Re: priviledge escalation techniques

miguel.dilaj_at_pharma.novartis.com
Date: 01/17/05

  • Next message: Jerry Shenk: "RE: DoS/DDoS Attack" 
    To: pen-test@securityfocus.com
Date: Mon, 17 Jan 2005 22:09:41 +0000

    Hi again jnf!

    I'll provide you 2 answers, then you can investigate yourself.

    a) It's perfectly possible for a process to run with high privileges, and
    drop the privileges when in the need to do something else. In fact is not
    only possible, it's common practice, both in the *nix and Windows world.
    I blame the fact that WHEN NO ONE IS LOGGED IN, the system is still
    monitoring the 5 SHIFT sequence, and runs sethc.exe as SYSTEM in that case
    (you can even launch explorer.exe and have the whole enchilada as SYSTEM).
    I'm not saying that I'm surprised, considering that the guys at M$ have
    thrown everything but the kitchen sink into system space...

    b) It's perfectly possible to monitor keystrokes even without
    administrative privileges, thanks to the way Windows is built. Feel free
    to try the keylogging functionality of the spanish tool VeoVeo
    (www.hackindex.org) as a normal user. If you don't understand spanish,
    don't panic, I made a translation to english, available at
    http://usuarios.lycos.es/n3kr0m4nc3r/tools/
    I know VeoVeo it's not perfect, but it shows the idea, and the source is
    available if you are not happy with it.

    I hope you don't think that the above are also silly statements...
    Cheers,

    Miguel Dilaj (Nekromancer, the humorous one)
    Vice-President of IT Security Research, OISSG (the funny organization)
    We need YOU at www.oissg.org!

    jnf <lists@innocence-lost.net>
    17/01/2005 19:45

     
            To: Miguel Dilaj/PH/Novartis@PH
            cc: pen-test@securityfocus.com
            Subject: Re: priviledge escalation techniques

    > and the guys at Micro$oft comit the cardinal mistake of not
    > making IT check if SHIFT was pressed 5 times, but to include that in
    some
    > other part of the OS (kernel? ;-)

    And while I sit here eating lunch it occured to me how silly of a
    statement that was- consider which is more of an acceptible risk-

    scenario 1) sethc.exe is run as a normal user, or rather as the user
    logged in- it does not run with any special capabilities, the keyboard
    driver or whatever intercepts and detects shift pressed 5 times, or held
    for X seconds- however
    IF someone managed to override your DAC's/file permissions then they can
    overwrite the program, however if this occurs- the game is already up
    because you had a more critical flaw some place else, and that is really
    the way that you lost control.

    scenario 2) sethc.exe is always running and monitoring keystrokes looking
    for any sequence of keystrokes that it recognizes, in order to do this
    either any user has to be able to 'sniff keystrokes', OR, it has to run
    with special access allowing the window for abuse to grow bigger- in
    addition to this the kernel has to take extra steps in order to pass every
    keystroke to userspace, which is going to degrade performance. So here,
    the simple program is now running with elevated status and becomes a huge
    potential for abuse.

    From a perspective of security, which is a better design? scenario 2 is
    basically what you are suggesting. I love IT Security as well, but its not
    nearly as humorous as It Security 'Professionals'

    cheers,
    jnf

  • Next message: Jerry Shenk: "RE: DoS/DDoS Attack"

    Relevant Pages

    • RE: priviledge escalation techniques
      ... self a command prompt with 'SYSTEM' privileges (well with win2k, ... scenario 1) sethc.exe is run as a normal user, or rather as the user logged ... scenario 2) sethc.exe is always running and monitoring keystrokes looking ... From a perspective of security, ...
      (Pen-Test)
    • Re: APACHE$PRIVILEDGED
      ... The primary security on OpenVMS and on most other multi-processing operating systems is implemented via the memory management system and via what VAX calls the change-mode routines, via the Alpha SRM PALcode change-mode equivalent, or via what the IA-32 and IA-32e architectures refer to as the call gate. ... With OpenVMS constructs including device drivers )and user-written system services (UWSS; also known as privileged shareable images), these constructs operate in inner processor modes. ... One of the more hazardous situations for system security is a mixed environment; where there are resources shared between trusted and untrusted environments. ... Not only will the operation that requires privileges now be permitted, but other and potentially unintended operations can also be permitted. ...
      (comp.os.vms)
    • [UNIX] Bugzilla Multiple Vulnerabilities (SQL Injections, Privileges Escalation, Information Leak)
      ... Get your security news from a reliable source. ... user may retain privileges that should have been removed, ... Reference: ... secure bug, you can access the summary of that bug even if you do not have ...
      (Securiteam)
    • Re: Happy 10 years of continuous virus free computing on OpenVMS alpha 7.1
      ... OpenVMS provides an inherent security advantage over all the other ... advantage of OpenVMS brings it much closer to such a goal than any OS ... attaining higher mode privileges or services for which a process was ... currently used University-level texts on OS Design. ...
      (comp.os.vms)
    • Re: Microsoft finally acknowledges the security drumbeats
      ... not part of the operating system. ... If the security problems go ... > IIS full administrator privileges. ... If processes like IIS running with admin priveleges is the ...
      (comp.security.misc)