3 ms·
Not being super familiar with Windows, is an escalation from "low privilege" to "medium privilege" actually concerning in practice? (e.g., this be used for som
by geofft 6y ago
Not being super familiar with Windows, is an escalation from "low privilege" to "medium privilege" actually concerning in practice?
(e.g., this be used for something like breaking out of a Chrome sandbox?)
- gruez 6y agohttps://chromium.googlesource.com/chromium/src/+/master/docs/design/sandbox.md#The-integrity-levels https://chromium.googlesource.com/chromium/src/+/master/docs... >Integrity levels are available on Windows Vista and later versions. They don‘t define a security boundary in the strict sense, but they do provide a form of mandatory access control (MAC) and act as the basis of Microsoft’s Internet Explorer sandbox. And yes, chrome uses it as a sandbox.
- ChrisSD 6y agoTo be clear, Chrome uses it as part of a "defense-in-depth" strategy, but its sandbox does not rely on it. From your link: > So, the integrity level is a bit redundant with the other measures, but it can be seen as an additional degree of defense-in-depth, and its use has no visible impact on performance or resource usage.
- tonyedgecombe 6y agoThe print spooler runs under the local system account so you effectively get admin rights over the local machine. If it's a terminal server then you control the server. Not sure about Chrome though.
- ChrisSD 6y agoThis vulnerability is about `splwow64.exe`. It's started by the malware but explorer has it on a whitelist that automatically elevates it to medium integrity. It's not running as admin or system.
- tonyedgecombe 6y agoMy mistake, you are correct.
- aj3 6y agoIn practice, no. Meaning, typical Windows environments (especially corporate AD) provide so many privesc vectors, that no pentester has ever been stopped by this security boundary. Same goes to AMSI bypasses, etc.