One Day Sec

What are some limitations or variations of the Long UNC folder creation for UAC bypass?

The fake folder can be created with multiple spaces (e.g., `\\?\C:\Windows `) or using at least two periods (e.g., `\\?\C:\Windows..`), but only the space variation works for UAC bypass. Additionally, short filenames (8.3 format) cannot be used to reference the fake path. The technique exploits path confusion to deceive administrators during process auditing, as the folder name appears identical to the legitimate `Windows` directory. Further variations are explored in Expansion of Techniques for Exploiting Simulated Trusted Directories.
Long UNC variationsspacesdotsshort filenameprocess auditing

Browse all Q&A →