full-disclosure - Re: [Windows XP] possible privilege escalation (Cosmin Stejerean)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <EE035D329C16C942AE4A6F513F330E07AA1FC1@haydn.cti.depaul.edu>
Date: Tue May 31 18:54:57 2005
From: cstejere at cs.depaul.edu (Stejerean, Cosmin)
Subject: Re: [Windows XP] possible privilege escalation
	(Cosmin Stejerean)


> Message: 5
> Date: Mon, 30 May 2005 23:00:31 +0200
> From: "Pif Gadget" <pif.gadget@...mail.fr>
> Subject: [Full-disclosure] [Windows XP] possible privilege escalation
> To: full-disclosure@...ts.grok.org.uk
> Message-ID: <BAY15-F3220DF3378A390192D4C02FF030@....gbl>
> Content-Type: text/plain; charset=iso-8859-1; format=flowed

> Hello,

> I've encountered twice a strange problem on my Windows XP SP2 (fully
> patched) box.

[...]

> Today, being logged in the simple user account and having Windows
> Media Player launched, I executed an installation executable file
> (from Microsoft) as Administrator using "Execute as..." entry in the
> contextual menu. The application was successfuly installed. Later, I
> tried to close Windows Media Player, the window was closed but the
> music was still playing. I looked in the Task Manager in order to
> force quit WMP, but to my surprise the task (wmplayer.exe) did not
> belong to me ("simple user"), but to Administrator (It's worth
> mentioning that the Administrator account was not open at that moment
> - as it is possible with User Fast Switching, so no other instance of
> WMP was running.)

What is even more strange is that you quit wmplayer.exe yet it was still
running in the background with higher privileges. I tried to reproduce this
but have failed. Can you provide more information such as which software
from MS you tried to install and which version of Windows Media player you
have installed.

Cosmin Stejerean


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3726 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050531/a41482ce/smime.bin