Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

I don't think this is considered as a finding #89

Closed
vletoux opened this issue Jul 4, 2019 · 1 comment
Closed

I don't think this is considered as a finding #89

vletoux opened this issue Jul 4, 2019 · 1 comment

Comments

@vletoux
Copy link

vletoux commented Jul 4, 2019

I found this in an assessment.

{
          "Privilege Rights": {
            "SeLoadDriverPrivilege": {
              "S-1-5-32-545": "BUILTIN\\Utilisateurs",
              "Description": "Required to load or unload a device driver. "
}

I don't think this is reported as "Interesting" but maybe I'm wrong.
In this case the SeLoadDriverPrivilege can be used for privilege escalation and it is granted to everyone.
(See the slides of Andrea for more details)

@l0ss
Copy link
Owner

l0ss commented Jul 6, 2019

image

It's definitely marked as 'interesting' within the code, as seen by the "I" highlighted in red above, which gets checked in AssessPrivRights.cs on line 37. If you're able to provide any example data that would help.

@l0ss l0ss closed this as completed Jul 6, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants