eugeny gladkih
14/12/06, 10:42
>>>>> "MS" == Michael Scheidell <scheidell@secnap.net> writes:
>> we've found local privilege escalation in Symantec LiveState agent.
>>
>> PoC:
>>
>> 1. kill shstart.exe process
MS> Wouldn't you have to be administrator to kill shstart.exe?
LocalSystem account has more privilegies then administrator's one.
--
Yours sincerely, Eugeny.
Doctor Web, Ltd. http://www.drweb.com
>> we've found local privilege escalation in Symantec LiveState agent.
>>
>> PoC:
>>
>> 1. kill shstart.exe process
MS> Wouldn't you have to be administrator to kill shstart.exe?
LocalSystem account has more privilegies then administrator's one.
--
Yours sincerely, Eugeny.
Doctor Web, Ltd. http://www.drweb.com