Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Pen-Test
[Top] [All Lists]

Re: RE: Microsoft RDP Priv. Escalation

Subject: Re: RE: Microsoft RDP Priv. Escalation
Date: 9 Apr 2008 03:04:13 -0000
Thor - Did you consider trying this out or did you merely read? Uploading .RDP 
files for direct access via the web is obviously wrong, but that's beyond the 
point of this entire insecurity, and you my friend are not comprehending it. 
The information about the insecurity isn't illegal as I did not use valid 
information from any .RDP connection file. The cmd.exe thing is simply an 
example. Other applications that wouldn't normally execute can be executed with 
this as well. The escalation is the ability to run applications you shouldn't 
be able to with such an account. It's under the privileges of the user, but the 
idea is, those privileges don't allow you to execute certain programs. Through 
that, you can.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

<Prev in Thread] Current Thread [Next in Thread>