RE: RE: [Full-disclosure] Windows Vista/7 lpksetup dll hijack

["Thor (Hammer of God)" <thor () hammerofgod com>]

I've tested loading a library from an application that requires admin privileges from a normal user and it will prompt 
for UAC if needed or fail.  I understand where the jacking takes place, but you are making it seem like you can bypass 
user permissions when you can't.  At least that's what I got from your OP.  IOW, even if the original app you run 
doesn't require UAC, if the jacked .dll requires escalated permissions, which would be just about anything interesting 
you could do, then it will fail (or prompt depending on how you write it).  

The main point is that you've got to get people to not only connect up to your remote share, but you've got to get them 
to execute the file, etc.  So I'm just wondering what makes this anything more than any other "put a malicious link 
here to make the user execute it" or email attachment business, particularly when you say "Remote Code Execution."

t

> Have you tested out the actual exploit method in a lab environment yet to see just what can be done as I have?
>
> On Oct 25, 2010 5:34pm, "Thor (Hammer of God)" <thor () hammerofgod com> wrote:
> > If you are considering this "Remote Code Execution" then why not just have the victim run an .exe from the "complete 
> > anonymous share" you've managed to get
> > people connected to and save all the trouble?   This would still run as the user context, and if the hijacked DLL 
> > tried to do something a normal user couldn't do then it too would be blocked or fail anyway.