The Windows Boot Process Can Be Killed by New Yonsole.A Backdoor

Re: The Windows Boot Process Can Be Killed by New Yonsole.A Backdoor 22.06.2010. u 11:12 · pre 199 meseci #21

Citat:

Ne trce svi servisi pod LocalService / NetworkService nalogom, ima ih koji trce i pod sistemskim nalogom. Ovi novi (LocalService/NetworkService) nalozi su uvedeni u Visti kako bi se limitirao exposure jer gomila 3rd party developera koristi servise koji su puni potencijalnih rupa, ali i dalje nije zabranjeno kreirati servise sa "matorim" sistemskim privilegijama koje su daleko sire.

LocalSystem izgleda postoji od Viste. LocalServices/NetworkServices su stari nalozi. Interesantno.

http://msdn.microsoft.com/en-us/library/ms684190(v=VS.85).aspx

Re: The Windows Boot Process Can Be Killed by New Yonsole.A Backdoor 22.06.2010. u 11:17 · pre 199 meseci #22

Si siguran

http://www.windowsnetworking.c...LocalSystemaccountcontext.html

^ ovo je iz 2004

http://support.microsoft.com/kb/132679

^ ovo je za NT 3.5

Koliko se secam, LocalSystem je mator koliko i NT.

Potpis

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

Re: The Windows Boot Process Can Be Killed by New Yonsole.A Backdoor 22.06.2010. u 11:22 · pre 199 meseci #23

Citat:

Si siguran

http://www.windowsnetworking.c...LocalSystemaccountcontext.html

^ ovo je iz 2004

http://support.microsoft.com/kb/132679

^ ovo je za NT 3.5

Koliko se secam, LocalSystem je mator koliko i NT.

Nisam siguran :)

Na XP-u ne mogu da nadjem "LocalSystem" medju BUILTIN nalozima, a W7 masinu nemam pri ruci trenutno.

Mozda ovo donekle razjasnjava stvar http://support.microsoft.com/kb/132679:

Citat:

NOTE: System Account and This Account: Local System use the same account.

Re: The Windows Boot Process Can Be Killed by New Yonsole.A Backdoor 22.06.2010. u 12:09 · pre 199 meseci #24

pise i u samom clanku backdoor trojan, koji moze sa remote servera primati instrukcije, ali tek nakon infekcije
(remote exploit je nesto drugo oboje imaju remote u nazivu)

Potpis

NO FATE

Re: The Windows Boot Process Can Be Killed by New Yonsole.A Backdoor 22.06.2010. u 12:14 · pre 199 meseci #25

Koliko kapiram, taj backdoor deo je samo za slanje instrukcija - skoro svaki danasnji trojan ima i neki listener kojim mozes da mu komandujes.

Potpis

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

Forum kao aplikacija na telefonu

Srodne teme