Skip to content

Latest commit

 

History

History
13 lines (11 loc) · 922 Bytes

README.md

File metadata and controls

13 lines (11 loc) · 922 Bytes
Raw

🗑️ delete-self-poc

A way to delete a locked, or current running executable, on disk. This was originally found by Jonas Lykkegaard - I just wrote the POC for it. This can also be used to delete locked files on disk, that the current calling process has permissions to get DELETE access to.

How does this work, though - in this POC?

  1. Open a HANDLE to the current running process, with GENERIC_READ | SYNCHRONIZE | DELETE access. Note, DELETE is only needed.
  2. Rename the primary file stream, :$DATA, using SetFileInformationByHandle to :wtfbbq.
  3. Close the HANDLE
  4. Open a HANDLE to the current process, set DeleteFile for the FileDispositionInfo class to TRUE.
  5. Close the HANDLE to trigger the file disposition
  6. Viola - the file is gone.

Releases

I have included a statically linked release within this repository, if you can't be bothered compiling the original source code.