Bugtraq: Inside GetAdmin

[mark () ntshop net (Mark Joseph Edwards)]

The nature of the getadmin bug is in the following API calls:
ChangeNtGlobalFlag(GetNtGlobalFlagPtr());


The above code creates the exploit. The GetNtGlobalFlagPtr() can be
replaced with a fix pointer, eliminating the need for READ access to the
ntoskrnl.exe, making it much tougher to defend against, while at the same
time, making it far less portable across NT systems.


Mark