full-disclosure - Question for the Windows pros

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu Jan 19 09:32:48 2006
From: nicolas.ruff at gmail.com (Nicolas RUFF)
Subject: Question for the Windows pros

	Hello,

The ImpersonateNamedPipeClient() risks have been fully documented by
Blake Watts back in 2002.
http://www.blakewatts.com/namedpipepaper.html

The problem is basically that OpenFile() will accept either :
- A file path ("C:\toto.txt")
- A share path ("\\hacker\toto")
- A named pipe path ("\\hacker\pipe\toto")

(Did you ever notice that you cannot create a share named "pipe" on a
Windows system ? ;)

So if you can open a file with a privileged application (such as a
SYSTEM service), you can gain the privileges of the application.

Real life example: take your antivirus, change the log file name from
"C:\Program Files\Antivirus\log.txt" to "\\mycomputer\pipe\toto" while
running a listener on the "toto" pipe. When the antivirus opens the log
file, you become SYSTEM.

Regards,
- Nicolas RUFF
Security Researcher @ EADS-CRC