Hot Potato – Windows Privilege Escalation

http://foxglovesecurity.com/2016/01/16/hot-potato/

by mmastrac • 11 years ago

73 33 11 years ago

foxglovesecurity.com

jevinskie• 11 years ago

Running a server on port 80 (< 1024) doesn't require any elevated privileges on Windows?

akira2501• 11 years ago

Nope. Windows got sockets before it got a reasonable privilege model.

andrewchambers3• 11 years ago

stopping non root users from listening on low ports probably causes more security issues than it solves, it means crappy admins and developers just gift root access to exploits.

theandrewbailey• 11 years ago

Windows makes up it's own rules and it isn't Unix at all.

userbinator2• 11 years ago

This exploit doesn't depend on that; 80 might as well be 8000 or 8080(common proxy port) or anything else. Observe that the proxy port can be specified:

    return "PROXY 127.0.0.1:80";}

CyberShadow• 11 years ago

Don't you still need to run the WPAD "server" on port 80?

useerup4• 11 years ago

It does. The built-in firewall will by default block any program from listening on any port, unless authorized by a rule.

The article did not touch on this subject, but I believe that for this to work, the admin will have to either switch off the firewall or create a rule authorizing the program to use the port (or the port to be used by any program)

breen-machine2• 11 years ago

If you watch the video for Windows 7 you see Windows Firewall tries to block it. It is blocking Potato from listening on *:80. There are no such restrictions for localhost:80.

No modifications were made from default config.

antmldr• 11 years ago

My jaw kind of hit the floor after reading Google Security Research's issue 222; very glad someone has built a simplified PoC. With any luck this will get some kind of response out of MS.

userbinator2• 11 years ago

Is the summary basically "turn off WPAD and this won't work?" Because that's not hard to do:

http://stackoverflow.com/questions/15029615/how-to-turn-off-...

echochar4• 11 years ago

Many times I see commenters on HN making statements to the effect of "users cannot run their own servers" and spurring a "debate" in the context of someone trying to innovate away from the current asymmetric, client-server, "calf-cow" internet.

I saw one such commment earlier today.

Thought experiment:

What about exploits like this one, among so many others over the years, in Microsft Windows?

In many cases it sure looks like the user is "running a server".

There is a port open and listening, waiting for connections. And some remote client can connect and issue commands.

digi_owl3• 11 years ago

Many times I see commenters on HN making statements to the effect of "users cannot run their own servers" and spurring a "debate" in the context of someone trying to innovate away from the current asymmetric, client-server, "calf-cow" internet.

What that is about is that most consumer level internet connections do not have a fix IP address. Thus you can't (easily) aim a DNS reference at it etc.

echochar4• 11 years ago

Understood. However try to reconcile this with the thought experiment I gave above. You would be saying that these Windows exploits would not work because users have IP addresses that are changing too frequently. Is it possible that _in practice_ many "dynamic" IP addresses are actually quite static (i.e., remaining the same for months or longer)? In _theory_ they could change by the day or week.

Hot Potato – Windows Privilege Escalation

Related Stories