full-disclosure - Re: Privilege escalation on Windows using BinaryPlanting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 26 Sep 2011 11:15:00 +1000
From: GloW - XD <doomxd@...il.com>
To: "Thor (Hammer of God)" <thor@...merofgod.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Privilege escalation on Windows using
	BinaryPlanting

Haha , too good and too true thor !

Maybe he can trick the user into installing on a FAT32 partition first, and
THEN get the to execute from a remote share!

Rofl x10.

Agreed , this kind of attack, is NOT deasible in 2011, try maybe, 2006.

Anyhow it has been a pleasure, ending this BS i think once and for all,
lookup how winlogon works for one thing, then look at how windows creates
and maintains a service_table, and then at the dlls, wich are protected ofc,
you cannot touch msgina.dll,without ALOT of help from a rootkit or something
similar, in wich case, why would you need to ?
You could add an admin, hidden, and in simple batfile script (yes i do have
my own code but no it is not for kids..), this is 10seconds and hidden, so
when you have gotten that far, why would you bother to hijack a dll ?

You CANNOT do crap,without complete ADMIN not SYSTEm, ADMIN$ share, and
total axcs to all sockets, meaning, all pipe control and thats where half of
windows exchanges smb shares for one thing, you guys dont seem to know CRAP
about windows to start with, then have the gall to raise such a frigging
ridiculous topic about a non happening, YOUTUBE ONE 'real' event, of this
being useful, or, even just working, and i would look but, you wont, cannot,
and will never be able to, especially on newer systems of windows7-8.
As i said earlier, enjoy your bs DFLL hijacking, but ms, dont care for it,
and whatever patches they instilled, dont touch even service_table.. so,
they have not given it a high prio,and why shuld they.

This is simply a case of a secteam gaining notoriety, to try and make this a
'big bug!!' , to try and gain brownie points from MS. Even tho, i dont
believe in many things MS, I know windows system, and how to break it,
better than many people, and i can tell you now, this whole DLL hijack, is a
complete and utter waste of your times.
But... keep on going, maybe MS will send you another 'thankyou' email ;)
xd / crazycoders.com / #haxnet@Ef




On 26 September 2011 10:52, Thor (Hammer of God) <thor@...merofgod.com>wrote:

>  Maybe he can trick the user into installing on a FAT32 partition first,
> and THEN get the to execute from a remote share!
>
> On Sep 25, 2011, at 5:30 PM, "Travis Biehn" <tbiehn@...il.com> wrote:
>
>   It might be a fun experiment to see what DLLs they're looking for :.)
>
>
> -Travis
>
> On Sun, Sep 25, 2011 at 2:57 PM, < <kz20fl@...glemail.com>
> kz20fl@...glemail.com> wrote:
>
>> To replace a service executable you usually need administrator access
>> anyway.
>>
>>
>> ------Original Message------
>> From: Madhur Ahuja
>> Sender: <full-disclosure-bounces@...ts.grok.org.uk>
>> full-disclosure-bounces@...ts.grok.org.uk
>> To: <security-basics@...urityfocus.com>security-basics@...urityfocus.com
>> To: <full-disclosure@...ts.grok.org.uk>full-disclosure@...ts.grok.org.uk
>> Subject: [Full-disclosure] Privilege escalation on Windows using
>> BinaryPlanting
>> Sent: 25 Sep 2011 19:31
>>
>> Imagine a situation where I have a Windows system with the restricted
>> user access and want to get the Administrator access.
>>
>> There are many services in Windows which run with SYSTEM account.
>>
>> If there exists even one such service whose executable is not
>> protected by Windows File Protection, isn't it possible to execute
>> malicious code (such as gaining Administrator access) simply by
>> replacing the service executable with malicious one and then
>> restarting the service.
>>
>> As a restricted user, what's stopping me to do this ?
>>
>> Is there any integrity check performed by services.msc or service
>> itself before executing with SYSTEM account ?
>>
>> Madhur
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter:  <http://lists.grok.org.uk/full-disclosure-charter.html>
>> http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - <http://secunia.com/>
>> http://secunia.com/
>>
>>  Sent from my POS BlackBerry  wireless device, which may wipe itself at
>> any moment
>>  _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter:  <http://lists.grok.org.uk/full-disclosure-charter.html>
>> http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - <http://secunia.com/>
>> http://secunia.com/
>>
>
>
>
>  --
> Twitter <https://twitter.com/tbiehn> | LinkedIn<http://www.linkedin.com/in/travisbiehn>|
> GitHub <http://github.com/tbiehn> |  <http://www.travisbiehn.com>
> TravisBiehn.com
>
>    _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: <http://lists.grok.org.uk/full-disclosure-charter.html>
> http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - <http://secunia.com/>http://secunia.com/
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/