[4865] in bugtraq
Inside GetAdmin
daemon@ATHENA.MIT.EDU (Mark Joseph Edwards)
Tue Jul 8 14:02:23 1997
Date: Tue, 8 Jul 1997 10:27:54 -0500
Reply-To: MJE <mark@ntshop.net>
From: Mark Joseph Edwards <mark@NTSHOP.NET>
X-To: Aleph One <aleph1@DFW.NET>
To: BUGTRAQ@NETSPACE.ORG
The nature of the getadmin bug is in the following API calls:
ChangeNtGlobalFlag(GetNtGlobalFlagPtr());
The above code creates the exploit. The GetNtGlobalFlagPtr() can be
replaced with a fix pointer, eliminating the need for READ access to the
ntoskrnl.exe, making it much tougher to defend against, while at the same
time, making it far less portable across NT systems.
Mark
