Win32: From Guest to Local system in 5 steps

[Dogbert]

Read here: http://security.tombom.co.uk/shatter.html

[rubank]

And it works great too.

At my bank I just browsed through the assets, found a chunk of old low-yield bonds no one will miss, ordered sale and made it payable to my account.

[Gurm]

Dogbert,

Actually, while that article makes it look very simple, the hard step is the one he leaves out - paging through memory with a debugger, trying to find the signature of a program with system privileges... never an easy task, if it's possible at all on the system you want to hack.

- Gurm

[Dogbert]

Ususally it's used for hacking from within.
Meaning - using your private workstation to hack further into your workplace's network.

[Gurm]

Yes, but it's still hard to find a local_system process with a debugger. Trust me.

- Gurm

[Technoid]

I agree with Gurm....
He only makes it look easy...

[Gurm]

Sometimes you CAN'T even find it, if it's swapped out.

I mean, if that local_system process isn't getting CPU time, odds are it's in virtual memory and can't be gotten to at all with a debugger.

That article presumes a lot. Microsoft is pretty much in the right to declare this a non-issue. You have worse problems than this if someone has persistent physical access to your network (like that nifty Dreamcast disc that turns it into a network hijack box!).

- Gurm