full-disclosure - Re: Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily Escalate Privileges andLogin as Cached Domain Admin Accounts (2010-M$-002)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <B086F0AB80574C54BA010D8102827D53@Bonaventure>
Date: Mon, 13 Dec 2010 10:15:35 -0800
From: "David Gillett" <gillettdavid@...a.edu>
To: "'Thor \(Hammer of God\)'" <thor@...merofgod.com>,
	"'George Carlson'" <gcarlson@...s.edu>, <bugtraq@...urityfocus.com>,
	<full-disclosure@...ts.grok.org.uk>
Subject: Re: Flaw in Microsoft Domain Account
	CachingAllows	Local Workstation Admins to Temporarily
	Escalate	Privileges	andLogin as Cached Domain Admin Accounts
	(2010-M$-002)

> If I take the domain admin out of my local administrators, they can't do
anything.  Done.

  Back when I did AD/domain support, all domain user accounts got a profile
that included a trivial script to re-add Domain Admins to the Local Admins
group.  So this kind of local removal shenanigans lasted only until the user
next logged into the domain.

David Gillett

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/