Microsoft Windows NT 4.0 - DCOM Server

source: https://www.securityfocus.com/bid/624/info


It is possible for a local user to modify how DCOM servers are run, thereby escalating his/her privilege level. The Interactive User has write permissions to the DCOM registry entries. By editing the registry keys associated with DCOM server applications, they can change which services are started to handle specific events. They can then overwrite the services EXE file, trigger the event, and have their code run as SYSTEM. 


This exploit will cause the System Event Notification service or SENS service to start when a VBScript calls for the creation of a new Wordpad Document. The SENS service is installed during an installation of IE5, but is not started. The default permissions allow Everybody write access to the EXE.
Edit the
HKCR\AppID\{73FDDC80-AEA9-101A-98A7-00AA00374959}
registry key and add a new value, "LocalService", with data SENS

Create an HTML document, with the following VBScript in it:
<SCRIPT LANGUAGE="VBScript"> CreateObject("Wordpad.Document.1") </SCRIPT>

Open the html document in a browser. The browser will request that the COM Service Control Manager (RPCSS.EXE) start the service associated with Wordpad.