must be the desktop, and since 'doze always searches '.' as the first 
element of %PATH%, it finds the folder, and then launches it.  Note that you 
can achieve the same effect by saying "start <foldernameincurrentdir>" at a 
DOS prompt; see MSDN for ShellExecuteEx if you want the real innards of the 
problem.

  This is also very much like the issue with having a file called 
"program.exe" in the root of your C: drive; the next time someone tries to 
launch a program through a path like "C:\program files\foo\bar.exe", and 
they don't adequately quote the path, 'doze interprets it as meaning "Run 
C:\program.exe with the single command-line argumetn 'file\foo\bar.exe'"

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today.... 



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Current thread: