Non-Admin User remotely shuts down the Host system

[murthy]

Non-Admin User remotely shuts down the Host system​

Description: Non-administrative users can remotely shut down a Windows XP Service Pack 3-based system by using the terminal service command TSShutdn.exe command from Win 7 system.

Environment:
Host: CPU- Pentium[R] D 2.80 GHz
Operating System- Windows XP with SP3
RAM- 1 GB

Client: CPU - Pentium[R] D 2.80 GHz
Operating System- Win 7
RAM- 1 GB
Repro Steps:
Configuration on Host PC:

• Goto Computer Management (My Computer->Manage).
• Create a local user (Non-Admin User)
• Add the local user to the “Remote Desktop Users Group”
• Log Off from the host system (XP SP3)

Remote Login through Client PC:

• Login to the host system remotely using the Host system local user credentials (Created in step 2)
• Goto command prompt type the terminal service command “tsshutdn.exe”.
• The system prompts “The system will shutdown in less than 60 sec”.
• The host PC is shutdown

Expected result: Local user (Non-Admin users) shouldn’t able to shut down the system remotely.
Actual Result: Local user (Non-Admin users) was able to shut down the system remotely.


Remarks:
The scenario is even true when the host is Win 7 and client is – XP with SP3

 

[murthy]

It ststes that it has been fixed in XP-SP2 and even in SP3, we need clarity for this...as we were able to reproduce this in XP sp3 and WIN 7....

 

[johngalt]

whoops - that is pretty serious.

I have W7 installed and we use XP at school so I can try this as long as I have terminal services installed - I'll give it a whirl.

Nice find, and if it happens to work even on these computers that I have access to that are joined on a Domain, this is pretty serious stuff.

 

[murthy]

whoops - that is pretty serious.

I have W7 installed and we use XP at school so I can try this as long as I have terminal services installed - I'll give it a whirl.

Nice find, and if it happens to work even on these computers that I have access to that are joined on a Domain, this is pretty serious stuff.

thanks johngalt..it would be of much help if you can reproduce the same scenario at your end post the findings..

 

[johngalt]

Will do.

Murthy - from India?

 

[redtech]

Oh not cool. I just tried this at work. VPN'd into the coporate network from my W7 laptop and shutdown my company workstation (xp.sp3, domain member).

 

[murthy]

Will do.

Murthy - from India?

yup I am from India..thanks for trying to reproduce the scenario...i will be waitng for your inputs.

 

[murthy]

Oh not cool. I just tried this at work. VPN'd into the coporate network from my W7 laptop and shutdown my company workstation (xp.sp3, domain member).

Hay thnks for your inputs...this is a very serious security threat...what we have understood is when a remote user tries to "forcefully shut down the host system" it doesnt check for user rights.

 

[Mark]

Have you sent some feedback to Microsoft about this yet, I'm sure they will want to fix this as soon as possible.

 

[murthy]

Yes we did