Many actions in Windows automatically generate doubts about permissions, privileges, and limits. More than once they have been reported as bugs, when in reality they walk a very thin gray line. If you want an example, researcher Alexander Korznikov published a short demo in which a user with elevated privileges hijacks another user's session, without entering credentials or anything like that. Vulnerability, or part of the design?
One of the oldest and most effective ways to access a password-protected Windows computer is using the Sticky Keys backdoor. If you don't know about it, search Google for "sethc.exe", and you'll be on your way. I've used it at least half a dozen times to restore access for users who forgot their password (or tried to change it, typed it incorrectly, and don't know what it became), and all you need is a copy of the operating system. Three major versions of Windows have passed since I heard about that shortcut, and it's still there. If it requires physical access, the truth is that Microsoft doesn't pay much attention... but imagine for a moment what other things can be done in the operating system.
https://www.youtube.com/embed/oPk5off3yUgThat brings us to the latest demo published by researcher Alexander Korznikov. What you just saw in the video is the hijacking by a user with elevated privileges of a session that was locked by another user. The only thing he used in the process was Task Manager, and a copy of the formidable PsExec tool by Mark Russinovich. When he tries to connect to the session for the first time, Windows correctly asks for the password, but with the help of PsExec, Task Manager is elevated to "NT AUTHORITY/SYSTEM"... and the rest is history.
Now, Korznikov has doubts, and so do we. Is it really a vulnerability or not? According to Microsoft, it is not, because its execution demands administrator privileges in the first place. And on the other hand, Korznikov's thing better qualifies as a rediscovery, because it was reported in April 2011. Still... maybe those sessions should be a little more separated, right?
