News for hackers. Stuff that matters.
Re:Deleting System32\curl.exe by tyingq on Monday April 24, 2023 @06:43AM (#35685866)
I'm guessing a common sequence is someone knowing what curl is, but not knowing that Windows ships with it. So, thinking that System32\curl.exe must have been put there by malware, or put there by someone installing optional software.
Re:Deleting System32\curl.exe by Freak_NL on Monday April 24, 2023 @06:57AM (#35685973)
Microsoft should have renamed it to WINDLHLP.COM or something Windowsy like that, and none of these people would have dared touch it.
Re:Deleting System32\curl.exe by tyingq on Monday April 24, 2023 @07:00AM (#35685997)
I noticed that "curl" in PowerShell is an alias, so you would have to deliberately say "curl.exe" to get System32\curl.exe

  C:\> alias curl

  CommandType     Name                                               Version    
  Source
  -----------     ----                                               -------    ------
  Alias           curl -> Invoke-WebRequest
Re:Deleting System32\curl.exe by justeleblanc on Monday April 24, 2023 @08:06AM (#35686591)
That's not the case in the latest versions of powershell.
Re:Deleting System32\curl.exe by VWWHFSfQ on Monday April 24, 2023 @09:32AM (#35687427)
Yeah they did the same thing with wget. Just absolutely bonkers
Re:Deleting System32\curl.exe by phpisthebest on Monday April 24, 2023 @09:49AM (#35687623)
That is for Windows Powershell, not Powershell (and yes Windows Powershell is different from PowerShell [1])

curl > curl.exe > C:\Windows\System32\curl.exe

[1] https://learn.microsoft.com/en-us/powershell/scripting/whats...

Re:Deleting System32\curl.exe by thomasjudge on Monday April 24, 2023 @11:22AM (#35688745)
This is so Microsoft