RE: RunAs weirdness...

[Ed Moyle <emoyle () scsnet csc com>]

> If I remember correctly the .ida and .idq overflows on IIS  left a similar
> address on the stack with nulls in it like 0x00410041
> and the fellas at eEye busted out some ninja technique to exploit it
> anyway.

KF mentioned it might be useful to share this with the list.  It seems to me to be likely that the nulls in this string 
are from a unicode/widechar conversion of the input arguments.  I checked the runas.exe import table, and it looks to 
be bringing in lstrcpy and wsprintf (wide char versions of the more traditional strcpy and sprintf).  

The thing also brings in CommandLineToArgvW, which makes me think somebody is doing something like (don't criticize the 
code...  this is just off the top of my head):

WCHAR buf[OVERFLOW_ME_SIZE];
LPTSTR lpCommandLine = GetCommandLine();
int argc = 0;
LPWSTR wargv = CommandLineToArgvW(lpCommandLine, &argc);
//don't know exactly what they are doing, but it could be something like:
lstrcpy(buf, wargv[1]);

Good find to whoever started this thread, by the way.
-E