full-disclosure - [Windows XP] possible privilege escalation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon May 30 22:31:48 2005
From: news-letters at bluewin.ch (NSC)
Subject: [Windows XP] possible privilege escalation

Pif Gadget a ?crit :

> Hello,
>
> I've encountered twice a strange problem on my Windows XP SP2 (fully
> patched) box.
>
> I have 2 separate accounts on my personal system : Administrator (for
> administrative tasks only) and simple user (for common everyday
> tasks), for security and system integrity reasons.
>
> Today, being logged in the simple user account and having Windows
> Media Player launched, I executed an installation executable file
> (from Microsoft) as Administrator using "Execute as..." entry in the
> contextual menu. The application was successfuly installed. Later, I
> tried to close Windows Media Player, the window was closed but the
> music was still playing. I looked in the Task Manager in order to
> force quit WMP, but to my surprise the task (wmplayer.exe) did not
> belong to me ("simple user"), but to Administrator (It's worth
> mentioning that the Administrator account was not open at that moment
> - as it is possible with User Fast Switching, so no other instance of
> WMP was running.)
>
> This happened to me once before, with the same conditions (including
> running an installation app using "Execute as..."), but I couldn't
> reproduce the issue "manually".
>
>
> Best regards,
>
>
> -- 
> Pif
>
> _________________________________________________________________
> Ne cherchez plus, trouvez ! Avec le nouveau MSN Search.
> http://search.msn.fr/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Hello,

are you sure you didn't launch wmplayer form the setup process (something
like: start wmplayer when setup is complete).

In this case it, wmplayer starts with the rights from setup.exe, which
in your case is the
admin account.

Have anice day.

Spencer