NT Login Default Folder Vulnerability
BID:515
Info
NT Login Default Folder Vulnerability
| Bugtraq ID: | 515 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 28 1999 12:00AM |
| Updated: | Jun 28 1999 12:00AM |
| Credit: | Originally posted to NTbugtraq on June 28, 1999 by Martin Wolf <[email protected]>. Additional comments posted to NTbugtraq on June 30, 1999 by Michael Benadiba <[email protected]> and Martin Wolf <[email protected]>. |
| Vulnerable: |
Microsoft Windows NT 4.0 SP5 Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 |
| Not Vulnerable: | |
Discussion
NT Login Default Folder Vulnerability
When a user logs into an NT machine, there are a few processes that are started automatically, including explorer.exe. These programs are normally in %winroot% or %winroot%\system32. The problem is that NT will look for these programs first in the user's home directory. If no user folder is specified, it will look in the root of the system drive. Only if the program it is looking for is not found in that location will it look in the 'normal' location. This allows any user to rename any executable and have it run at login, effectively bypassing many policy restrictions. The list of currently known filenames that will work is: explorer.exe, nddeagnt.exe, taskmgr.exe and userinit.exe .
When a user logs into an NT machine, there are a few processes that are started automatically, including explorer.exe. These programs are normally in %winroot% or %winroot%\system32. The problem is that NT will look for these programs first in the user's home directory. If no user folder is specified, it will look in the root of the system drive. Only if the program it is looking for is not found in that location will it look in the 'normal' location. This allows any user to rename any executable and have it run at login, effectively bypassing many policy restrictions. The list of currently known filenames that will work is: explorer.exe, nddeagnt.exe, taskmgr.exe and userinit.exe .
Exploit / POC
NT Login Default Folder Vulnerability
Log in as a normal user. Copy command.com to your home directory and rename it explorer.exe. Log out and log back in.
Log in as a normal user. Copy command.com to your home directory and rename it explorer.exe. Log out and log back in.