Full Disclosure mailing list archives
Re: [Windows XP] possible privilege escalation (Cosmin Stejerean)
From: "Stejerean, Cosmin" <cstejere () cs depaul edu>
Date: Tue, 31 May 2005 11:23:20 -0500
Message: 5 Date: Mon, 30 May 2005 23:00:31 +0200 From: "Pif Gadget" <pif.gadget () hotmail fr> Subject: [Full-disclosure] [Windows XP] possible privilege escalation To: full-disclosure () lists grok org uk Message-ID: <BAY15-F3220DF3378A390192D4C02FF030 () phx gbl> Content-Type: text/plain; charset=iso-8859-1; format=flowed
Hello,
I've encountered twice a strange problem on my Windows XP SP2 (fully patched) box.
[...]
Today, being logged in the simple user account and having Windows Media Player launched, I executed an installation executable file (from Microsoft) as Administrator using "Execute as..." entry in the contextual menu. The application was successfuly installed. Later, I tried to close Windows Media Player, the window was closed but the music was still playing. I looked in the Task Manager in order to force quit WMP, but to my surprise the task (wmplayer.exe) did not belong to me ("simple user"), but to Administrator (It's worth mentioning that the Administrator account was not open at that moment - as it is possible with User Fast Switching, so no other instance of WMP was running.)
What is even more strange is that you quit wmplayer.exe yet it was still running in the background with higher privileges. I tried to reproduce this but have failed. Can you provide more information such as which software from MS you tried to install and which version of Windows Media player you have installed. Cosmin Stejerean
Attachment:
smime.p7s
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: [Windows XP] possible privilege escalation (Cosmin Stejerean) Stejerean, Cosmin (May 31)