Gray Hat Hacking, Second Edition, 2nd Edition

Attack Patterns for Each Interesting Object Type

Let’s apply the analysis methodology to real objects and start finding real security vulnerabilities. The following sections will list DACL enumeration techniques, then the power permissions, and then will demonstrate an attack.

Attacking Services

Services are the simplest object type to demonstrate privilege escalation, so we’ll start here. Let’s step through our attack process.

Enumerating DACL of a Windows Service

We’ll start with the first running service on a typical Windows XP SP2 system.

C:\tools>net start
These Windows services are started:

   Alerter
   Application Layer Gateway Service
   Ati HotKey Poller
   Automatic Updates
   ...

We used AccessChk.exe earlier to enumerate file system DACLs and ...