4 ms·
The vulnerability in hh.exe is already well known and documented by the LOLBAS project [0]. My team and I (Adversary Simulation at IBM X-Force Red) conduct stea
by octagons 5y ago
The vulnerability in hh.exe is already well known and documented by the LOLBAS project [0]. My team and I (Adversary Simulation at IBM X-Force Red) conduct stealth-oriented red team security assessments and we use vulnerabilities like this to do our jobs every day - just as any red team worth its salt would. Capabilities like this are built into all kinds of tools that are installed by default on Windows. They are often essential to obtaining code or command execution on hosts through social engineering or post-exploitation when moving laterally between hosts.
This is just speculation, but the privesc vulnerability might be related to memory allocation in the DLL used to integrate with the system shell context menu - i.e. right clicking on a file. Just a guess based on the mention of a heap overflow.
[0] https://lolbas-project.github.io/lolbas/Binaries/Hh/ https://lolbas-project.github.io/lolbas/Binaries/Hh/
- tyingq 5y agoI think it's also probably somewhat common for run of the mill employees to use privilege escalation exploits to get admin access to do regular tasks. At least it was common in places I've worked where your local PC was so locked down that you couldn't do your job, and the official process to work around that wasn't reasonable. Enough people doing that opens up other unintended holes.
- vorticalbox 5y agoAt work I've used dirty sock[0] to gain su on a development server. [0]https://github.com/ROIGap/dirty_sock https://github.com/ROIGap/dirty_sock
- staticassertion 5y agoI'm pretty sure I've used this exact attack to escalate privs back when I was in high school, to work around the school's restrictions.
- _ofdw 5y agoFor me it was installing a local account with admin privileges via Kali Linux.