Slashdot Mirror

← Back to Stories (view on slashdot.org)

Gaining System-Level Access To Vista

Posted by kdawson on from the seems-too-simple-somehow dept.

An anonymous reader writes "This video shows a method by which a user can use a Linux distro called BackTrack to gain system access to Windows Vista without logging into Windows or knowing the username or password for any accounts. To accomplish this, the user renames cmd.exe to Utilman.exe — this is the program that brings up the Accessibility options for users without sight or with limited vision. The attack takes advantage of the fact that the Utility Manager can be invoked before the user logs into the system. The user gains System access, which is a level higher than Administrator. The person who discovered this security hole claims that XP, 2000, 2003 and NT are not vulnerable to it; only Windows Vista is."

30 of 412 comments (clear)

  1. Cancel.... by FriendSite.com · · Score: 5, Funny

    Allow full root access

    Cancel or Allow...

  2. physical access == game over by bersl2 · · Score: 5, Insightful

    How is this news?

    1. Re:physical access == game over by zonky · · Score: 5, Insightful

      Does it bypass the bitlocker/full drive encyption options in vista? Physical access is not always game over....

    2. Re:physical access == game over by hcmtnbiker · · Score: 5, Informative

      It wont bypass bitlocker if you have to put in a password as soon as you boot, but it might if you have it set up the other way.

      Physical access does always mean game over, bruting(most people keep thier FDE passwords around 4 characters) and the possibility of plain text attacks exist on certain blocks.

      The interesting thing is that the utility for helping impaired people is run as SYSTEM when it really doesn't have to be. I had wondered this and thought about doing the same hack before ever even seeing this video, however didn't ever bother to do it, the possibility of messing something up and having to revert it after just seemed too annoying to me.

      --
      If i had one dollar for every brain you dont have, i would have $1.
    3. Re:physical access == game over by sandmtyh · · Score: 5, Informative

      it works in xp and 2000... you just have to do the same trick with diffrent file names.

    4. Re:physical access == game over by _xeno_ · · Score: 5, Interesting

      No kidding. I once "hacked" into a Linux machine that had an unknown root password by booting off a live CD, sudo bashing to become root, and then it's just mount, chroot and passwd to reset the root password. (I could have also manually edited /etc/shadow but this was easier.)

      Linux is horribly insecure! I was able to reset the root password with just a live CD and complete access to the machine!

      Now of course if the hard drive had been encrypted, this "attack" wouldn't have worked. (Although in this case at least, a different attack would have worked: reinstalling the OS. Resetting the root password was faster. The data on the machine wasn't important. We just needed a working Linux installation with a known root password.)

      --
      You are in a maze of twisty little relative jumps, all alike.
    5. Re:physical access == game over by Hunter-Killer · · Score: 5, Informative

      Parent is correct; been doing this in XP for years with C:\windows\system32\sethc.exe (StickyKeys).

      The article wouldn't have been newsworthy if it had merely said "Vista just as vulnerable, nothing new." Especially since the old tricks are often the first things tried with the new OS.

    6. Re:physical access == game over by weicco · · Score: 5, Insightful

      The interesting thing is that the utility for helping impaired people is run as SYSTEM when it really doesn't have to be.

      My hunch would be that the utility has to insert some system level hooks into Windows in order to read text from every widget (window, control, or whatever you call them) in the system. This is why it needs elevated privileges.

      But the whole article is stupid. I "hacked" into my coworker's Win2000 installation almost decade ago. He was on holiday and we needed something from his PC. I downloaded nice little program from the internet, copied it to disk, booted it and changed admin password. Then we just log on to his system using the new password. Wow! Maybe I should post an article to Slashdot about this!

      --
      You don't know what you don't know.
    7. Re:physical access == game over by Count+Fenring · · Score: 5, Funny

      I think we can all agree that any hack involving a time machine is newsworthy.

    8. Re:physical access == game over by WWWWolf · · Score: 5, Insightful

      Secondly, which moron in Microsoft would allow 'root' level programs to run 'before' the user has logged in as root? Pretty dumb, it seems to me. Maybe they did it on purpose?

      A bit of a chicken-and-an-egg problem here: How do you propose you authenticate users without a) running the authenticating program as root, having privileges to say "okay, you're user X, let me shift the control over to you", or b) being just as exploitable by giving limited user Y the privilege of saying "okay, you're user X, let me shift the control over to you"?

      Linux isn't any better, you know...

