bugtraq - Re: Symantec LiveState Agent for Windows vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <C19B145C.86E6%thor@hammerofgod.com>
Date: Tue, 05 Dec 2006 12:19:40 -0800
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: Bugtraq <bugtraq@...urityfocus.com>
Subject: Re: Symantec LiveState Agent for Windows vulnerability - Local
 Privilege Escalation

On 12/5/06 11:16 AM, "eugeny gladkih" <john@...eb.com> spoketh to all:

>>>>>> "MS" == Michael Scheidell <scheidell@...nap.net> writes:
> 
>>> we've found local privilege escalation in Symantec LiveState agent.
>>> 
>>> PoC:
>>> 
>>> 1. kill shstart.exe process
> 
>  MS> Wouldn't you have to be administrator to kill shstart.exe?
> 
> LocalSystem account has more privilegies then administrator's one.

The local administrator can do whatever he wants, including just setting the
startup context of a service to run as LocalSystem.  Any "privileged
escalation" that requires you to already be an administrator is not an issue
at all, period. For the one-millionth-and-second time, any "issue" that
begins with "if you are a local administrator, then you can..."  is a
non-issue and a waste of everyone's time.

That is the skinny on that.

t