Windows can do things that require UAC without prompting for UAC.
For example, Windows can change any file in C:\Windows without requiring UAC. Could a malicious program "pretend" to be windows and do the same kind of thing, but with worse results?
3
-
I don't know of any proof of concept that this is even possible.– Randy EJun 25, 2013 at 2:26
-
1What do you mean by "Windows"? Are you referring to a particular process running in Windows?– void_inJun 25, 2013 at 4:17
-
4You need to review your terms. An operating system, by definition, consists of all functions it is designed to provide. Windows is an operating system not a thing that one can pretend to be. Onc can pretend to be an identity inside that system with related rights and privileges.– zedman9991Jun 25, 2013 at 12:09
Add a comment
|
1 Answer
Acting as Windows is called running as SYSTEM. SYSTEM is the user account that has the lowest level access and can do anything on, well, the system. Windows uses the SYSTEM account to run key services that keeps the system in order.
If you can run as SYSTEM then yes you can pretty much do anything you want on that machine. The problem is that it's really difficult (relatively speaking) to get a program to run as SYSTEM, as you need administrative permissions to do so.
-
+1 There are various methods where you can inject into a process and then migrate to SYSTEM. A large portion of how Meterpreter from Metasploit works. It gets harder to do as we move into Windows 8 and 2008 R2 world, but you'll see advisories that support development in this space is really active. Here is a fresh privilege escalation from May seclists.org/fulldisclosure/2013/May/91– g3kJun 28, 2013 at 18:25