      # ps axu | grep getty
      root 4825 [...] /sbin/getty 38400 tty3
      root 4826 [...] /sbin/getty 38400 tty4
      [...]
      # ps axu | grep gdm
      root 10691 [...] /usr/sbin/gdm
      root 23736 [...] /usr/sbin/gdm

      A better question would be to ask, "why is the login application executing random programs anyway?" or, like you said, "why isn't the login application making sure that, when it executes a random program, it actually executes the program it was supposed to execute?" but I suppose the answer to these questions is simple: "sometimes the flexibility is warranted" and "this is getting way too elaborate, giving minimal gains in actual real security" - in short, if you want to make sure utilman.exe isn't messed around with before the boot, the more feasible and elegant solution is to use full-drive encryption (which solves far more problems at one single swat), not mess around with micro-granular annoyances.

    9. Re:physical access == game over by Kugrian · · Score: 5, Funny

      Face it, if an attacker already has physical access to a system -- to the extent that he can run his own Linux OS on it and mess with the contents of its disks -- then that computer is already, entirely owned. This is true for Linux, it's true for OS X, it's true for BSD, and it's true for Windows. That's just the way computers work.


      It's much much harder with Linux. First of all you have to work out how to lure the user out of their basement and away from their computer.
    10. Re:physical access == game over by Oktober+Sunset · · Score: 5, Funny

      I use a 26 char password on a laptop that locks every 5 minutes.

      Once you get used to it, it's not too annoying at all.

      --
      What if Tetris was invented by Nazis?
    11. Re:physical access == game over by ConanG · · Score: 5, Funny

      No, it's
      qwertyuiopasdfghjklzxcvbnm

      but good guess!

    12. Re:physical access == game over by Barny · · Score: 5, Informative

      You can also use similar tricks to work around the vista Activation wizard to install drivers.

      When vista says "activate now or die" tap shift 5 times, opt to go to accessibility panel, now you have an explorer window running as System, you can jump to control panel, start up all the networking and windows installer services, install those pesky Lan drivers, then exit back and activate windows.

      This works so well now because of the heavy integration of explorer/iexplore and the configuration panel scripts.

      --
      ...
      /me sighs
    13. Re:physical access == game over by karmatic · · Score: 5, Informative

      Or, you could just pay for that software you've pirated. See, no more pesky activation dialogs. But of course being Slashdot, that means that it's noble to somehow stick it to Microsoft. Did you actually read the parent? It's possible to get Vista into a state where you can't activate (online) because you lack networking drivers.

      Instead of using the incredibly painful phone activation, you can use this to install said LAN drivers and activate.

      If you're using a pirate copy, there's no pesky activation dialog either, and if you're using a crack, you don't really need LAN drivers to use it, do you?
  3. Is this how it was planned? by websters · · Score: 5, Funny

    A conversation amongst the developers: Dev 1: "You see - we can just rename the exe and then get the job done!" Dev 2: "Is there a risk?" Dev 1: "How? Users without sight or with limited vision will have a hard time getting to cmd.exe to rename it - dumbass!"

    1. Re:Is this how it was planned? by totally+bogus+dude · · Score: 5, Insightful

      Not really, the kernel is just a file or two. If you insist, then rename init to something else (e.g. a shell) and you'll get a similar effect on Linux. Or modify the inittab to run a logged-in root shell on one of the vty's. If you really think this is some special OMG VISTA IS SO INSECURE COMPARED TO EVERYTHING ELSE flaw, then you don't understand the "problem" at all.

      However I have to wonder: once you have access to the filesystem, why exactly would you bother booting into Vista and getting yourself a privileged cmd.exe? Why not just access whatever data you want from the other OS? Or does "unencrypted hard drives can be read and modified using other computers" not make a good enough headline?

      This whole thing is so completely and utterly pointless it's probably created a black hole.

  4. PANIC by Profane+MuthaFucka · · Score: 5, Insightful

    The BIOS lets you run anything! Even a whole new operating system! Unrestricted access OMG!

    --
    Fascism trolls keeping me up every night. When I starts a preachin', he HITS ME WITH HIS REICH!
    1. Re:PANIC by jhdevos · · Score: 5, Funny

      Right... They should think of some system where the BIOS will only load code that was digitally signed somehow, so these atrocities are no longer possible. Personally, I will only feel safe when I know that Microsoft completely controls what goed on on my PC!

  5. If you can write the raw disk... by Animats · · Score: 5, Insightful

    Really. If you have enough access to the machine to boot your own OS and rewrite the disk, of course you can take over the machine.

