full-disclosure - Re: Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Login as Cached Domain Admin Accounts (2010-M$-002)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 13 Dec 2010 16:34:50 +0100
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: <full-disclosure@...ts.grok.org.uk>
Cc: Jeremy SAINTOT <jeremy.saintot@...il.com>
Subject: Re: Flaw in Microsoft Domain Account Caching
	Allows Local Workstation Admins to Temporarily Escalate
	Privileges and Login as Cached Domain Admin Accounts (2010-M$-002)

"Jeremy SAINTOT" <jeremy.saintot@...il.com> wrote:

> Correct me if I'm wrong, but here is what I think of that :

You are wrong!

> A Domain user that is a Local admin of his workstation is different than 
> a Domain user which is Domain Admin.

A local administrator has all the powers on his computer, while a domain
administrator as all the powers in the domain/AD.
Typically domain administrators are members of the "Administrators" group
too.

> Then, a local admin whose account is an AD account can run scripts *on 
> his local machine* in the name of the domain admin.

Right. The local machine but MUST NOT be able to query the AD, else the
cached credentials are not used.

> This includes the possibility of dumping the Domain Admin password hash 
> and even *all the domain accounts password hashes* (ie: psexec + pwdump 
> against the DC, with the privileges of the domain admin).

WRONG!
Read the OP again. CAREFULLY. The computer needs to be unplugged from the
network.
There is NO POSSIBILITY to access OTHER domain members with cached
credentials.

> An exploitation scenario could be the following for an unprivileged 
> domain user:
> 
> - Become local admin of his workstation (bunch of methods out there)
> - Run script ad the Domain Admin with this technique)
> - Recover Domain admin or Domain Users password hashes.
> - Crack the passwords and become Domain Admin (ie: Administrator of all 
> workstations and servers in the domain).
> 
> My two cents !

That's inflation: 2 cents worth nothing.

Stefan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/