Hacker News Reader

Comment by hyperman1 | Hacker News Reader

There used to be a weird trick here: Who says drive letters have to be letters? If you had more than 26 drives, msdos just took whatever was in the ascii table after Z: . This was easy to cause with network drives. Programs mostly just went with it unquestioningly. I don 't remember what happens if your drive letter itself is a backslash.

A few years ago it was still possible to do stuff like

  subst ?: C:\somepath

Then you had a drive ?: which was accepted by half of your programs but not the others.

I don't have a win10 laying around so I can't test if this is still true today.

View on HN

Muhaha.

As a DoS of DOS: x:\> copy c:\config.sys CLOCK$

Also special DOS filenames:

    CON PRN AUX NUL {COM,LPT}[1-9]

https://superuser.com/questions/1362080/which-characters-are...

Print autoexec.bat to the dot matrix printer on LPT1?

    x:\> copy autoexec.bat lpt1
    x:\>

Create a file called foo.txt without an editor?

    x:\> copy con foo.txt
    whatever
    whatever
    whatever
    whatever
    ^Z<ENTER>
    x:\>

A social DoS of any machine with BASIC or similar.

    10 INPUT "Press any key to continue..."; $X
    20 GOTO 10

When good floppies go bad:

    General Failure reading drive A:\.
    Abort, Ignore, Retry, Fail?

Yes that still works under Windows 10/11. Useful if you are working in the command line, and have tools somewhere else that you are accessing (that are not in the PATH) and you get tired of typing the full path to the tools.

>A few years ago it was still possible to do stuff like

> subst ?: C:\somepath

>Then you had a drive ?: which was accepted by half of your programs but not the others.

Neat! Like a Windows version of chroot? Can it be used to stop programs from accessing C?

I don't think subst is a good idea for security purposes. You can't hide the original drive, some tools look right trough it, and UNC path names allow other ways.

Windows has the concepts of window stations and sessions. One of these 2 is the namespace for drive letters, as it allows different rdp users to have their own network drives, and also give services their own security context . Take sysinternals winobj to look around. Maybe you can build something chrootlike out of it, I dont really know, I am a bit out of my depth here.

Reply on news.ycombinator.com