Re: Question for the Windows pros

[Yvan Boily <yboily () gmail com>]

> The explanations on MS's site are vague enough that they're meaningless.
> What services running on Windows allow clients to access them?  And if they
> do, do they restrict access to the Local Machine?  Or do they allow Remote
> Access?  (For example, RPC is clearly remote.  Is the Windows Time service?)

Actually, the explanations are not vague or meaningless.  It just
helps to have an understanding of what this privilege governs.  Lets
start with the fact that in essence it only applies to Server
operating systems, and only to Windows 2000 SP4, or Windows 2003.

http://msdn.microsoft.com/library/default.asp?url=/library/en-
us/secauthz/security/authorization_constants.asp

Mike Howard also demonstrates the technique here:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncode/html/secure03132003.asp

RPC is not clearly remote.  It is merely a mechanism which is capable
of delivering remote calls.

According to MSDN this is a list of API that require SeImpersonatePrivelege:

RpcImpersonateClient
ImpersonateAnonymousToken
ImpersonateClient
ImpersonateLoggedOnUser
ImpersonateSecurityContext
RpcGetAuthorizationContextForClient

Reading the API, and the MSDN Documentation on IMpersonation and
Delegation should illuminate this issue.

The short story is though, that any case where any process or thread
will execute, either locally or remotely, under another users security
context, impersonation is required.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/