Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
This is a bit old (2007) but it shows this kind of bug perfectly well. http://securitytracker.com/id/1018588 So I can imagine one scenario in which DLL hijacking would make sense - if the developers neglected to properly set the directory permissions and it got reported as a vuln, the patch *could* have been to properly set the permissions on *files* and forget to set them on the directory. It'd be an extremely stupid way to patch. Then again, it's an extremely stupid bug to begin with, so... :) On Mon, Sep 26, 2011 at 3:36 AM, Thor (Hammer of God) t...@hammerofgod.comwrote: You'd have to be admin to install as a service, and the service would obviously need to then be running as local system to be of benefit (beyond what a normal user could do anyway) AND the installer would have to grant a normal user rights to overwrite it. Certainly possible, but the developer would have to go out of their way to screw that up. And if they did, it still wouldn't be because of the OS... T On Sep 25, 2011, at 6:18 PM, Travis Biehn tbi...@gmail.com wrote: GloW: there's a lot of 3rd party software that installs itself as windows services. -Travis On Sun, Sep 25, 2011 at 9:15 PM, GloW - XD doo...@gmail.com doo...@gmail.com wrote: Haha , too good and too true thor ! Maybe he can trick the user into installing on a FAT32 partition first, and THEN get the to execute from a remote share! Rofl x10. Agreed , this kind of attack, is NOT deasible in 2011, try maybe, 2006. Anyhow it has been a pleasure, ending this BS i think once and for all, lookup how winlogon works for one thing, then look at how windows creates and maintains a service_table, and then at the dlls, wich are protected ofc, you cannot touch msgina.dll,without ALOT of help from a rootkit or something similar, in wich case, why would you need to ? You could add an admin, hidden, and in simple batfile script (yes i do have my own code but no it is not for kids..), this is 10seconds and hidden, so when you have gotten that far, why would you bother to hijack a dll ? You CANNOT do crap,without complete ADMIN not SYSTEm, ADMIN$ share, and total axcs to all sockets, meaning, all pipe control and thats where half of windows exchanges smb shares for one thing, you guys dont seem to know CRAP about windows to start with, then have the gall to raise such a frigging ridiculous topic about a non happening, YOUTUBE ONE 'real' event, of this being useful, or, even just working, and i would look but, you wont, cannot, and will never be able to, especially on newer systems of windows7-8. As i said earlier, enjoy your bs DFLL hijacking, but ms, dont care for it, and whatever patches they instilled, dont touch even service_table.. so, they have not given it a high prio,and why shuld they. This is simply a case of a secteam gaining notoriety, to try and make this a 'big bug!!' , to try and gain brownie points from MS. Even tho, i dont believe in many things MS, I know windows system, and how to break it, better than many people, and i can tell you now, this whole DLL hijack, is a complete and utter waste of your times. But... keep on going, maybe MS will send you another 'thankyou' email ;) xd / http://crazycoders.comcrazycoders.com / #haxnet@Ef On 26 September 2011 10:52, Thor (Hammer of God) t...@hammerofgod.com t...@hammerofgod.com wrote: Maybe he can trick the user into installing on a FAT32 partition first, and THEN get the to execute from a remote share! On Sep 25, 2011, at 5:30 PM, Travis Biehn tbi...@gmail.com tbi...@gmail.com wrote: It might be a fun experiment to see what DLLs they're looking for :.) -Travis On Sun, Sep 25, 2011 at 2:57 PM, kz2...@googlemail.comkz2...@googlemail.com kz2...@googlemail.com wrote: To replace a service executable you usually need administrator access anyway. --Original Message-- From: Madhur Ahuja Sender: full-disclosure-boun...@lists.grok.org.ukfull-disclosure-boun...@lists.grok.org.uk full-disclosure-boun...@lists.grok.org.uk To: security-bas...@securityfocus.comsecurity-bas...@securityfocus.com security-bas...@securityfocus.com To: full-disclosure@lists.grok.org.ukfull-disclosure@lists.grok.org.uk full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting Sent: 25 Sep 2011 19:31 Imagine a situation where I have a Windows system with the restricted user access and want to get the Administrator access. There are many services in Windows which run with SYSTEM account. If there exists even one such service whose executable is not protected by Windows File Protection, isn't it possible to execute malicious code (such as gaining Administrator access) simply by replacing the service executable with malicious one and then restarting the service. As a restricted user, what's stopping me to do this ? Is there any integrity check performed by services.msc
Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
