|
|
BugTraq
Microsoft Window Utility Manager Local Elevation of Privileges Jul 13 2004 08:00PM Vivek Rathod (Application Security, Inc.) (vrathod appsecinc com) (1 replies) Re: Microsoft Window Utility Manager Local Elevation of Privileges Jul 14 2004 11:58AM Chris Paget (ivegotta tombom co uk) (2 replies) Re: Microsoft Window Utility Manager Local Elevation of Privileges Jul 14 2004 06:24PM KF (lists) (kf_lists secnetops com) |
|
Privacy Statement |
Cesar.
--- Chris Paget <ivegotta (at) tombom.co (dot) uk [email concealed]> wrote:
> On Tue, 13 Jul 2004 16:00:33 -0400, you wrote:
> ...
>
> This isn't quite right - on my system at least,
> browsing for cmd.exe
> in this way generates an error:
> "The C:\WINNT\system32\cmd.exe file is not a Windows
> Help file, or the
> file is corrupted."
>
> That said, the file dialog can be made to display a
> ListView control
> (display details rather than a list). This ListView
> control will
> accept both WM_SETTEXT (to inject shellcode into the
> caption of the
> window) followed by LVM_SORTITEMS (which specifies
> the address for a
> sort function) to execute said code. It is a valid
> method for
> arbitrary code execution as LocalSystem, but not
> quite as simply as
> Vivek makes out.
>
> Chris
>
> --
> Chris Paget
> ivegotta (at) tombom.co (dot) uk [email concealed]
__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - Send 10MB messages!
http://promotions.yahoo.com/new_mail
[ reply ]