wh04m1001 / zonealarmeop

Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV

Hi there 👋

Penetration tester - Interested in Windows internals and security research.

---

zonealarmeop's Issues

Some Questions

Hi Filip, thanks for sharing this great idea, I also found basically the same situation in the Windows service, but when I use this poc as a template to write my own poc, while locking the bad file, and trigger it, the next action is deleting the old file(old file will SetRenameInformationFile to bad file), and try move the bad file through NtSetInformationFile, But in this moment, Delete the old file is not success, it will get the error number: 32 which means [The process cannot access the file because it is being used by another process], I wonder how u fix and solve it