A way to delete a locked, or current running executable, on disk. This was originally found by Jonas Lykkegaard - I just wrote the POC for it. This can also be used to delete locked files on disk, that the current calling process has permissions to get DELETE
access to.
How does this work, though - in this POC?
- Open a
HANDLE
to the current running process, withGENERIC_READ | SYNCHRONIZE | DELETE
access. Note,DELETE
is only needed. - Rename the primary file stream,
:$DATA
, usingSetFileInformationByHandle
to:wtfbbq
. - Close the
HANDLE
- Open a
HANDLE
to the current process, setDeleteFile
for theFileDispositionInfo
class toTRUE
. - Close the
HANDLE
to trigger the file disposition - Viola - the file is gone.
I have included a statically linked release within this repository, if you can't be bothered compiling the original source code.