Vulnerability Development mailing list archives

Re: ImpersonateNamedPipeClient -- "How Named Pipe Security Works"


From: Matt Conover <shok () CAMEL ETHEREAL NET>
Date: Thu, 3 Aug 2000 08:12:10 -0700

I have a follow up message that I'm still waiting to go through, but
yes.  I verified with some people here that you can only impersonate a
client with an account on the machine (these can be through the
domain--i.e., if you look at your user manager and you're in the domain,
you'll see things like DOMAINNAME\username.  If they aren't in the list of
users, you can't impersonate them--there are *no* exceptions to this.

Matt


Current thread: