Only logs Chrome browser (open as admin) if the program is opened as admin.

Question

Only logs Chrome browser (open as admin) if the program is opened as admin.

Dagdelo opened this issue 6 years ago · comments

It logs everything from other open windows without being as admin. But it only logs open windows as admin if the program is opened as admin.

Giacomo Lawrance · Answer 1 · Fri Oct 26 2018 01:08:16 GMT+0800 (China Standard Time)

Could you go into a little detail?

Henrique Delgado · Answer 2 · Fri Oct 26 2018 01:12:38 GMT+0800 (China Standard Time)

Sorry for English. It's as simple as that: the program does not catch the program's keystrokes (in this case the Chrome browser) open with administrator privilege. It only proceeds to capture if the program has the same privileges.

Giacomo Lawrance · Answer 3 · Sat Oct 27 2018 00:24:18 GMT+0800 (China Standard Time)

But when you have Chrome with admin permissions don’t you need to run it with admin permissions?

Henrique Delgado · Answer 4 · Sat Oct 27 2018 00:40:42 GMT+0800 (China Standard Time)

Yes! I'm just trying to say that the program only registers with equivalent or higher permissions. In case the browser is at the admin level and the program is not, it does not register.

Ata Hakçıl · Answer 5 · Fri Nov 02 2018 09:30:00 GMT+0800 (China Standard Time)

I don't think this is a bug, but rather how windows hooks are supposed to work. As far as i know you can only hook to a process with equal or less privilage level

Henrique Delgado · Answer 6 · Fri Nov 02 2018 10:08:30 GMT+0800 (China Standard Time)

I don't think this is a bug, but rather how windows hooks are supposed to work. As far as i know you can only hook to a process with equal or less privilage level

I have to agree. So a new feature 'bypass uac'/escalate privileges is necessary.

Ata Hakçıl · Answer 7 · Fri Nov 02 2018 12:49:31 GMT+0800 (China Standard Time)

I have to agree. So a new feature 'bypass uac'/escalate privileges is necessary.

I have to disagree again, does anyone even question when an exe asks for admin privilages? I say go for it, just ask it yourself, i bet 99% of the times people are going to give it.

Henrique Delgado · Answer 8 · Fri Nov 02 2018 14:46:17 GMT+0800 (China Standard Time)

I have to disagree again, does anyone even question when an exe asks for admin privilages? I say go for it, just ask it yourself, i bet 99% of the times people are going to give it.

So here we differ. Leveling underneath is wrong, underestimate the target is a step to be detected and have your payload being sent to the virustotal.