mirror of
https://github.com/BenjiTrapp/MostShittyEDR
synced 2026-08-09 12:00:52 +00:00
Der BenjiandClaude Opus 4.6
c37272daa6
Jekyll collections require the underscore-prefixed directory naming convention (_challenges, _solutions). Move files accordingly, extract index pages to root with proper permalinks, and fix defaults scope in _config.yml to use type-based matching. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1.0 KiB
1.0 KiB
title, difficulty, category
| title | difficulty | category |
|---|---|---|
| Solution 05: Path Manipulation | easy | Command Line Obfuscation |
[Back to Challenge]({{ '/challenges/05-path-manipulation/' | relative_url }})
Overview
PROCESSENTRY32W.szExeFile contains only the filename (not the full path), so Rule 1 always sees just the executable name regardless of how it was invoked.
Solution
This challenge is actually a learning exercise: path manipulation does not bypass Rule 1 because szExeFile strips the path automatically.
However, the command line (used by Rule 2) preserves the full path as typed. This means you can use path tricks to hide keywords in the command line:
# The command line contains the full path, not "whoami"
C:\Windows\System32\who""ami.exe
# Using environment variables in paths
%SystemRoot%\System32\whoami.exe
# The PEB stores %SystemRoot% unexpanded
Key Insight
Rule 1 (process name) is path-independent. Rule 2 (command line) sees exactly what was typed, including path components and shell tricks.