full-disclosure - PeanutHull Local Privilege Escalation Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed Jul 20 10:08:00 2005
From: smaillist at gmail.com (Sowhat .)
Subject: PeanutHull Local Privilege Escalation
	Vulnerability

PeanutHull Local Privilege Escalation Vulnerability

by Sowhat

EN: http://secway.org/advisory/AD20050720EN.txt
CN: http://secway.org/advisory/AD20050720CN.txt

Product Affected:

PeanutHull <= 3.0 Beta 5 

Overview:

Oray Inc. is the world's biggest DDNS (Dynamic Domain Name Service)
 Provider (According to their WEBSITE). PeanutHull is the DDNS client
For more information ,see http://www.oray.net 

Details:

The vulnerability is caused due to SYSTEM privileges are not 
dropped when accessing the PeanutHull from the System Tray icon.

A local non-privileged user can access the application via the 
system tray and can execute commands with Local System privileges.

Exploit:
1. Double click on the PeanutHull icon in the Taskbar to open 
   the PeanutHull window.
2. Click Help, click BBS
3. Type C:\ in the poped up IE Address BAR
4. Navagate to %WINDIR%\System32\
5. click CMD.exe 
6. A new command shell will open with SYSTEM privileges

Exploitng this vulnerability allows local non-privileged user
to obtain SYSTEM privilege.

Vendor Response:

2005.07.13 Vendor notified via email 
2005.07.14 Vendor responsed that this problem will be fixed 
           in the 3.0 Final Version.
2005.07.20 PeanutHull 3.0 Released
2005.07.20 So I released this advisory

Please update to PeanutHull 3.0
http://www.oray.net