November 26, 2020
Zero Day vulnerability discovered by mistake in Windows 7
The vulnerability resides in two misconfigured registry keys for the RPC Endpoint Mapper and DNSCache services that are part of all Windows installations.
HKLM, SYSTEM, CurrentControlSet, Services, RpcEptMapper HKLM-SYSTEM-CurrentControlSet-Services-Dnscache
French security researcher Clément Labro was the one who discovered the vulnerability in Windows 7. He says that an attacker with a foothold in vulnerable systems can modify these registry keys to activate a subkey. Typically used by the Windows performance monitoring mechanism.
“Performance” subkeys are often used to monitor the performance of an application. And because of their role, they also allow developers to load their own DLL files. In order to monitor performance using custom tools.
In recent versions of Windows, these DLLs are often restricted and loaded with limited privileges. Labro said that in Windows 7 and Windows Server 2008 it is still possible to load custom DLLs. These were run with system level privileges.
пиздос посоны, нахуй с икспи воще вылезали
