Manually insert RIGHT-TO-LEFT OVERRIDE (RTL) character into the filename

http://www.charbase.com/202e-unicode-right-to-left-override
When a RIGHT-TO-LEFT OVERRIDE character is inserted into the filename, the characters that follow are displayed in reverse order.
When named properly, an .exe file can appear to be a .pdf file (e.g. evil[RTL Unicode]fdp.exe will appear as evilexe.pdf).
This does not affect the file's execution.
## By Python
>>> f = open('evil\xE2\x80\xAEfdp.exe', 'w')
>>> f.close()
>>> f = open("evil\u202efdp.exe", "w")
>>> f.close()

67c71e8e-1599-11e7-9f20-4b75e769f3a1.png

>>> import os
>>>
>>> os.rename('calc-copy.exe', 'calc-copy\xE2\x80\xAEfdp.exe')
>>> exit()
# file calc-copy?fdp.exe
calc-copy?fdp.exe: PE32+ executable for MS Windows (GUI) Mono/.Net assembly

RTL.png

ファイル名にRTL文字が含まれているか確認するbashワンライナー
echo -n $filename | xxd -p | tr -d '\r\n' | grep -i "e280ae"

Leave a Reply

Your email address will not be published. Required fields are marked *


The reCAPTCHA verification period has expired. Please reload the page.