All Major Browsers Fall at Pwn2Own Day Two

Re:All Major Browsers Fall at Pwn2Own Day Two by userbinator on Friday March 20, 2015 @07:36PM (#9241298)

You cannot login as SYSTEM, but processes can run as SYSTEM

There's a trick to do this, I only remember it well for XP (via task scheduler/at command) but it's possible for the newer versions too.

In Windows, Administrator is not the true root.

[ Parent | on HN ]

Re:All Major Browsers Fall at Pwn2Own Day Two by quotemstr on Friday March 20, 2015 @08:24PM (#9241427)

Use psexec: https://technet.microsoft.com/en-us/sysinternals/bb897553.as...

It's occasionally useful to run regedit as SYSTEM.

[ Parent | on HN ]

Re:All Major Browsers Fall at Pwn2Own Day Two by breakingcups on Monday March 23, 2015 @06:05AM (#9250122)

That's not logging in as SYSTEM, that's running an explorer process as SYSTEM.

Another way to accomplish it in XP & such was by copying cmd.exe over one of the default screensavers (which are also just regular programs). When you're at the login screen the screensaver gets run as system, thus giving you the equivalent of a root shell. Launching explorer from it would result in a new user profile being created in explorer and you'd be "logged in" as SYSTEM, but not really.

[ Parent | on HN ]