RE: priviledge escalation techniques

From: John Cobb (johnc_at_nobytes.com)
Date: 01/17/05

  • Next message: Faisal Khan: "Re: Windows based DoS Tools?" 
    To: "'jnf'" <lists@innocence-lost.net>, <miguel.dilaj@pharma.novartis.com>
Date: Mon, 17 Jan 2005 22:44:58 -0000

    You could always do the classic 'at 12:00 /interactive cmd.exe' to gain your
    self a command prompt with 'SYSTEM' privileges (well with win2k, havent
    tested xp)

    E.g.:

    C:\>at 22:39 /interactive cmd.exe
    Added a new job with job ID = 1

    C:\>

    In a new window...

    C:\>whoami
    SYSTEM

    C:\>

    Bing :)

    (also works nice with cygwin ;) )

    Regards

    John Cobb

    www.NoBytes.com
     
    Web Design, Web Hosting, Hardware, Software, You Name it, if its to do with
    IT we can sort it.
     

    -----Original Message-----
    From: jnf [mailto:lists@innocence-lost.net]
    Sent: 17 January 2005 19:45
    To: miguel.dilaj@pharma.novartis.com
    Cc: pen-test@securityfocus.com
    Subject: Re: priviledge escalation techniques

    > and the guys at Micro$oft comit the cardinal mistake of not making IT
    > check if SHIFT was pressed 5 times, but to include that in some other
    > part of the OS (kernel? ;-)

    And while I sit here eating lunch it occured to me how silly of a statement
    that was- consider which is more of an acceptible risk-

    scenario 1) sethc.exe is run as a normal user, or rather as the user logged
    in- it does not run with any special capabilities, the keyboard driver or
    whatever intercepts and detects shift pressed 5 times, or held for X
    seconds- however IF someone managed to override your DAC's/file permissions
    then they can overwrite the program, however if this occurs- the game is
    already up because you had a more critical flaw some place else, and that is
    really the way that you lost control.

    scenario 2) sethc.exe is always running and monitoring keystrokes looking
    for any sequence of keystrokes that it recognizes, in order to do this
    either any user has to be able to 'sniff keystrokes', OR, it has to run with
    special access allowing the window for abuse to grow bigger- in addition to
    this the kernel has to take extra steps in order to pass every keystroke to
    userspace, which is going to degrade performance. So here, the simple
    program is now running with elevated status and becomes a huge potential for
    abuse.

    From a perspective of security, which is a better design? scenario 2 is
    basically what you are suggesting. I love IT Security as well, but its not
    nearly as humorous as It Security 'Professionals'

    cheers,
    jnf

  • Next message: Faisal Khan: "Re: Windows based DoS Tools?"

    Relevant Pages

    • Re: priviledge escalation techniques
      ... drop the privileges when in the need to do something else. ... Vice-President of IT Security Research, ... scenario 1) sethc.exe is run as a normal user, ... scenario 2) sethc.exe is always running and monitoring keystrokes looking ...
      (Pen-Test)
    • Re: possible solution to cdbakeoven failing to detect ATAPI burners
      ... >> No disrespect, but seriously, can you give me a scenario where something ... > that would constitute a bug in cdrecord, ... > program any more privileges than those he needs to do his job.") as ... Security is always a tradeoff with convenience, ...
      (freebsd-questions)
    • Re: priviledge escalation techniques
      ... > making IT check if SHIFT was pressed 5 times, but to include that in some ... scenario 2) sethc.exe is always running and monitoring keystrokes looking ... From a perspective of security, ...
      (Pen-Test)
    • Re: key press
      ... The receiver can do some validity checking - verifying that a key ... that the physical keyboard state when the message was generated ... If the receipt of a key press has security issues associated with it, ... I think a bigger security issue is the interception of real keystrokes ...
      (borland.public.delphi.nativeapi)
    • RE: priviledge escalation techniques
      ... The below 'at 12:00 /interactive cmd.exe' command will grant you System ... so the risk of elevated privileges is minor. ... looking for any sequence of keystrokes that it recognizes, ... This email has been scanned by the MessageLabs Email Security System. ...
      (Pen-Test)