To replace a service executable you usually need administrator access anyway. --Original Message-- From: Madhur Ahuja Sender: full-disclosure-boun...@lists.grok.org.uk To: security-bas...@securityfocus.com To: full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting Sent: 25 Sep 2011 19:31 Imagine a situation where I have a Windows system with the restricted user access and want to get the Administrator access. There are many services in Windows which run with SYSTEM account. If there exists even one such service whose executable is not protected by Windows File Protection, isn't it possible to execute malicious code (such as gaining Administrator access) simply by replacing the service executable with malicious one and then restarting the service. As a restricted user, what's stopping me to do this ? Is there any integrity check performed by services.msc or service itself before executing with SYSTEM account ? Madhur ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ Sent from my POS BlackBerry wireless device, which may wipe itself at any moment ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
It might be a fun experiment to see what DLLs they're looking for :.) -Travis On Sun, Sep 25, 2011 at 2:57 PM, kz2...@googlemail.com wrote: To replace a service executable you usually need administrator access anyway. --Original Message-- From: Madhur Ahuja Sender: full-disclosure-boun...@lists.grok.org.uk To: security-bas...@securityfocus.com To: full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting Sent: 25 Sep 2011 19:31 Imagine a situation where I have a Windows system with the restricted user access and want to get the Administrator access. There are many services in Windows which run with SYSTEM account. If there exists even one such service whose executable is not protected by Windows File Protection, isn't it possible to execute malicious code (such as gaining Administrator access) simply by replacing the service executable with malicious one and then restarting the service. As a restricted user, what's stopping me to do this ? Is there any integrity check performed by services.msc or service itself before executing with SYSTEM account ? Madhur ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ Sent from my POS BlackBerry wireless device, which may wipe itself at any moment ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -- Twitter https://twitter.com/tbiehn | LinkedInhttp://www.linkedin.com/in/travisbiehn| GitHub http://github.com/tbiehn | TravisBiehn.comhttp://www.travisbiehn.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
Good luck with that... you might want to look into msgina.dll , try replace that ;) have phun xd On 26 September 2011 10:29, Travis Biehn tbi...@gmail.com wrote: It might be a fun experiment to see what DLLs they're looking for :.) -Travis On Sun, Sep 25, 2011 at 2:57 PM, kz2...@googlemail.com wrote: To replace a service executable you usually need administrator access anyway. --Original Message-- From: Madhur Ahuja Sender: full-disclosure-boun...@lists.grok.org.uk To: security-bas...@securityfocus.com To: full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting Sent: 25 Sep 2011 19:31 Imagine a situation where I have a Windows system with the restricted user access and want to get the Administrator access. There are many services in Windows which run with SYSTEM account. If there exists even one such service whose executable is not protected by Windows File Protection, isn't it possible to execute malicious code (such as gaining Administrator access) simply by replacing the service executable with malicious one and then restarting the service. As a restricted user, what's stopping me to do this ? Is there any integrity check performed by services.msc or service itself before executing with SYSTEM account ? Madhur ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ Sent from my POS BlackBerry wireless device, which may wipe itself at any moment ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -- Twitter https://twitter.com/tbiehn | LinkedInhttp://www.linkedin.com/in/travisbiehn| GitHub http://github.com/tbiehn | TravisBiehn.comhttp://www.travisbiehn.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
