Pages: 1/1 First page 1 Final page [ View by Articles | List ]
虽然是个前段时间的漏洞了,但是之前一直只关注漏洞的利用,而未关注具体的解决方案,今天无意中和用户聊天时提到的,用户让帮忙找个解决方案,网上搜索了下,在 刺 那里找的相关的说明,并在微软的找到了具体的解决办法。详细如下:

这个漏洞是由于在NetworkService 或者 LocalService 下运行的代码,可以访问同样是在 NetworkService 或者 LocalService 下运行的进程,某些进程允许提升权限为LocalSystem。

MS Windows 2003 Token Kidnapping Local Exploit PoC

  [阴 October 9, 2008 12:40 | by !4p47hy ]
It has been a long time since Token Kidnapping presentation (http://www.argeniss.com/research/TokenKidnapping.pdf)
was published so I decided to release a PoC exploit for Win2k3 that alows to execute code under SYSTEM account.

Basically if you can run code under any service in Win2k3 then you can own Windows, this is because Windows services accounts can impersonate.  Other process (not services) that can impersonate are IIS 6 worker processes so if you can run code from an ASP .NET or classic ASP web application then you can own Windows too. If you provide shared hosting services then I would recomend to not allow users to run this kind of code from ASP.
Pages: 1/1 First page 1 Final page [ View by Articles | List ]