Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Here's the situation: As an adminstrator, I am able to stall the application by closing 2 handles held by the process. (Using ProcExplorer) . Is there any way/hack I can use to close file handles while as a regular user. handle.exe and ProcExplorer wont let me do so as a regular user. Is this because of Windows' security or because of ProcExplorer and Handle.exe's limitation ?

share|improve this question
    
Is there any particular reason you need this functionality? –  Iszi Jul 12 '12 at 19:59
    
Yes to demonstrate a vulnerability. –  sudhacker Jul 12 '12 at 20:13
    
Could you explain this more in deep please. What user the app runs exactly the name, and to what groups in belongs in windows and domain, if on domain, and is this the same user the main app runs? –  Andrew Smith Jul 12 '12 at 20:29
    
Currently I'm thinking this is offtopic - it sounds like a general windows question. There is a hint of security question about it so I won't close unless it gets some votes/flags but can you clarify what the question is - Your final sentence looks on-topic, if limited but if you are asking 'show me a hack to breach windows security controls' then it will be off-topic. –  Rory Alsop Jul 13 '12 at 10:13
    
I cant reveal the name of the software here for obvious reasons. But the situation leads to a DoS on the entire system when I close 2 RPC handles held by the process. I can do this using an Adminstrator Account having admin privileges. This counts as a vulnerability in itself. But, if a regular limited user, somehow could(using some code) also close the handle held by the said admin process, the impact of the vulnerability would be amplified. @AndrewSmith : Yes this is the same process that runs on both admin as well as limited user accounts. OS is XP. Its a test system,hence no domains/group –  sudhacker Jul 13 '12 at 14:02

2 Answers 2

Considering the only way you could get to the process is through debugging hooks (I think). The Local Security policy in windows 7 has the following for the debug permission:

Debug programs

This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components.

Caution

Assigning this user right can be a security risk. Only assign this user right to trusted users.

Default: Administrators

If this is the case only users with this permission could cause the issue you're referring to. Your bigger issue is users that are able to escalate permissions, but that's the battle we all fight.

share|improve this answer
up vote 0 down vote accepted

This can be done ! Process explorer doesn't allow you to do it but you can write a simple python script to close the handles using the DUPLICATEHANDLE_CLOSE SOURCE can be used to close handles of the same user level processes.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.