T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/migrate.bat:13- Finding
Predictable staging directory permits local executable substitution
- Content
View full analysis
nul if not exist "C:\migrate_tmp\node.exe" ( echo FAILED to stage node.exe - aborting. pause exit /b 1 ) C:\migrate_tmp\node.exe "%~dp0migrate.js" set RC=%errorlevel% C:\Windows\System32\cmd.exe /c rmdir /s /q C:\migrate_tmp >nul 2>&1 ``` ### Technical Analysis The launcher stages and executes `node.exe` from the fixed, globally predictable path `C:\migrate_tmp`. It does not securely create this directory, restrict its permissions, verify that it owns the directory, validate the `robocopy` exit status, or compare the staged executable with the trusted source. The only validation is an existence check. If a local attacker pre-creates `C:\migrate_tmp\node.exe` and prevents `robocopy` from replacing it—for example, through directory permissions, file permissions, or a lock—the existence test still succeeds. The launcher then executes the attacker-controlled binary. Because the script invokes the staged executable directly, this is a tool-spoofing vulnerability rather than ordinary command-line injection. ### Attack Path 1. A local attacker creates `C:\migrate_tmp`. 2. The attacker places a malicious executable at `C:\migrate_tmp\node.exe`. 3. The attacker configures permissions or locks so that the legitimate `node.exe` cannot replace the malicious file. 4. The victim starts `scripts/migrate.bat`. 5. `robocopy` fails to replace the planted executable, but its result is not checked. 6. `if not exist` succeeds because the malicious file exists. 7. The batch file executes the malicious `node.exe` with the victim's privileges. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privi ...[truncated 334 chars]- Remediation
View remediation