0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Aloaha Credential Provider Monitor 5.0.226 Local Privilege Escalation Vulnerability
[Aloaha Credential Provider Monitor 5.0.226 Local Privilege Escalation Vulnerability
Vendor: Aloaha Software - Wrocklage Intermedia GmbH
Product web page: http://www.aloaha.com
Affected version: 5.0.226
Summary: Aloaha Credential Provider represents one of the most dramatic changes
in the Windows Vista / 7 logon screen, making it much easier to implement new user
authentication scenarios that are supported by the OS. To be able to logon via
Smartcard to a windows machine requires usually the machine being a member of a
domain. With the Aloaha Credential Provider that is not required, the logon screen
is the first thing users see when they turn on the computer.
Desc: The Aloaha Credential Provider Service is vulnerable to an elevation of
privileges vulnerability which can be used by a simple user that can change the
executable file with a binary of choice. The vulnerability exist due to the
improper permissions, with the 'F' flag (full) for the 'Everyone' group, for the
'AloahaCredentialProviderService.exe' binary file. The service was shipped with
Aloaha PDF Saver and possibly every SmartCard Software package from Aloaha. The
files are installed in the 'Wrocklage' directory which has the Everyone group
assigned to it with full permissions making every single file inside vulnerable
to change by any user on the affected machine. After you replace the binary with
your rootkit, on reboot you get SYSTEM privileges.
Tested on: Microsoft Windows 7 Ultimate SP1 (EN) 32bit/64bit
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2013-5124
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5124.php
19.01.2013
---------------------------------------------------------------------------------
C:\Program Files\Wrocklage>sc qc AloahaCPM
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: AloahaCPM
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : "C:\Program Files\Wrocklage\AloahaCredentialProviderService.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Aloaha Credential Provider Monitor
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\Program Files\Wrocklage>cacls AloahaCredentialProviderService.exe
C:\Program Files\Wrocklage\AloahaCredentialProviderService.exe NT AUTHORITY\SYSTEM:(ID)F
Everyone:(ID)F
BUILTIN\Administrators:(ID)F
BUILTIN\Users:(ID)R
C:\Program Files\Wrocklage>
---------------------------------------------------------------------------------
# 0day.today [2024-11-16] #