Tridge writes:

#### Summary

A remote winreg caller without SeRemoteShutdownPrivilege can invoke configured shutdown or abort hooks because the privilege check only gates root elevation; smbrun() still executes and a zero exit status returns WERR_OK.

- librpc/idl/winreg.idl:401-412 defines winreg_InitiateSystemShutdownEx without a registry handle argument.
- source3/rpc_server/winreg/srv_winreg_nt.c:569-575 loads the shutdown script and denies only when it is empty.
- source3/rpc_server/winreg/srv_winreg_nt.c:619-640 checks SEC_PRIV_REMOTE_SHUTDOWN but still calls smbrun() and returns WERR_OK on ret == 0.
- source3/rpc_server/winreg/srv_winreg_nt.c:659-681 repeats the same pattern for abort_shutdown_script.
- docs-xml/smbdotconf/logon/shutdownscript.xml:12-14 documents root execution only when the connected user has SeRemoteShutdownPrivilege; lines 58-59 show the default is empty.

Remaining uncertainty: No RPC service proof was run. Runtime exploitability depends on RPC exposure and configured non-empty shutdown hooks; defaults are empty.

#### Dataflow

Attacker role: Remote winreg RPC caller able to bind and invoke shutdown or abort-shutdown operations but lacking SeRemoteShutdownPrivilege.

Entrypoint: winreg_InitiateSystemShutdownEx and winreg_AbortSystemShutdown handleless RPC operations.

Trust boundary: Remote RPC input crosses into local admin-configured hook execution and shutdown workflow authorization.

Controls and counterevidence:
- shutdown script and abort shutdown script default to empty, returning WERR_ACCESS_DENIED without execution.
- SEC_PRIV_REMOTE_SHUTDOWN is checked, but only controls become_root()/unbecome_root().
- Unprivileged callers run the hook without root elevation, but the hook still runs and success is based on script exit status.
- The shutdown message is alpha-sanitized before substitution.

Exploit steps:
1. Configure or target a server with a non-empty shutdown script or abort shutdown script.
2. Bind to winreg and call InitiateSystemShutdownEx or AbortSystemShutdown without SeRemoteShutdownPrivilege.
3. The handler loads and substitutes the configured script, computes can_shutdown=false, but still calls smbrun().


Attacker outcome: A remote winreg caller without SeRemoteShutdownPrivilege can invoke configured shutdown or abort hooks because the privilege check only gates root elevation; smbrun() still executes and a zero exit status returns WERR_OK.

#### Severity

Final severity is **medium**. This has a concrete sink and plausible attacker path, but role, configuration, optional feature, or runtime preconditions bound practical exploitability.

The validation disposition was reportable with severity suggestion medium. The final decision is report with severity medium because the source-supported attack path crosses a meaningful boundary, while the listed controls constrain likelihood and blast radius.

Counterevidence: Default hook parameters are empty, unprivileged callers do not become root, and runtime exposure depends on winreg RPC access and site-specific hook configuration.

Remediation summary: Enforce SeRemoteShutdownPrivilege before any hook substitution or smbrun() call, and return access denied before executing shutdown/abort scripts for unauthorized callers.


#### Remediation

Enforce SeRemoteShutdownPrivilege before any hook substitution or smbrun() call, and return access denied before executing shutdown/abort scripts for unauthorized callers. Add regression coverage that exercises the attacker-controlled input at the listed entry point and asserts the validation, authorization, containment, or size check occurs before the dangerous sink.


| Severity | medium |
| Confidence | high |
| Confidence rationale | Static source tracing identifies the attacker input, broken control, and sink in repository code. Remaining uncertainty: No RPC service proof was run. |