How to Find the Original Directory Where the App Was Launched From While the App Is in a Different Directory - Bug Found

When running a command line .exe from the command line to launch an app from a current folder, Environment.CurrentDirectory displays the wrong folder, when the command is run with escalated privileges.

It displays the location of the exe, not the current folder.

C:\Users\Markus\Documents > testexe.EXE

TestExe.exe resides in c:\windows\system32 

Here's output running TestExe.exe

Specifically if you set app.config to get your app to run as Administrator with UAC prompt

 <requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

this will return the location of the exe, not the current directory the exe is run from.

Super frustrating and a bug in .NET.

Here's the simple source code

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

using System; using System.Collections.Generic; using System.Linq; using System.Text; namespace TestExe { class Program { static void Main(string[] args) { Console.WriteLine(Environment.CurrentDirectory); Console.Read(); } } }

Here's app.config code

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58

<?xml version="1.0" encoding="utf-8"?> <asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <!-- UAC Manifest Options If you want to change the Windows User Account Control level replace the requestedExecutionLevel node with one of the following. <requestedExecutionLevel level="asInvoker" uiAccess="false" /> <requestedExecutionLevel level="requireAdministrator" uiAccess="false" /> <requestedExecutionLevel level="highestAvailable" uiAccess="false" /> Specifying requestedExecutionLevel node will disable file and registry virtualization. If you want to utilize File and Registry Virtualization for backward compatibility then delete the requestedExecutionLevel node. --> <requestedExecutionLevel level="requireAdministrator" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!-- A list of all Windows versions that this application is designed to work with. Windows will automatically select the most compatible environment.--> <!-- If your application is designed to work with Windows Vista, uncomment the following supportedOS node--> <!--<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>--> <!-- If your application is designed to work with Windows 7, uncomment the following supportedOS node--> <!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>--> <!-- If your application is designed to work with Windows 8, uncomment the following supportedOS node--> <!--<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS>--> <!-- If your application is designed to work with Windows 8.1, uncomment the following supportedOS node--> <!--<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>--> </application> </compatibility> <!-- Enable themes for Windows common controls and dialogs (Windows XP and later) --> <!-- <dependency> <dependentAssembly> <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" /> </dependentAssembly> </dependency>--> </asmv1:assembly>

Apple Phishing Email - RE: [New Statement] Your account has been locked due to suspicious activity CASE ID : [FWD.] [Update Report]

For the record, this is an Apple phishing email attempt that is recently going around and made it through spam filters. What to do?  Report them, goto bottom of page.

From : Apple Service Subject : RE: [New Statement] Your account has been locked due to suspicious activity CASE ID : [FWD.] [Update Report] ATTACHED DOCX CONTENTS - ALWAYS OPEN WITH WORD VIEWER ONLINE AρρleID Locked Aggrement We emailed you a little while ago to ask for your help resolving an issued with your AρρleID, Your AppleID is still temporarily Locked for security reason. If you or someone else enters your password, security questions, or other account information incorrectly too many times, Your AρρleID automatically locks to protect your security. You can unlock your Aρρle ID after you verify your identity. We want to work with you to restore your account as quickly as possible. What will happen if your AρρleID has been Locked? * You can’t make payment * You can’t access personal data that are associated with the your AρρleID How can you unlocked your AρρleID You must login to Your AρρleID to the following link (https://aρρleid.aρρle.com/account#!&Page=Unlock) PHISHING LINK  https://www.appidaccountmanageinformationupdatetsatsa.com/?sign Follow Step by step to Unlock your AρρleID. If you have not signed recently and Believe someone may have accessed your account, Go to AρρleID (https://iforgot.aρρle.com/password/verify/aρρleid) and change your password as soon as possible. Sincerely, Aρρle Support Note: If the informations above looks familiar, you can ignore this message

It contains infected DOCX file: Doc_UserNotice.docx

PHISHING LINKs;  

1. (https://aρρleid.aρρle.com/account#!&Page=Unlock) PHISHING LINK 

https://www.appidaccountmanageinformationupdatetsatsa.com/?sig

How to tell this is a Phishing email ?

1. Check email address in full, if it's not from originating company then it's phishing.
2. Hover over all links in email, if it's not from the apple.com site then forget it.
   
   
3. The best way is to look at message source, see below.

How to examine Email Message Source ?

Now lets look at message source

1. Outlook.com->Actions->View Message Source. 
2. Gmail.com->More (down arrow to top right)->Show original.

Check for suspicious links, anything that does not originate from apple.com.

Report Phishing Email (not as Spam)

1. Outlook.com->Junk (at Top)->Phishing Scam
2. Gmail.com->More (downarrow to top right)->Report Phishing 

Report Phishing URLs at Google now 

If you have recievied this email take further action now by click these links

1. https://www.google.com/safebrowsing/report_phish/

Report phishing at Microsoft and government agencies

1. http://www.microsoft.com/security/online-privacy/phishing-faq.aspx

Report phishing emails to Apple 

Forward the email to abuse@icloud.com. This provides Apple's legal department and law enforcement with useful information to help prevent future phishing emails.

There is not such thing as security

There is not such thing as security, this applies to all platforms and operating systems.

Jon McCoy - Hacking .Net Applications: The Black Arts
This presentation will cover the Black Arts of making Cracks, KeyGens, Malware, and more. The information in this presentation will allow a .NET programmer to do unspeakable things .NET applications. I will cover the life cycle of developing such attacks and over coming common countermeasures to stop such attacks. New tools to assist in the attacks will be supplied. This presentation will focus on C# but applies to any application based on the .NET framework.

Jon McCoy is a .NET Software Engineer that focused on security and forensics. He has worked on a number of Open Source projects ranging from hacking tools to software for paralyzed people. With a deep knowledge of programming under the .NET Framework he has released new attacks on live applications and the .NET Framework it self. He provides consulting to protect .NET applications.



Jon McCoy: Hacking .NET(C#) Application: Code of the Hacker from NDC Conferences on Vimeo.


Backup video----