I'm doing some vulnerability research against a Windows server application that serves some update files that clients can download. Using TcpView/netstat, I can see that there is an open port listening to handle update requests. However, the process is running as SYSTEM.

I'm familiar with the technique of hooking recv / recvfrom on applications to start reversing the protocol, but that doesn't seem to be possible in this case. I'm not really sure how to figure out what binary the code handling these requests is from, after looking at the process on Process Explorer / Hacker. Any tips or tricks you all can recommend?

  • sysinternals' process monitor can sometimes give you backtraces if you're trying to avoid digging invasively... Commented Feb 3 at 18:25
  • 1
    If what you mean is that the process is a normal executable that is running as the "SYSTEM" user, then you can run a debugger in elevated mode and attach to it as any other process.
    – Yotamz
    Commented Feb 3 at 20:10
  • AFAIR running a debugger with admin permission is not enough, you need SYSTEM permissions. You can use psexec to run executables of your choice with SYSTEM permissions, so you are at the same permission level and can access the process you want at run-time with debugging tools. Anyway a network process running with SYSTEM permissions is a WTF of it's own.
    – Robert
    Commented Feb 4 at 16:27
  • @Robert - Thanks for the comment. I'll give that a shot.
    – BobNewby
    Commented Jun 4 at 17:09


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.