Learn, hack!

URL

https://media.blackhat.com/bh-us-10/presentations/Cerrudo/BlackHat-USA-2010-Cerrudo-Toke-Kidnapping%27s-Revenge-slides.pdf

File name

BlackHat-USA-2010-Cerrudo-Toke-Kidnapping%27s-Revenge-slides.pdf

File size

208.7 KB

MD5

a177658ef6dd49b8a53ab558d9004b6f

SHA1

930303496598d4994249fc2b69608633618e3432

On April 14, 2009 Microsoft released a patch (documented here) to fix the issues detailed in my previous Token Kidnapping presentation (download PDF). The patch properly fixed the issues but... This new presentation will detail new design mistakes and security issues that can be exploited to elevate privileges on all Windows versions including the brand new Windows 2008 R2 and Windows 7. These new attacks allow to bypass new Windows services protections such as Per service SID, Write restricted token, etc. It will be demonstrated that almost any process with impersonation rights can elevate privileges to Local System account and completely compromise Windows OSs. While the issues are not critical in nature since impersonation rights are required, they allow to exploit services such as IIS 6, IIS 7, SQL Server, etc. in some specific scenarios. Exploits code for those services will be released. The presentation will be given in a very practical way showing how the new issues were found, with what tools, techniques, etc. allowing the participants to learn how to easily find these kind security issues in Windows operating systems.