full-disclosure - Re: Local persistent DoS in Windows XP SP2 Taskmanager

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <759230648.20080315192227@SECURITY.NNOV.RU>
Date: Sat, 15 Mar 2008 19:22:27 +0300
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: SkyOut <skyout@....net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Local persistent DoS in Windows XP SP2
	Taskmanager

Dear SkyOut,

I see no security impact here.

RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting", 0, KEY_SET_VALUE, &hKey);

requires  administrative  privileges.  If user has ones, you can achieve
better results by deleting task manager of trojaning it.

You can also use

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows    NT\CurrentVersion\Image
File Execution Options\taskmgr.exe\Debug

key to launch notepad.exe instead of taskmgr.exe.

--Friday, March 14, 2008, 10:49:31 PM, you wrote to full-disclosure@...ts.grok.org.uk:

S> Dear list,

S> after weeks of total ignorance by Microsoft I decided to finally  
S> release all information
S> related to a bug, that has to do with the Windows XP SP2 Taskmanager.
S> Manipulating
S> a Registry key makes it possible to disable the Taskmgr. On the next
S> startup it will crash with
S> an error message. It is possible to backup the key and repair the  
S> Registry doing so, but
S> the attack scenario is clear: A virus uses this code, the user can't
S> open the Taskmgr anymore
S> and your process is somehow "hidden".

S> The full information about this bug, can be found here:
S> http://core-security.net/archive/2008/march/index.php#14032008

S> And the exploit is available here:
S> http://core-security.net/releases/exploits/taskmgr_dos.c.txt

S> Greets,
S> SkyOut

S> ---
S> core-security.net
S> ---

-- 
~/ZARAZA http://securityvulns.com/
ЭНИАКам - по морде!  (Лем)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/