    Now if someone manages to do this from the outside, that's news.

  6. DUH..... this works in 2000 and xp as well by sandmtyh · · Score: 5, Informative

    boot NTFS live linux CD rename magnify.exe magnify.bak. copy cmd.exe to magnify.exe. boot to login screen and press windowskey+U and choose magnify the screen. system level access to anything. Also if you are an admin in windows xp, just run "at 12:05 /interactive cmd.exe" at 12:05 there will be a cmd promt that pops open (BTW you can use any time, then adjust the system clock) the cmd prompt that pops open will have system level access. use taskmgr to kill explorer.exe then lauch explorer from the cmd prompt..... you are now system. I have been using this for years... i was told that MS was going to sign all the EXE files to stop this attack, but guess what..... cmd.exe will still be signed. people who are surprised by this.... you might also like to know how to get remote desktop running on XP home http://www.geekport.com/2007/08/15/enabling-remote-desktop-in-xp-home/

  7. Re:WTF? by fabs64 · · Score: 5, Insightful
    You mean like init? gdm? Xorg? sshd?

    Wow, if I boot a *nix machine with a rescue disk (assuming /sbin isn't encrypted) I can replace all sorts of apps that run as root with my own!

    danger will robinson.

    Seriously, as many problems as I have with Microsoft's past security practices, this does not look like anything.

  8. Re:WTF? by icebike · · Score: 5, Insightful

    > While this does require physical access, running
    > something as root before login is still incredibly
    > stupid.

    Every Unix/Linux system runs "something as root" before login. You should look at "top" some time and see what pid number 1 is and who ran it.

    --
    Sig Battery depleted. Reverting to safe mode.
  9. Mastercard Ad by this+great+guy · · Score: 5, Funny
    • Getting Camstasia Studio to record your BackTrack & Vista sessions: free (you got the free trial version)
    • Downloading a James Bond music to put it in your flash demo: free (you have got crazy peer-to-peer skillz)
    • Showing the world the amazing things you can do with physical access to a box and that it takes you 60 long secs to painfully rename cmd.exe to utilman.exe: ...priceless
  10. This isn't a real security hole. by kiwioddBall · · Score: 5, Insightful

    Reason : You need access to the system to rename the system files in the first place. To rename system files you need Admin permission.

    Definition of a security hole : A security hole allows you to gain system access when you don't have system access in the first place.

  11. This could be useful by WizzardX · · Score: 5, Insightful

    I think this is a useful hack. iirc, unlike most other OS's, Vista doesn't give you "real" system level admin if you login as administrator. It reserves the highest privilege level for itself. This could be useful for disabling services, updating system files and so on, that Vista won't let you do normally.

  12. Re:Multi-step process by gazbo · · Score: 5, Insightful
    No. In order to rename the file remotely you already need root. And even ignoring that, you would still need physical access to use the newly exploited shell.

    Your comment is akin to saying "Ah, but what if someone finds a way to remotely append init=/bin/bash to Grub?" There's no weakness in Linux there, as you'd need to have root on the box in order to do such a thing, and then after the shutdown -r you'd be fucked anyway as it sat at a shell 1000 miles away waiting for someone to type into the console.

  13. I disagree by Mostly+a+lurker · · Score: 5, Interesting

    Consider: someone arrives from 10 years in the future in a time machine. OK, at the time he arrives this is news. However, at the point the individual leaves to go back in time, we have already known about this for 10 years. He may even be reusing the same time machine, if it was never used in the intervening period. How is a 10 year old story news (I am ignoring /. for the purpose of this argument)?

  14. Re:Long weekend... by WI2822 · · Score: 5, Funny

    maybe you should shop for a MAC over the weekend Do you know of any good MAC addresses?
  15. hooks should be in service or drivers by DrYak · · Score: 5, Interesting

    The interesting thing is that the utility for helping impaired people is run as SYSTEM when it really doesn't have to be.
    My hunch would be that the utility has to insert some system level hooks into Windows in order to read text from every widget (window, control, or whatever you call them) in the system. This is why it needs elevated privileges. Yeah. But microsoft's own good practice recommendation is that this kind of hooks need to be placed in a driver or a service (it self installed with the necessary privileges). And that the program that needs the access stay with low privileges and only access what it needs through the API exposed by the privileged service/driver.

    That's how all hardware monitoring and similar tools do, to avoid triggering false alarams in UAC.

    It's just strange how Windows can't even follow their own recommendations.
    --
    "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]