Maybe he can trick the user into installing on a FAT32 partition first, and THEN get the to execute from a remote share! On Sep 25, 2011, at 5:30 PM, Travis Biehn tbi...@gmail.commailto:tbi...@gmail.com wrote: It might be a fun experiment to see what DLLs they're looking for :.) -Travis On Sun, Sep 25, 2011 at 2:57 PM, mailto:kz2...@googlemail.comkz2...@googlemail.commailto:kz2...@googlemail.com wrote: To replace a service executable you usually need administrator access anyway. --Original Message-- From: Madhur Ahuja Sender: mailto:full-disclosure-boun...@lists.grok.org.uk full-disclosure-boun...@lists.grok.org.ukmailto:full-disclosure-boun...@lists.grok.org.uk To: mailto:security-bas...@securityfocus.com security-bas...@securityfocus.commailto:security-bas...@securityfocus.com To: mailto:full-disclosure@lists.grok.org.uk full-disclosure@lists.grok.org.ukmailto:full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting Sent: 25 Sep 2011 19:31 Imagine a situation where I have a Windows system with the restricted user access and want to get the Administrator access. There are many services in Windows which run with SYSTEM account. If there exists even one such service whose executable is not protected by Windows File Protection, isn't it possible to execute malicious code (such as gaining Administrator access) simply by replacing the service executable with malicious one and then restarting the service. As a restricted user, what's stopping me to do this ? Is there any integrity check performed by services.msc or service itself before executing with SYSTEM account ? Madhur ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ http://secunia.com/ Sent from my POS BlackBerry wireless device, which may wipe itself at any moment ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ http://secunia.com/ -- Twitterhttps://twitter.com/tbiehn | LinkedInhttp://www.linkedin.com/in/travisbiehn | GitHubhttp://github.com/tbiehn | http://www.travisbiehn.com TravisBiehn.comhttp://TravisBiehn.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
Haha , too good and too true thor ! Maybe he can trick the user into installing on a FAT32 partition first, and THEN get the to execute from a remote share! Rofl x10. Agreed , this kind of attack, is NOT deasible in 2011, try maybe, 2006. Anyhow it has been a pleasure, ending this BS i think once and for all, lookup how winlogon works for one thing, then look at how windows creates and maintains a service_table, and then at the dlls, wich are protected ofc, you cannot touch msgina.dll,without ALOT of help from a rootkit or something similar, in wich case, why would you need to ? You could add an admin, hidden, and in simple batfile script (yes i do have my own code but no it is not for kids..), this is 10seconds and hidden, so when you have gotten that far, why would you bother to hijack a dll ? You CANNOT do crap,without complete ADMIN not SYSTEm, ADMIN$ share, and total axcs to all sockets, meaning, all pipe control and thats where half of windows exchanges smb shares for one thing, you guys dont seem to know CRAP about windows to start with, then have the gall to raise such a frigging ridiculous topic about a non happening, YOUTUBE ONE 'real' event, of this being useful, or, even just working, and i would look but, you wont, cannot, and will never be able to, especially on newer systems of windows7-8. As i said earlier, enjoy your bs DFLL hijacking, but ms, dont care for it, and whatever patches they instilled, dont touch even service_table.. so, they have not given it a high prio,and why shuld they. This is simply a case of a secteam gaining notoriety, to try and make this a 'big bug!!' , to try and gain brownie points from MS. Even tho, i dont believe in many things MS, I know windows system, and how to break it, better than many people, and i can tell you now, this whole DLL hijack, is a complete and utter waste of your times. But... keep on going, maybe MS will send you another 'thankyou' email ;) xd / crazycoders.com / #haxnet@Ef On 26 September 2011 10:52, Thor (Hammer of God) t...@hammerofgod.comwrote: Maybe he can trick the user into installing on a FAT32 partition first, and THEN get the to execute from a remote share! On Sep 25, 2011, at 5:30 PM, Travis Biehn tbi...@gmail.com wrote: It might be a fun experiment to see what DLLs they're looking for :.) -Travis On Sun, Sep 25, 2011 at 2:57 PM, kz2...@googlemail.com kz2...@googlemail.com wrote: To replace a service executable you usually need administrator access anyway. --Original Message-- From: Madhur Ahuja Sender: full-disclosure-boun...@lists.grok.org.uk full-disclosure-boun...@lists.grok.org.uk To: security-bas...@securityfocus.comsecurity-bas...@securityfocus.com To: full-disclosure@lists.grok.org.ukfull-disclosure@lists.grok.org.uk Subject: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting Sent: 25 Sep 2011 19:31 Imagine a situation where I have a Windows system with the restricted user access and want to get the Administrator access. There are many services in Windows which run with SYSTEM account. If there exists even one such service whose executable is not protected by Windows File Protection, isn't it possible to execute malicious code (such as gaining Administrator access) simply by replacing the service executable with malicious one and then restarting the service. As a restricted user, what's stopping me to do this ? Is there any integrity check performed by services.msc or service itself before executing with SYSTEM account ? Madhur ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ http://secunia.com/ Sent from my POS BlackBerry wireless device, which may wipe itself at any moment ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ http://secunia.com/ -- Twitter https://twitter.com/tbiehn | LinkedInhttp://www.linkedin.com/in/travisbiehn| GitHub http://github.com/tbiehn | http://www.travisbiehn.com TravisBiehn.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk
Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
GloW: there's a lot of 3rd party software that installs itself as windows services. -Travis On Sun, Sep 25, 2011 at 9:15 PM, GloW - XD doo...@gmail.com wrote: Haha , too good and too true thor ! Maybe he can trick the user into installing on a FAT32 partition first, and THEN get the to execute from a remote share! Rofl x10. Agreed , this kind of attack, is NOT deasible in 2011, try maybe, 2006. Anyhow it has been a pleasure, ending this BS i think once and for all, lookup how winlogon works for one thing, then look at how windows creates and maintains a service_table, and then at the dlls, wich are protected ofc, you cannot touch msgina.dll,without ALOT of help from a rootkit or something similar, in wich case, why would you need to ? You could add an admin, hidden, and in simple batfile script (yes i do have my own code but no it is not for kids..), this is 10seconds and hidden, so when you have gotten that far, why would you bother to hijack a dll ? You CANNOT do crap,without complete ADMIN not SYSTEm, ADMIN$ share, and total axcs to all sockets, meaning, all pipe control and thats where half of windows exchanges smb shares for one thing, you guys dont seem to know CRAP about windows to start with, then have the gall to raise such a frigging ridiculous topic about a non happening, YOUTUBE ONE 'real' event, of this being useful, or, even just working, and i would look but, you wont, cannot, and will never be able to, especially on newer systems of windows7-8. As i said earlier, enjoy your bs DFLL hijacking, but ms, dont care for it, and whatever patches they instilled, dont touch even service_table.. so, they have not given it a high prio,and why shuld they. This is simply a case of a secteam gaining notoriety, to try and make this a 'big bug!!' , to try and gain brownie points from MS. Even tho, i dont believe in many things MS, I know windows system, and how to break it, better than many people, and i can tell you now, this whole DLL hijack, is a complete and utter waste of your times. But... keep on going, maybe MS will send you another 'thankyou' email ;) xd / crazycoders.com / #haxnet@Ef On 26 September 2011 10:52, Thor (Hammer of God) t...@hammerofgod.comwrote: Maybe he can trick the user into installing on a FAT32 partition first, and THEN get the to execute from a remote share! On Sep 25, 2011, at 5:30 PM, Travis Biehn tbi...@gmail.com wrote: It might be a fun experiment to see what DLLs they're looking for :.) -Travis On Sun, Sep 25, 2011 at 2:57 PM, kz2...@googlemail.com kz2...@googlemail.com wrote: To replace a service executable you usually need administrator access anyway. --Original Message-- From: Madhur Ahuja Sender: full-disclosure-boun...@lists.grok.org.uk full-disclosure-boun...@lists.grok.org.uk To: security-bas...@securityfocus.comsecurity-bas...@securityfocus.com To: full-disclosure@lists.grok.org.ukfull-disclosure@lists.grok.org.uk Subject: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting Sent: 25 Sep 2011 19:31 Imagine a situation where I have a Windows system with the restricted user access and want to get the Administrator access. There are many services in Windows which run with SYSTEM account. If there exists even one such service whose executable is not protected by Windows File Protection, isn't it possible to execute malicious code (such as gaining Administrator access) simply by replacing the service executable with malicious one and then restarting the service. As a restricted user, what's stopping me to do this ? Is there any integrity check performed by services.msc or service itself before executing with SYSTEM account ? Madhur ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ http://secunia.com/ Sent from my POS BlackBerry wireless device, which may wipe itself at any moment ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ http://secunia.com/ -- Twitter https://twitter.com/tbiehn | LinkedInhttp://www.linkedin.com/in/travisbiehn| GitHub http://github.com/tbiehn | http://www.travisbiehn.com TravisBiehn.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full
Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
