Question re: executing files from inside archives

Discussion in 'other software & services' started by Gullible Jones, Feb 19, 2016.

  1. Gullible Jones

    Gullible Jones Registered Member

    Joined:
    May 16, 2013
    Posts:
    1,459
    I don't have a Windows system handy at the moment, so I can't answer this myself right now...

    Say you download an archive, which contains an executable. You open the archive in Explorer or whatever, then double-click on the executable. It runs. Right?

    Now, where is it running from?

    Is it

    a) Being accessed directly from the archive, with some virtual filesystem layer transparently decompressing it as needed

    b) Dumped into a temporary file somewhere, and run from there?

    Why do I care? Because in the latter case, NTFS ACLs should be able to prevent it from running (if you apply them on the right directory). But in the former, it could potentially bypass ACLs, since the VFS might be subject to different rules than the hard disk filesystem.

    Anyone know the answer?
     
  2. rossnixon

    rossnixon Registered Member

    Joined:
    Aug 14, 2013
    Posts:
    21
    Location:
    New Zealand
    Yes, I just tested it to confirm.

    The executable gets extracted to the %temp% directory, and runs from there.
     
  3. Gullible Jones

    Gullible Jones Registered Member

    Joined:
    May 16, 2013
    Posts:
    1,459
Loading...