NT LPC Privilege Escalation Vulnerability

vendor:

Windows NT

by:

Bindview

7.2

CVSS

HIGH

Privilege Escalation

269

CWE

Product Name: Windows NT

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2000

NT LPC Privilege Escalation Vulnerability

This vulnerability is a new variation of the NT LPC Privilege Escalation Vulnerability reported on January 12, 2000 by Bindview. The patch released by Microsoft on January 12, 2000 does not address these new issues. A number of restrictions apply to this new variation of the spoofed LPC replies vulnerability. Only presently running processes can be impersonated and the LPC identifier must be specified. As well, in order to successfully exploit this vulnerability, the request must be conducted at the same time as when the LPC call was made. Successful exploitation could lead to privilege escalation on the local machine. These vulnerabilities can only be launched against a machine a user can interactively log onto, therefore remote exploitation is not possible.

Mitigation:

Microsoft has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1753/info

This vulnerability is a new variation of the NT LPC Privilege Escalation Vulnerabilty (please see https://www.securityfocus.com/bid/934 for details) reported on January 12, 2000 by Bindview. The patch released by Microsoft (http://www.microsoft.com/technet/security/bulletin/ms00-003.asp) on January 12, 2000 does not address these new issues.

A number of restrictions apply to this new variation of the spoofed LPC replies vulnerability. Only presently running processes can be impersonated and the LPC identifier must be specified. As well, in order to successfully exploit this vulnerability, the request must be conducted at the same time as when the LPC call was made.

Successful exploitation could lead to privilege escalation on the local machine.

These vulnerabilities can only be launched against a machine a user can interactively log onto, therefore remote exploitation is not possible.

start porttool -s \BaseNamedObjects\Foo
start porttool -c \BaseNamedObjects\Foo
porttool -s3 \BaseNamedObjects\Foo2
(enter PID, TID, MID from porttool -s ...) 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20254.zip