You'd have to be admin to install as a service, and the service would obviously need to then be running as local system to be of benefit (beyond what a normal user could do anyway) AND the installer would have to grant a normal user rights to overwrite it. Certainly possible, but the developer would have to go out of their way to screw that up. And if they did, it still wouldn't be because of the OS... T On Sep 25, 2011, at 6:18 PM, Travis Biehn tbi...@gmail.commailto:tbi...@gmail.com wrote: GloW: there's a lot of 3rd party software that installs itself as windows services. -Travis On Sun, Sep 25, 2011 at 9:15 PM, GloW - XD mailto:doo...@gmail.comdoo...@gmail.commailto:doo...@gmail.com wrote: Haha , too good and too true thor ! Maybe he can trick the user into installing on a FAT32 partition first, and THEN get the to execute from a remote share! Rofl x10. Agreed , this kind of attack, is NOT deasible in 2011, try maybe, 2006. Anyhow it has been a pleasure, ending this BS i think once and for all, lookup how winlogon works for one thing, then look at how windows creates and maintains a service_table, and then at the dlls, wich are protected ofc, you cannot touch msgina.dll,without ALOT of help from a rootkit or something similar, in wich case, why would you need to ? You could add an admin, hidden, and in simple batfile script (yes i do have my own code but no it is not for kids..), this is 10seconds and hidden, so when you have gotten that far, why would you bother to hijack a dll ? You CANNOT do crap,without complete ADMIN not SYSTEm, ADMIN$ share, and total axcs to all sockets, meaning, all pipe control and thats where half of windows exchanges smb shares for one thing, you guys dont seem to know CRAP about windows to start with, then have the gall to raise such a frigging ridiculous topic about a non happening, YOUTUBE ONE 'real' event, of this being useful, or, even just working, and i would look but, you wont, cannot, and will never be able to, especially on newer systems of windows7-8. As i said earlier, enjoy your bs DFLL hijacking, but ms, dont care for it, and whatever patches they instilled, dont touch even service_table.. so, they have not given it a high prio,and why shuld they. This is simply a case of a secteam gaining notoriety, to try and make this a 'big bug!!' , to try and gain brownie points from MS. Even tho, i dont believe in many things MS, I know windows system, and how to break it, better than many people, and i can tell you now, this whole DLL hijack, is a complete and utter waste of your times. But... keep on going, maybe MS will send you another 'thankyou' email ;) xd / http://crazycoders.com crazycoders.comhttp://crazycoders.com / #haxnet@Ef On 26 September 2011 10:52, Thor (Hammer of God) mailto:t...@hammerofgod.comt...@hammerofgod.commailto:t...@hammerofgod.com wrote: Maybe he can trick the user into installing on a FAT32 partition first, and THEN get the to execute from a remote share! On Sep 25, 2011, at 5:30 PM, Travis Biehn mailto:tbi...@gmail.comtbi...@gmail.commailto:tbi...@gmail.com wrote: It might be a fun experiment to see what DLLs they're looking for :.) -Travis On Sun, Sep 25, 2011 at 2:57 PM, mailto:kz2...@googlemail.commailto:kz2...@googlemail.comkz2...@googlemail.commailto:kz2...@googlemail.com wrote: To replace a service executable you usually need administrator access anyway. --Original Message-- From: Madhur Ahuja Sender: mailto:full-disclosure-boun...@lists.grok.org.uk mailto:full-disclosure-boun...@lists.grok.org.uk full-disclosure-boun...@lists.grok.org.ukmailto:full-disclosure-boun...@lists.grok.org.uk To: mailto:security-bas...@securityfocus.com mailto:security-bas...@securityfocus.com security-bas...@securityfocus.commailto:security-bas...@securityfocus.com To: mailto:full-disclosure@lists.grok.org.uk mailto:full-disclosure@lists.grok.org.uk full-disclosure@lists.grok.org.ukmailto:full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting Sent: 25 Sep 2011 19:31 Imagine a situation where I have a Windows system with the restricted user access and want to get the Administrator access. There are many services in Windows which run with SYSTEM account. If there exists even one such service whose executable is not protected by Windows File Protection, isn't it possible to execute malicious code (such as gaining Administrator access) simply by replacing the service executable with malicious one and then restarting the service. As a restricted user, what's stopping me to do this ? Is there any integrity check performed by services.msc or service itself before executing with SYSTEM account ? Madhur ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html http://lists.grok.org.uk/full-disclosure-charter.html http://lists.grok.org.uk/full
Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
On Mon, 26 Sep 2011 01:36:13 -, Thor (Hammer of God) said: Certainly possible, but the developer would have to go out of their way to screw that up. Yes, but doesn't that sentence describe like 75% of all the CVE's out there? :) pgpLnNoqmv0WQ.pgp Description: PGP signature ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
