full-disclosure - Process Killing - Playing with PostThreadMessage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20031002103022.1526.qmail@localhost.localdomain>
From: guninski at guninski.com (Georgi Guninski)
Subject: Process Killing - Playing with
 PostThreadMessage

On Thu, 2 Oct 2003 17:28:14 +1200
"Brett Moore" <brett.moore@...urity-assessment.com> wrote:

> 
> It appears from our testing that any thread running under any security
> level will accept a WM_QUIT message, causing the process to terminate.
> 

...

> While this does not have the security implications of 'privilege escalation'
> attacks, it may cause some concerns under certain circumstances.
> 

In some circumstances this probably may be used for privilege escalation.
In windoze a process may escalate its privileges if a more privileged process writes to its named pipes. So if you manage to kill a process which holds important named pipe, then create the same named pipe and then someone writes to your named pipe you may elevate your privileges.
You may check http://www.guninski.com/dr07.html for an old demo.

georgi