Full Disclosure mailing list archives
Re: [Windows XP] possible privilege escalation
From: "KF (lists)" <kf_lists () digitalmunition com>
Date: Wed, 08 Jun 2005 04:00:54 -0400
Would this possibly have anything to do with MSIEXEC.exe (that is off the top of my head) running as system? I have occasionally seen this process chilling out running as SYSTEM.
-KF NSC wrote:
Pif Gadget a écrit :Hello, I've encountered twice a strange problem on my Windows XP SP2 (fully patched) box. I have 2 separate accounts on my personal system : Administrator (for administrative tasks only) and simple user (for common everyday tasks), for security and system integrity reasons. Today, being logged in the simple user account and having Windows Media Player launched, I executed an installation executable file (from Microsoft) as Administrator using "Execute as..." entry in the contextual menu. The application was successfuly installed. Later, I tried to close Windows Media Player, the window was closed but the music was still playing. I looked in the Task Manager in order to force quit WMP, but to my surprise the task (wmplayer.exe) did not belong to me ("simple user"), but to Administrator (It's worth mentioning that the Administrator account was not open at that moment - as it is possible with User Fast Switching, so no other instance of WMP was running.) This happened to me once before, with the same conditions (including running an installation app using "Execute as..."), but I couldn't reproduce the issue "manually". Best regards, -- Pif _________________________________________________________________ Ne cherchez plus, trouvez ! Avec le nouveau MSN Search. http://search.msn.fr/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/Hello, are you sure you didn't launch wmplayer form the setup process (something like: start wmplayer when setup is complete). In this case it, wmplayer starts with the rights from setup.exe, which in your case is the admin account. Have anice day. Spencer _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: [Windows XP] possible privilege escalation KF (lists) (Jun 07)