bugtraq - Re: Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePrivileges and Login as Cached Domain Admin Accounts (2010-M$-002)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5590d579$6aae304c$1b76e6fd$@com>
Date: Mon, 13 Dec 2010 08:20:21 -0800
From: "StenoPlasma @ ExploitDevelopment" <StenoPlasma@...loitdevelopment.com>
To: "Stefan Kanthak" <stefan.kanthak@...go.de>,
	<bugtraq@...urityfocus.com>, <full-disclosure@...ts.grok.org.uk>
Cc: "George Carlson" <gcarlson@...s.edu>
Subject: Re: Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePrivileges and Login as Cached Domain Admin Accounts (2010-M$-002)

Stefan,

For you information:

Cached domain accounts on a local system are not stored in the SAM.  They 
are stored in the SECURITY registry hive.  When a cached domain user logs 
in to the system, they do not authenticate against the SAM (As you can see 
in my article, I am not editing the SAM).  

-----------------------------------------------------
StenoPlasma at ExploitDevelopment.com  
www.ExploitDevelopment.com
-----------------------------------------------------

-------- Original Message --------
> From: "Stefan Kanthak" <stefan.kanthak@...go.de>
> Sent: Monday, December 13, 2010 7:53 AM
> To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
> Subject: Re: Flaw in Microsoft Domain Account CachingAllows Local 
Workstation Admins to Temporarily EscalatePrivileges and Login as Cached 
Domain Admin Accounts (2010-M$-002)
> 
> "George Carlson" <gcarlson@...s.edu> wrote:
> 
> > Your objections are mostly true in a normal sense.
> 
> And in abnormal sense?
> 
> > However, it is not true when Group Policy is taken into account.
> 
> Group Policies need an AD. Cached credentials are only used locally,
> for domain accounts, when the computer can't connect to the AD.
> 
> > Group Policies differentiate between local and Domain administrators
> 
> Local administrators don't authenticate against an AD, they authenticate
> against the local SAM. No GPOs there!
> And: a local administrator can override ANY policy, even exempt the
> computer completely from processing Group Policies.
> 
> > and so this
> > vulnerability is problematic for shops that differentiate between
> > desktop support and AD support.
> 
> Again: this is NO VULNERABILITY.
> An administrator is an administrator is an administrator.
> 
> [braindead fullquote removed ]
> 
> Stefan