full-disclosure - Re: Windows Vista/7 lpksetup dll hijack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <58DB1B68E62B9F448DF1A276B0886DF16EB39646@EX2010.hammerofgod.com>
Date: Tue, 26 Oct 2010 17:54:33 +0000
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: Jann Horn <jannhorn@...glemail.com>, "Thor (Hammer of God)"
	<thor@...merofgod.com>
Cc: Full-Disclosure mailing list <full-disclosure@...ts.grok.org.uk>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
	"TBorland1@...il.com" <TBorland1@...il.com>
Subject: Re: Windows Vista/7 lpksetup dll hijack

>Am Montag, den 25.10.2010, 22:56 +0000 schrieb Thor (Hammer of God):
>> The main point is that you've got to get people to not only connect up
>> to your remote share, but you've got to get them to execute the file,
>> etc.  So I'm just wondering what makes this anything more than any
>> other "put a malicious link here to make the user execute it" or email
>> attachment business, particularly when you say "Remote Code
>> Execution."
>
>Err... as far as I know, the interesting part is having the current path be set to
>something you can control (to make windows load evil dlls), and if you just link
>to the file, that's not the case.

But your *aren't* controlling it.  The loadlibrary seek priority is a set path.  The user must first connect to the share, and launch the file from the share.  THAT makes it part of the working directory.  These are not the droids you are looking for. 

This particular execution mechanism still makes lpksetup run and it still launches UAC.  Now what IS interesting is that, as I've previously stated, when one cancels UAC, the oci.dll is still executed - however it can only run code that the user can.

Thus, if you are going to get a user to connect to a share and launch a file from that share, why make it go through all that crap (and launch UAC) when you can just have them run an EXE that does whatever you want in user mode without worrying about UAC at all.  That's my main point.

t

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/