full-disclosure - elevating privileges from Admin to SYSTEM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <797217123.20060308000956@Zoller.lu>
Date: Tue Mar  7 23:10:10 2006
From: Thierry at Zoller.lu (Thierry Zoller)
Subject: elevating privileges from Admin to SYSTEM

Dear NULL,

>from Administrator to SYSTEM level

- Task sheduler
  at xx:xx cmd.exe
- CreateRemoteThread & LoadLibrary Thread injection (lsass etc.)
  http://www.codeproject.com/threads/winspy.asp
- The CreateRemoteThread & WriteProcessMemory Technique (lsass etc.)
  http://win32.mvps.org/processes/remthread.html
  http://www.codeproject.com/threads/winspy.asp
- CreateRemoteProcess() Process injection  (lsass etc.)
  http://www.anticracking.sk/EliCZ/export/CPRPICHA.zip
- Drivers/services creating windows (handles)....
- Drivers/services opening a "Can't find help file" when sending F1 keypress to
  the windows it's supposed not to create, then browing to cmd.exe and
  right clicking open..
- Driver/services calling c:\program files\whatever.exe without quotes
  *wink wink* had to put that one here.
....
..

  

-- 
http://secdev.zoller.lu
Thierry Zoller
Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7