full-disclosure - Re: Removing the NIC cable = EoP?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 2 Oct 2006 21:02:44 -0700
From: "Pink Hat" <pinkhat.h4x0r@...il.com>
To: Krainium <krainium@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Removing the NIC cable = EoP?

This doesn't work on XP.  Pulling the network cable *does not* cause the
machine to default to local administrator.  From the lame post:

"Login on the computer, and wait for the login window to disappear. Pull the
network cable out of the wall. After about 30 seconds you will see the
message that "could not retrieve local profile". It now loads up into the
LOCAL administrator mode"

Think about this for just a second.  Think about how Windows has worked with
profiles since pretty much forever.  The profile will be (unless configured
otherwise) cached on the local machine.  If configured to not be cached on
the local machine you will either be given a default desktop (in luser land
not local admin) and in some cases (older windows versions) you won't be
allowed to login.

So either the post is complete baloney or there is something badly
misconfigured.

On 10/2/06, Krainium <krainium@...il.com> wrote:
>
>
> This seems to me to be more of a poor policy configuration.  In Windows
> XP, the policy settings 'Local Policies/' 'Log on locally' and 'Deny
> logon locally' should prevent what this person is claiming (given proper
> policy settings).  They did not identify a specific OS, but I assume
> it's XP.
>
> I haven't tried it, but that's my first impression.
>
>
> > Hi list,
> >
> > recently I came across this link:
> > http://evolvedlight.co.uk/?p=6
> >
> > I searched around but didn't find anything more specific about this,
> > kinda, EoP. Can someone actualy confirm this is working? Any
> > informations would be much appreciated.
> >
> > Thank you.
> >
> > -E.
> >
> >
> > ____________________
> > http://www.email.si/
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/