1

once a wise man told to me that every folder contains a file autorun.inf (not sure about the name but properties are same as autorun.inf) and he changes the codes of the file to execute a batch script(batch script is present in the same directory) which generally delets a specified file in another directory. I was not able to find such files in any of my folder.

so the question is- "is there any such file with such properties in every folder" or in general is this possible if YES then how?

3 Answers3

2

I think you're talking about desktop.ini not autorun.inf (You're correct, by the way. They both have the same format) and the buffer overflow vulnerability in Windows Shell, MS03-027. Yes, it made it possible to execute commands specified in the desktop.ini file in a directory upon the access of that directory. That vulnerability was patched long time ago.

Luckily for you, there's a another way, albeit more complicated and less malicious, to do that. It's called "shell custom verbs", and it works on modern systems. The idea is simple:

  1. You create a new "verb" (action) and register it in HKEY_CLASSES_ROOT.

  2. For the execution of your newly created verb, you need to create a WSH script and bind it to that verb using the shell\RunAppFolder\command Windows Register key for the verb you've created (Note: The value @ in that key must be stored as a hex string).

  3. Finally, you add that verb to the desktop.ini file in your desired folder and mark it as the default action.

Adi
  • 219
0

Modern versions of Windows have this disabled. autorun.inf used to be included in CDs by vendors and then would be read by Windows to look for a program specified in this file to run. It was mostly used for starting setup or some internal program in CD whenever it was inserted in your CD-Rom. You could control how this worked and adjust it but if I remember correctly it was on by default.

As it was abusable it got patched in 2009. I am not sure that there was ever such functionality for any folder, but I know for sure it worked for external USB drives.

In short, this is only possible on old and outdated Windows (pre 2009 feb).

You can check Microsoft security advisory regarding this here: https://technet.microsoft.com/library/security/967940

ek9
  • 3,455
0

Only the root directory of drives can execute autorun.inf and only if AutoPlay is enabled. Arbitrary folders can be customized with desktop.ini, but not made to automatically run a program when they are executed.

Synetech
  • 69,547