read past EOF characters?

[iamtheky]

I am exploring the capabilities of the bash on windows and building POCs for circumventing user controls  (like in the last build you could simply 'tail ntuser.dat' and hard crash the entire box).  This file shows effective policies, so being able to do something like dump an array of executables that are in the disallowrun key is probably not desired for an admin.  Articles currently espouse the benefits, I want to make sure our folk clearly understand the risks and additional attack vectors exposed.

Edited June 2, 2016 by iamtheky

[iamtheky]

Figured it out.  Not too terrible and fairly reliable in my testing, (though admittedly i dont know if all the various files im trying it on are of similar mixed formats).

$hFile = fileopen("NTuserPOL_Copy.txt", 16)
$sStr = fileread($hFile)
fileclose($hFile)

$count = 3
while 1
   If stringmid($sStr , $count , 2) = "" then exitloop
       If stringmid($sStr , $count , 2) < "20" then
          $sStr = StringReplace($sStr , $count , "  " , 1)
       EndIf
$count += 2
wend

FileWrite("testoutput.txt" , BinaryToString(StringStripWS($sStr , 8)))
msgbox(0, '' , BinaryToString(fileread("testoutput.txt")))

 

Edited June 2, 2016 by iamtheky