RE: RE: [Full-disclosure] Windows Vista/7 lpksetup dll hijack

["Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>]

I've tested loading a library from an application that requires admin 
privileges from a normal user and it will prompt for UAC if needed or fail.  I 
understand where the jacking takes place, but you are making it seem like you 
can bypass user permissions when you can't.  At least that's what I got from 
your OP.  IOW, even if the original app you run doesn't require UAC, if the 
jacked .dll requires escalated permissions, which would be just about anything 
interesting you could do, then it will fail (or prompt depending on how you 
write it).  

The main point is that you've got to get people to not only connect up to your 
remote share, but you've got to get them to execute the file, etc.  So I'm just 
wondering what makes this anything more than any other "put a malicious link 
here to make the user execute it" or email attachment business, particularly 
when you say "Remote Code Execution."

t

>Have you tested out the actual exploit method in a lab environment yet to see 
>just what can be done as I have?
>
>On Oct 25, 2010 5:34pm, "Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx> wrote:
>>
>> 
>> If you are considering this "Remote Code Execution" then why not just have 
>> the victim run an .exe from the "complete anonymous share" you've managed to 
>> get
>> people connected to and save all the trouble?   This would still run as the 
>> user context, and if the hijacked DLL tried to do something a normal user 
>> couldn't do then it too would be blocked or fail anyway. 
>>