linksysWLAN20.txt

`Summary:  
Privilege escalation in Linksys WLAN Monitor v2.0 (http://www.linksys.com/)  
  
Details:  
The Linksys WLAN Monitor service (WLSVC) that is used to configure  
settings for various Linksys wireless network cards runs under the  
context of the LocalSystem account. It is possible to manipulate the  
administrative interface of the Linksys WLAN Monitor and escalate  
privileges to that of the LocalSystem account.  
  
Vulnerable Versions:  
Linksys WLAN Monitor v2.0 (for the WUSB54G wireless NIC and possibly  
other wireless NICs)  
  
Patches/Workarounds:  
The vendor was notified of the issue. There was no response as to  
whether or not a patch/fix would be released.  
  
Exploits:  
  
1. Right click on the Linksys Wireless Network Monitor in the lower right corner  
of the screen and click Open the Monitor.  
  
2. Click the Profiles tab and click Import.  
  
2. Right click on the Open button and click What's This?  
  
3. Right click on the help text that is shown in yellow and click Print Topic.  
  
4. Right click on any printer and click Open.  
  
5. Click Help, Help Topics.  
  
6. Right click in the right side of the help screen and click View Source.  
  
7. Notepad will appear (running under the context of the LocalSystem account).  
Click File, click Open.  
  
8. Change Files of type: to All Files, navigate to the system32 directory and  
locate cmd.exe. Right click cmd.exe and choose Open.  
  
The result is a command prompt running under the context of the LocalSystem  
account.  
  
Discovered by Reed Arvin reedarvin[at]gmail[dot]com  
(http://reedarvin.thearvins.com/)  
`