Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting

From: kz20fl@xxxxxxxxxxxxxx
Date: Sun, 25 Sep 2011 18:57:28 +0000

To replace a service executable you usually need administrator access anyway.

------Original Message------
From: Madhur Ahuja
Sender: full-disclosure-bounces@xxxxxxxxxxxxxxxxx
To: security-basics@xxxxxxxxxxxxxxxxx
To: full-disclosure@xxxxxxxxxxxxxxxxx
Subject: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
Sent: 25 Sep 2011 19:31

Imagine a situation where I have a Windows system with the restricted
user access and want to get the Administrator access.

There are many services in Windows which run with SYSTEM account.

If there exists even one such service whose executable is not
protected by Windows File Protection, isn't it possible to execute
malicious code (such as gaining Administrator access) simply by
replacing the service executable with malicious one and then
restarting the service.

As a restricted user, what's stopping me to do this ?

Is there any integrity check performed by services.msc or service
itself before executing with SYSTEM account ?

Madhur

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Sent from my POS BlackBerry wireless device, which may wipe itself at any moment

Prev by Date: Re: Protecting against the SpyPhone threat
Next by Date: CEH program and Sybex Study Guide
Previous by thread: [Full-disclosure] Privilege escalation on Windows using Binary Planting
Next by thread: CEH program and Sybex Study Guide
Index(es):
- Date
- Thread

Relevant Pages

Re: [Full-disclosure] Privilege escalation on Windows using Binary Planting
... The restricted user can replace GoogleUpdate.exe to execute malicious code. ... windows exchanges smb shares for one thing, you guys dont seem to know CRAP ... [Full-disclosure] Privilege escalation on Windows using ...
(Full-Disclosure)
Re: [Full-disclosure] Screen_unlock - Windows logon screen unlocker
... [Full-disclosure] Screen_unlock - Windows logon screen unlocker ... When you have "suspended or hibernated Windows box" and you want to resume it without user's password, you may be able to accomplish this by the Winlockpwn in case the box has Firewire port. ... Overwrite it with screen_unlock.exe cluster-by-cluster using dd. ... execute utilman by pressing Windows_Key + U. ...
(Full-Disclosure)
Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
... there's a lot of 3rd party software that installs itself as windows services. ... Maybe he can trick the user into installing on a FAT32 partition first, and THEN get the to execute from a remote share! ... To replace a service executable you usually need administrator access anyway. ... [Full-disclosure] Privilege escalation on Windows using BinaryPlanting ...
(Full-Disclosure)
Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting
... windows exchanges smb shares for one thing, you guys dont seem to know CRAP ... and THEN get the to execute from a remote share! ... [Full-disclosure] Privilege escalation on Windows using ... Charter: ...
(Full-Disclosure)
[Full-disclosure] Privilege escalation on Windows using Binary Planting
... user access and want to get the Administrator access. ... There are many services in Windows which run with SYSTEM account. ... isn't it possible to execute ...
(Security-Basics)