mailing list archives
Re: Question for the Windows pros
From: Nicolas RUFF <nicolas.ruff () gmail com>
Date: Thu, 19 Jan 2006 10:32:44 +0100
The ImpersonateNamedPipeClient() risks have been fully documented by
Blake Watts back in 2002.
The problem is basically that OpenFile() will accept either :
- A file path ("C:\toto.txt")
- A share path ("\\hacker\toto")
- A named pipe path ("\\hacker\pipe\toto")
(Did you ever notice that you cannot create a share named "pipe" on a
Windows system ? ;)
So if you can open a file with a privileged application (such as a
SYSTEM service), you can gain the privileges of the application.
Real life example: take your antivirus, change the log file name from
"C:\Program Files\Antivirus\log.txt" to "\\mycomputer\pipe\toto" while
running a listener on the "toto" pipe. When the antivirus opens the log
file, you become SYSTEM.
- Nicolas RUFF
Security Researcher @ EADS-CRC
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
Re: Question for the Windows pros Nicolas RUFF (Jan 19)