batch scriptsvbscriptand powershell scripts make system administratorslives easier by automating humdrum tasks their purpose can vary from continually registering to central inventory service to forcing updates of software from their own repositories one common problem is the lack of proper acls on these scripting files in number of caseson otherwise secure serversi've found batch scripts or powershell scripts that are run once day by the system user while being globally writable by any user if you run your process monitor long enough in an enterprise (or you simply install the example service provided in the beginning of this you might see process records that look like this,nt authority\system, :\windows\system \cscript exec:\windows\system \cscript exe /nologo " :\windows\temp\azndldsddfggg vbs", , ,sechangenotifyprivilege|seimpersonateprivilege|secreateglobal privilegeyou can see that system process has spawned the cscript exe binary and passed in the :\windows\temp\andldsddfggg vbs parameter the example service provided should generate these events once per minute if you do directory listingyou will not see this file present what is happening is that the service is creating random filenamepushing vbscript into the fileand then executing that vbscript 've seen this action performed by commercial software in number of casesand 've seen software that copies files into temporary locationexecuteand then delete those files in order to exploit this conditionwe have to effectively win race against the executing code when the software or scheduled task creates the filewe need to be able to inject our own code into the file before the process executes it and then ultimately deletes it the trick to this is the handy windows api called readdirectorychangeswwhich enables us to monitor directory for any changes to files or subdirectories we can also filter these events so that we're able to determine when the file has been "savedso we can quickly inject our code before it' executed it can be incredibly useful to simply keep an eye on all temporary directories for period of hours or longerbecause sometimes you'll find interesting bugs or information disclosures on top of potential privilege escalations let' begin by creating file monitorand then we'll build on that to automatically inject code create new file called file_monitor py and hammer out the followingmodified example that is originally given herehtml import tempfile import threading import win file import win con import os these are the common temp file directories dirs_to_monitor [" :\\windows\\temp",tempfile gettempdir()file modification constants file_created file_deleted file_modified file_renamed_from file_renamed_to def start_monitor(path_to_watch)