Token Kidnapping's Revenge

[Nytro]

Token Kidnapping's Revenge

Author: Cesar Cerrudo

(cesar.at.argeniss.dot.com)

Abstract

This document describes some Microsoft Windows elevation of privilege vulnerabilities, how

they were found with the use of simple tools and how they can be exploited. Starting with a

little security issue that then leads to more significant vulnerabilities finding. All the

vulnerabilities detailed here are not publicly know at the time of this document release.

Table of contents
Table of contents.................................................................................................................................2
Abstract................................................................................................................................................3
Introduction.........................................................................................................................................4
Some theory.........................................................................................................................................5
The Tools.............................................................................................................................................6
Finding the vulnerabilities...................................................................................................................6
Bypassing Microsoft fix for Token Kidnapping on Windows 2003 and XP.....................................10
Preventing exploitation......................................................................................................................13
Conclusion.........................................................................................................................................14
Special Thanks...................................................................................................................................15
About the author................................................................................................................................16
References.........................................................................................................................................17
About Argeniss..................................................................................................................................18

Download:

http://www.exploit-db.com/download_pdf/17256