De:
grios@lanet.com.pe
Fecha:12 Mar 98 20:13:17
Disculpen amigos, me confundi, el programita que convierte a un usuario
comun en administrador del sistema se llama Getadmin.
A continuacion les adjunto un informe mas detallado de Microsoft de como trabaja dicho programa:
A utility, Getadmin.exe, is being circulated on the Internet that grants
normal users administrative rights by adding them to the Administrators
group. This utility can be run from any user context except Guest and
grants a local user account administrative rights.
This problem does not occur on Windows NT 3.51.
CAUSE
=====
Getadmin.exe works because of a problem in a low-level kernel routine that causes a global flag to be set which allows calls to NtOpenProcessToken to succeed regardless of the current users permissions. This in turn allows a
user to attach to any process running on the system, including a process running in the system's security context, such as WinLogon. Once attached
to such a process, a thread can be started in the security context of the process.
In the specific case of GetAdmin, it attaches to the WinLogon process,
which is running in the system's security context, and makes standard API
calls that add the specified user to the administrators group.
It is important to note that any account which has been granted the rights
to "Debug Programs" will always be able to run Getadmin.exe successfully,
even after the application of the hotfix. This is because the "Debug
Programs" right allows a user to attach to any process. The "Debug
Programs" right is initially granted to Administrators and should be only granted to fully trusted users.
Also, if Getadmin.exe is run with an account that is already a member of
the administrators local group, it will still work (even after applying the hotfix). This is by design. Members of the administrators group always have
the rights to make the calls GetAdmin needs in order to succeed.
RESOLUTION
==========
A fix to the Windows NT Kernel routine which was being used to set the
global flag has been developed by Microsoft. This fix prevents an
application, such as Getadmin.exe, from attaching to WinLogon (or any other process not owned by the user) and from granting administrative rights to users.
To resolve this problem, obtain the hotfix below, or wait for the next
service pack.
This hotfix has been posted to the following Internet location:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/spa/nt40/
hotfixes-postSP3/getadmin-fix
------------------------------------------------------------------------------- -
Para retirarse envie a
listasrcp@rcp.net.pe 'unsubscribe winnt'
No envie mensajes con 'subscribe' o 'unsubscribe' a
winnt@rcp.net.pe
Web de Listas Red Cientifica Peruana:
http://www.rcp.net.pe/rcp/LISTAS ---------
Para enviar un mensaje a la lista, hagalo con remitente
"
winnt@servinet.net.ar"
y destinatario "
winnt@rcp.net.pe", por netmail al nodo 4:905/555. (gateway)
--- MHSFIDO (c) FG
* Origin: ISP <SERVINET BBS> +54-833-27500 (4:905/551.50)
SEEN-BY: 902/9 905/100 551