2

Here's the situation: As an adminstrator, I am able to stall the application by closing 2 handles held by the process. (Using ProcExplorer) . Is there any way/hack I can use to close file handles while as a regular user. handle.exe and ProcExplorer wont let me do so as a regular user. Is this because of Windows' security or because of ProcExplorer and Handle.exe's limitation ?

5
  • Is there any particular reason you need this functionality?
    – Iszi
    Jul 12, 2012 at 19:59
  • Yes to demonstrate a vulnerability.
    – sudhacker
    Jul 12, 2012 at 20:13
  • Could you explain this more in deep please. What user the app runs exactly the name, and to what groups in belongs in windows and domain, if on domain, and is this the same user the main app runs? Jul 12, 2012 at 20:29
  • Currently I'm thinking this is offtopic - it sounds like a general windows question. There is a hint of security question about it so I won't close unless it gets some votes/flags but can you clarify what the question is - Your final sentence looks on-topic, if limited but if you are asking 'show me a hack to breach windows security controls' then it will be off-topic.
    – Rory Alsop
    Jul 13, 2012 at 10:13
  • I cant reveal the name of the software here for obvious reasons. But the situation leads to a DoS on the entire system when I close 2 RPC handles held by the process. I can do this using an Adminstrator Account having admin privileges. This counts as a vulnerability in itself. But, if a regular limited user, somehow could(using some code) also close the handle held by the said admin process, the impact of the vulnerability would be amplified. @AndrewSmith : Yes this is the same process that runs on both admin as well as limited user accounts. OS is XP. Its a test system,hence no domains/group
    – sudhacker
    Jul 13, 2012 at 14:02

2 Answers 2

2

Considering the only way you could get to the process is through debugging hooks (I think). The Local Security policy in windows 7 has the following for the debug permission:

Debug programs

This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components.

Caution

Assigning this user right can be a security risk. Only assign this user right to trusted users.

Default: Administrators

If this is the case only users with this permission could cause the issue you're referring to. Your bigger issue is users that are able to escalate permissions, but that's the battle we all fight.

0

This can be done ! Process explorer doesn't allow you to do it but you can write a simple python script to close the handles using the DUPLICATEHANDLE_CLOSE SOURCE can be used to close handles of the same user level processes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.