News for hackers. Stuff that matters.
Re:All Major Browsers Fall at Pwn2Own Day Two by ams6110 on Friday March 20, 2015 @01:14PM (#9238975)
IIRC on Windows, SYSTEM is an account something less than full Administrator but more privileged than a normal user. I think many services run as SYSTEM.
Re:All Major Browsers Fall at Pwn2Own Day Two by Someone1234 on Friday March 20, 2015 @02:04PM (#9239436)
SYSTEM is root.

SYSTEM is arguably not a user, because a user has things like a password, groups, and other user properties. SYSTEM on the other hand is a built in low level security context which cannot be removed, altered, or shared across a network. You cannot login as SYSTEM, but processes can run as SYSTEM. It has a static SID on all Windows systems as S-1-5.

Some of the processes that run as SYSTEM in SYSTEM: ntoskml (Windows Kernel), all drivers, and all interrupt handlers. A few key services (not all, and fewer every release).

Literally it doesn't get higher than NT AUTHORITY\SYSTEM on Windows. The administrator account no longer exists on most Windows installations at all, and the administrators group is just that, a group.

It is like root on UNIX, if the root account had been configured to disable interactive login and to allow sudo only.

PS - SYSTEM is sometimes called NT AUTHORITY in documentation. I've seen it called both, I've also seen it called "NT AUTHORITY\SYSTEM." I believe the NT AUTHORITY is referring to the lowest level of permissions within the OS, and SYSTEM is at that level/root of the permissions table. So really NT AUTHORITY and SYSTEM are equivalent.

Re:All Major Browsers Fall at Pwn2Own Day Two by icebraining on Friday March 20, 2015 @02:19PM (#9239578)
It is like root on UNIX, if the root account had been configured to disable interactive login and to allow sudo only.

Which is what Ubuntu actually does :)

https://help.ubuntu.com/community/RootSudo

Re:All Major Browsers Fall at Pwn2Own Day Two by akira2501 on Friday March 20, 2015 @03:24PM (#9240121)
Small nit:

S-1-5-18 is the SID+RID for "NT AUTHORITY\SYSTEM". S-1-5 is just the "NT AUTHORITY" prefix.

Re:All Major Browsers Fall at Pwn2Own Day Two by userbinator on Friday March 20, 2015 @07:36PM (#9241298)
You cannot login as SYSTEM, but processes can run as SYSTEM

There's a trick to do this, I only remember it well for XP (via task scheduler/at command) but it's possible for the newer versions too.

In Windows, Administrator is not the true root.

Re:All Major Browsers Fall at Pwn2Own Day Two by quotemstr on Friday March 20, 2015 @08:24PM (#9241427)
Use psexec: https://technet.microsoft.com/en-us/sysinternals/bb897553.as...

It's occasionally useful to run regedit as SYSTEM.

Re:All Major Browsers Fall at Pwn2Own Day Two by breakingcups on Monday March 23, 2015 @06:05AM (#9250122)
That's not logging in as SYSTEM, that's running an explorer process as SYSTEM.

Another way to accomplish it in XP & such was by copying cmd.exe over one of the default screensavers (which are also just regular programs). When you're at the login screen the screensaver gets run as system, thus giving you the equivalent of a root shell. Launching explorer from it would result in a new user profile being created in explorer and you'd be "logged in" as SYSTEM, but not really.

Re:All Major Browsers Fall at Pwn2Own Day Two by reader_1000 on Friday March 20, 2015 @04:19PM (#9240450)
When I configure a service that runs as SYSTEM user, I cannot perform administrative calls on that service. For example, a powershell script fails with "access denied" when it has an operation that requires admin rights. So I think, running as SYSTEM does not make you root all the time? Or am I missing something?
Re:All Major Browsers Fall at Pwn2Own Day Two by HanyouHottie on Friday March 20, 2015 @03:46PM (#9240248)
Another small nit: Every Windows installation has two built-in accounts that can't be removed (but can be renamed!): Administrator and Guest. It's just that they're both disabled by default (since Vista I believe) and there's no easy GUI to enable Administrator while there is for Guest.
Re:All Major Browsers Fall at Pwn2Own Day Two by xrstf on Friday March 20, 2015 @02:23PM (#9239593)
Thanks for this explanation! :)
Re:All Major Browsers Fall at Pwn2Own Day Two by dblohm7 on Friday March 20, 2015 @02:06PM (#9239462)
Nope, it is MORE privileged than full Administrator!
Re:All Major Browsers Fall at Pwn2Own Day Two by krylon on Saturday March 21, 2015 @06:25AM (#9242337)
You might think so, but check the service configuration (services.msc) - on a typical Windows machine, you will find plenty of services running as SYSTEM. Basically, nearly all services that do not need to face the network (Windows has another builtin account for that, which I think is called NETWORK or NETWORK SERVICE on English versions of Windows).