3 ms·
> Why the help viewer does anything as NT AUTHORITY\SYSTEM is beyond me. I don't get it either. From poking around in Process Explorer the help viewer window i
by smileybarry 5y ago
> Why the help viewer does anything as NT AUTHORITY\SYSTEM is beyond me.
I don't get it either. From poking around in Process Explorer the help viewer window isn't its own process, it's still part of "7zFM.exe" which is running at medium integrity (not admin). Don't know where the high integrity context is coming from.
I wonder if it's silent elevation, in which case just putting UAC on "always ask" is good enough (and what I do anyway).
- divingdragon 5y agoThe PoC video showed that the current user isn't in the "Administrator" group (though there is another user "zeroday" in there), which makes it look like not a simple UAC bypass. Or perhaps I misunderstood something.
- Someone 5y agoGoogle tells me the help viewer uses IE7 with ActiveX to display help pages (https://www.comparitech.com/blog/information-security/malicious-chm-files/ https://www.comparitech.com/blog/information-security/malici...) Given that, I think this is better removed from any system. If you have to access .chm files, I would first try other tools for displaying html help (https://blog.kowalczyk.info/articles/chm-reader-viewer-for-windows.html https://blog.kowalczyk.info/articles/chm-reader-viewer-for-w... has a list)
- badsectoracula 5y agoPretty much every other CHM viewer than the original one has multiple issues displaying CHM files properly or at all. Even Free Pascal and Lazarus that use their own tools to both produce and view CHM files (Lazarus has its own cross-platform CHM implementation) have their own CHM files working better with the Microsoft CHM viewer than their own viewer.