BugTraq
Windows XP Task Scheduler Local Privilege Escalation (Advisory) Jun 12 2006 12:53AM
zipk0der (zipk0der pandora-security com) (1 replies)
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=
= Advisory: Windows XP Task Scheduler Local Privilege Escalation
=
= Author: Daniel Hückmann (zipk0der) zipk0der (at) pandora-security (dot) com [email concealed]
=
= Released at: http://www.pandora-security.com
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=

1. Overview.

In Windows XP, the task scheduler service runs as "SYSTEM" (local service);
this is akin to running cron as root. Any processes spawned by the
task scheduler
inherit "SYSTEM" permissions. Using command line tools, we can kill the Windows
desktop (explorer.exe) and restart it running under "SYSTEM". Once running under
"SYSTEM" we have full control of the machine, and can do things even
Administrators
can't. Also included is a recommended fix. Read the full paper at the
link below.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=

Direct link to the original paper discussing this issue in detail...

http://www.pandora-security.com/forum/viewtopic.php?t=2093

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=

Sincerely,

Daniel Hückmann - R&D Director, Pandora Security

[ reply ]
Re: Windows XP Task Scheduler Local Privilege Escalation (Advisory) Jun 12 2006 08:37PM
Eliah Kagan (degeneracypressure gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus