Exploiting secondary logon
The secondary logon is a Windows service that is used by administrators to perform administrative tasks through a standard system account. This service can be exploited through an inherent vulnerability that affects the following versions of Windows:
- Windows 7
- Windows Server 2008
- Windows 8.1
- Windows Server 2012
- Windows 10
The exploitation process leverages the lack of sanitization of handles in the secondary logon service, which can allow a user to duplicate a system service thread handle.
In this section, we will take a look at how to exploit this vulnerability both manually and automatically using the Metasploit framework. It is important to note, however, that the exploit requires certain dependencies to be met in order for this process to work:
- The target system should have two or more CPU cores.
- The target system should be running PowerShell V2.0 or later.
More information regarding this exploit can...
