Penetration Testing: RE: RE: Microsoft RDP Priv. Escalation

["Thor (Hammer of God)" <thor () hammerofgod com>]

"Alternate Shell" simply launches a program on connect within the
context of the logged on user.  It's the exact same thing as going to
the "Programs" tab of mstsc and checking "Start the following program on
connection."  There is no privileged escalation - the app runs in the
context of the user specified.  It's a simple as that.

This doesn't "get around" any permissions.  You can't "execute programs
you normally couldn't execute."  If you are executing programs, then you
have the permission to do so.

t

> -----Original Message-----
> From: listbounce () securityfocus com
> [mailto:listbounce () securityfocus com] On Behalf Of Yousif () Vapt-Sec com
> Sent: Tuesday, April 08, 2008 8:04 PM
> To: pen-test () securityfocus com
> Subject: Re: RE: Microsoft RDP Priv. Escalation
>
> Thor - Did you consider trying this out or did you merely read?
> Uploading .RDP files for direct access via the web is obviously wrong,
> but that's beyond the point of this entire insecurity, and you my
> friend are not comprehending it. The information about the insecurity
> isn't illegal as I did not use valid information from any .RDP
> connection file. The cmd.exe thing is simply an example. Other
> applications that wouldn't normally execute can be executed with this
> as well. The escalation is the ability to run applications you
> shouldn't be able to with such an account. It's under the privileges
of
> the user, but the idea is, those privileges don't allow you to execute
> certain programs. Through that, you can.
-----------------------------------------------------------------------
> -
> This list is sponsored by: Cenzic
>
> Need to secure your web apps NOW?
> Cenzic finds more, "real" vulnerabilities fast.
> Click to try it, buy it or download a solution FREE today!
>
> http://www.cenzic.com/downloads
-----------------------------------------------------------------------
> -

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------