5
1
Quick scenario on a local Windows system.
Drive E:
is formatted with NTFS has the following layout and permissions:
E:\ (JohnDoe)
E:\folder (Administrator)
E:\folder\subfolder (JohnDoe)
JohnDoe
has read/write access to the root directory.JohnDoe
has read/write accesssubfolder
JohnDoe
does NOT have access tofolder
JohnDoe
does NOT have the ability to alter permissions.
Since JohnDoe
cannot access folder
and thus cannot list the contents, he must type in the path E:\folder\subfolder
manually. There is is no "clickable" way to get from E:\
to subfolder
.
Here's the question: Is there any way for JohnDoe
to discover the existence and path of the accessible subfolder
, without being able to list the contents of it's parent folder
? Assume that he was not told the subfolder
's name and that the permissions do not change from what is stated above.
For the sake of this problem, ignore the possibility of a brute-force attack to guess subfolder
's name. Only non-brute-force methods are permitted.
4This is the correct answer for Windows – if you do not have the "Read" permission on
folder
, you cannot list its contents. But note that, even though one would expectfolder\subfolder
to be entirely inaccessible due to lack of the "Traverse" permission onfolder
(corresponding to thex
bit on Unix), by default Windows gives everyone the "Bypass traverse checking" privilege andsubfolder
remains reachable if its full path is known. – user1686 – 2011-10-07T05:56:22.733