Need help with renaming the file including permissions

Content Authoring
1

Hi Team,

Recently MS has released an advisory for Windows Type 1 Font Parsing Remote Code Execution Vulnerability and I am trying to mitigate the issue for hundred of servers using bigfix action and seems to be out after trying multiple ways. Need help!!!

I have set the registry using regset and hive names
however following the taking the ownership and renaming the file I am lost.
I am using below method in action -

waithidden cmd.exe x64 /C icacls.exe cd c:\Windows\System32 takeown.exe /f atmfd.dll
dos icacls.exe atmfd.dll /save atmfd.dll.acl
dos icacls.exe atmfd.dll /grant Administrators:(F) rename atmfd.dll x-atmfd.dll
waithidden cmd.exe x64 /C icacls.exe cd c:\Windows\System32 takeown.exe /f atmfd.dll
dos icacls.exe atmfd.dll /save atmfd.dll.acl
dos icacls.exe atmfd.dll /grant Administrators:(F) rename atmfd.dll x-atmfd.dll

if{x64 of operating system}
endif

Please suggest.

2

We facing same issue, run the actio it executed in syswow64 directry success but failed to run in Windows\system32 directory …hundreds of servers we need to perform …please need help

3

I can’t make much sense of what you’re doing - the syntax for those commands is so far off that I’d start over.

I haven’t checked that particular bulletin, but I can give you a starting point. To run 64-bit commands and affect the system32 folder instead of the syswow64 folder, you’ll need action uses wow64 redirection false.

You also can’t use things like ‘waithidden cd’ because each waithidden spawns a new shell, with its own default working directory. You also have icacls and takeown in the wrong order, I think.

The start of what you’ll need is more like

Action uses wow64 redirection false

Waithidden takeown.exe "c:\windows\system32\atmfd.dll"

Waithidden icacls.exe "c:\windows\system32\atmfd.dll" /grant Administrators:F 

Move "c:\windows\system32\atmfd.dll" "c:\windows\system32\x-atmfd.dll"

But I don’t know that it’s Administrators you need to Grant access, since BESClient is running as LocalSystem. Check the syntax on icacls, you may need the account to be “NT AUTHORITY\SYSTEM” instead.

4

Hi Jason,

We tried your steps , all went fine but the last command line Move “c:\windows\system32\atmfd.dll” “c:\windows\system32\x-atmfd.dll” dint work as expected.
failed to rename the file as x-atmfd.dll.
Any help is appreciated.
how can we run with account “NT AUTHORITY\SYSTEM”

5

With BESClient, you’re already running as system; so you may need to change the icacls command to Grant permissions to the system account rather than Administrators

6

thanks for the clue , actually the same commands as is working fine for the syswow64 directory and failing for windows\system32
why could be that any idea?

7

Can you post the full ActionScript you’re using now?

8

Hi Jason

Thanks I used the below action and its working fine , THANKS LOT, but just one new issue occured the file is getting renamed as x-atmfd.dll" (its adding the quotes to the renamed file! by this its also changing the file type to dll" instead for file type Application extension.)

Action uses wow64 redirection false

Waithidden takeown.exe “c:\windows\system32\atmfd.dll”

Waithidden icacls.exe “c:\windows\system32\atmfd.dll” /grant Administrators:F

Move “c:\windows\system32\atmfd.dll” " c:\windows\system32\x-atmfd.dll”

Waithidden takeown.exe “c:\windows\ syswow64\atmfd.dll”

Waithidden icacls.exe “c:\windows\ syswow64\atmfd.dll” /grant Administrators:F

Move “c:\windows\ syswow64\atmfd.dll” " c:\windows\ syswow64\x-atmfd.dll”

9

sorry …correction here , actually we replaced Administrator or SYSTEM in the working action

Action uses wow64 redirection false

Waithidden takeown.exe “c:\windows\system32\atmfd.dll”

Waithidden icacls.exe “c:\windows\system32\atmfd.dll” /grant SYSTEM:F

Move “c:\windows\system32\atmfd.dll” " c:\windows\system32\x-atmfd.dll”

Waithidden takeown.exe “c:\windows\ syswow64\atmfd.dll”

Waithidden icacls.exe “c:\windows\ syswow64\atmfd.dll” /grant SYSTEM:F

Move “c:\windows\ syswow64\atmfd.dll” " c:\windows\ syswow64\x-atmfd.dll”

10

It looks like there is a mix of “smart quotes” and normal quotes. That might just be the Forum software or your browser converting them when you post to the forum, but check your action to be sure the quotes are correct. It also looks like there is a space after the quote and before C:\ in your target filenames.

11

dll-Bigfixme Action
dll-Bigfixme Action859×522 36 KB

Please see the picture attached for more clear understanding

/save atmfd.dll.acl command successful but we couldn’t find the file in both directory system32 and syswow64 directory ?
rest all went fine .

12

You’ll need to specify the fully-qualified path of the file to save, else it’ll end up in the BESData directory (and get removed with the next site update).

13

Hi Jason
Thanks again after we did fully-qualified path as /save "c:\windows\system32\atmfd.dll.acl
this file appear correctly but now the next command line didnt work that is the Move “c:\windows\system32\atmfd.dll” "c:\windows\system32\x-atmfd.dll didn’t work totally in both the directories system32 and syswoW64

14

If your are running the action repeatedly, you’ll need to delete the Target file first. The 'movec command in ActionScript will not overwrite an existing file, so add a delete command first.

15

each time we are trying it on a new server where everything as default. strange think is that if you notice , if we fix one line the other is not working as expected.
everything is working fine except that we added the line as per solution requirement /save atmfd.dll.acl
if we remove this line as is the action is working fine.

16

Dear Jason,
Many thanks for guideline .
This below actions are successfully working & VA are getting fixed.

Action uses wow64 redirection false
Waithidden takeown.exe "c:\windows\system32\atmfd.dll"
Waithidden icacls.exe “c:\windows\system32\atmfd.dll” /grant SYSTEM:F
Waithidden icacls.exe atmfd.dll /save "c:\windows\system32\atmfd.dll.acl"
Move “c:\windows\system32\atmfd.dll” "c:\windows\system32\x-atmfd.dll"
Waithidden takeown.exe "c:\windows\syswow64\atmfd.dll"
Waithidden icacls.exe “c:\windows\syswow64\atmfd.dll” /grant SYSTEM:F
Waithidden icacls.exe atmfd.dll /save "c:\windows\syswow64\atmfd.dll.acl"
Move “c:\windows\syswow64\atmfd.dll” “c:\windows\syswow64\x-atmfd.dll”

1 Like