Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]

Re: [Full-disclosure] [Windows XP] possible privilege escalation

Subject: Re: [Full-disclosure] [Windows XP] possible privilege escalation
Date: Mon, 30 May 2005 23:31:18 +0200
Pif Gadget a écrit :

Hello,

I've encountered twice a strange problem on my Windows XP SP2 (fully
patched) box.

I have 2 separate accounts on my personal system : Administrator (for
administrative tasks only) and simple user (for common everyday
tasks), for security and system integrity reasons.

Today, being logged in the simple user account and having Windows
Media Player launched, I executed an installation executable file
(from Microsoft) as Administrator using "Execute as..." entry in the
contextual menu. The application was successfuly installed. Later, I
tried to close Windows Media Player, the window was closed but the
music was still playing. I looked in the Task Manager in order to
force quit WMP, but to my surprise the task (wmplayer.exe) did not
belong to me ("simple user"), but to Administrator (It's worth
mentioning that the Administrator account was not open at that moment
- as it is possible with User Fast Switching, so no other instance of
WMP was running.)

This happened to me once before, with the same conditions (including
running an installation app using "Execute as..."), but I couldn't
reproduce the issue "manually".


Best regards,


-- 
Pif

_________________________________________________________________
Ne cherchez plus, trouvez ! Avec le nouveau MSN Search.
http://search.msn.fr/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Hello,

are you sure you didn't launch wmplayer form the setup process (something
like: start wmplayer when setup is complete).

In this case it, wmplayer starts with the rights from setup.exe, which
in your case is the
admin account.

Have anice day.

Spencer



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

<Prev in Thread] Current Thread [Next in Thread>