Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I have a few computers at home on which i hack for fun. Until now google has been able to answer my questions. But now I need your help. What ways are there to elevate from a non-admin user to NT system? Source code, how to's and explenation on how they operate would be awesome!

share|improve this question
2  
Hi @filip I'm afraid this isn't the place to come for exploit code. We can give answers on protection strategy and explanation of technique, but we avoid the black hat end of things. A quick google will get you lots of exploits anyway. – Rory Alsop♦ Oct 2 '11 at 16:15
3  
I would add that "what are some" generally asks for a list, and that such a list is likely to be out of date very, very quickly. Generally, an exploit targets a specific process running in the desired privilege and injects code through that exploit. So it depends entirely on whether there is a bug and how long the bug stays unpatched. – Antony Vennard Oct 2 '11 at 16:31
@Rory Isn't this qualified as white-hat since i have permission (my own computers) to to this? I am doing this to learn entry points. If I know how some exploit works then I'll have a better chance of stopping it. – Filip Haglund Oct 2 '11 at 19:02

3 Answers

up vote 3 down vote accepted

Firstly, there's the runas application, which allows you to impersonate any user on a system. Just pass the call to the program you want to run through runas and it can be run with any user you like.

Secondly, there's the WindowsIdentity class for .NET which allows you to impersonate users if you have sufficient rights.

WinAPI also features some functions to create processes for a user different than the one executing the current process, see the CreateProcessAsUser function for further details.

share|improve this answer
up vote 2 down vote

One of the more common ways that a security tester would use to try and escalate privileges using something like Metasploit.

Using Metasploit you can deploy a meterpreter payload to the target system and then use the getsystem command to attempt to escalate to administrator. This command uses a number of techniques under the hood, but as it's all open source you can read the relevant Metasploit files to get the details.

share|improve this answer
i know metasploit. It was actually the reason to this question since their getsystem has multiple ways of doing this. The file i found (way #1 or something like that) tho was a .dll = quite hard to inspect. Will check out the source next week to see if i can find it. – Filip Haglund Oct 2 '11 at 19:23
up vote 1 down vote

nmap your 3rd party apps for versions and look at sites such as securityfocus and exploit-db or even pre-built metasploit exploits for escalations.

3rd party apps that run under higher privs can be a goldmine

There's a million ways to find privilege escalations .. you just need to look around .. run a nessus scan to look for weaknesses

You should do the offensive-security pen testing course .. it will answer all your questions :)

share|improve this answer
A bit too buzy for that right now tho :/ Gonna do it sometime – Filip Haglund Oct 6 '11 at 16:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.