What is delete-self-poc
Automated tool for detecting steganographic content in images, with F5 detection capabilities.
The delete-self-poc: A Demonstration of Deleting Locked Executables
The delete-self-poc is a demonstration of a method used to delete a locked executable or a file that is currently running from the disk.
This concept was initially discovered and proven...
This concept was initially discovered by Jonas Lykkegaard, and I have developed a proof of concept (POC) for it. Furthermore, this concept can be utilized to delete locked files on disk, as long as the current calling process possesses the required permissions to access and delete those files.
Understanding the Process: How Does This Work?
How does this work, though? - In this Proof of Concept (POC)? - First, open a HANDLE to the currently running process with DELETE access. Note that only DELETE access is necessary. - Next, use the SetFileInformationByHandle function to rename the primary file stream, :$DATA, to :wtfbbq. - After that, close the HANDLE. - Then, open another HANDLE to the current process and set the DeleteFile flag of the FileDispositionInfo class to TRUE. - Finally, close the HANDLE to trigger the file disposition. Voila! The file is now gone. Releases: I have included a statically linked release within this repository in case you prefer not to compile the original source code yourself.
delete-self-poc Reviews
No reviews yet.
