Windows 2000 Runas weirdness

From: jesperhtat_private
Date: Tue Dec 18 2001 - 01:18:53 PST

  • Next message: Replugge [Rod]: "Re: FTP scans from wanadoo.fr - MOre info"

    
     ('binary' encoding is not supported, stored as-is)
    Hiyas,
    Here is an interesting bug I found with the 
    Win2k "runas" command.  Could be exploitable, but I 
    dont think that it would do much good 
    as the error that comes up when you issue the 
    command refers to "runas.exe" in the title bar. 
    
    Heres what happens:
    
    C:\>runas /user:administrator 
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAA
    Enter password for administrator:(can be any 
    password, doesnt have to be the right one...)
    Attempting to 
    start "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    A" a
    s user "administrator"...
    
    I then gives a "The instruction at "0x77fcbcd2" 
    referenced memory at "0x00000100". The memory 
    could not be "written"." error.
    
    Let me know what you guys think/find out, im 
    curious :-).
    
    -Scarabus
    jesperhtat_private
    



    This archive was generated by hypermail 2b30 : Tue Dec 18 2001 - 08:33:33 PST