Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: Thor (Hammer of God) (thorhammerofgod.com)
Date: Fri Dec 10 2010 - 09:56:29 CST
Hey Jeff - StenoPlasma and I took the conversation off-line, and I'm clear about what he is illustrating.
As far as the local machine is concerned, there is no difference between the local admin and the domain admin or any other admin in the Administrators group. The paper illustrates how one admin can pretend to be another admin by masquerading as his SID. Of course, the admin could masquerade as a normal user too, but there's no point in that. That said, there's no point in one admin pretending to be another admin. There is no down-range network access to this, and as StenoPlasma pointed out, you have to have the network cable unplugged to do this.
Not taking away from SP's find, but at the end of the day, this doesn't allow an administrator to do anything he couldn't already do. If repudiation is the concern, the one admin can simply create another admin user, log in as them, and do whatever they want logging activities as that user.
I've been counting, and now this is 1 million four: If it starts with "If I'm admin..." then what comes next doesn't matter.
From: Jeffrey Walton [mailto:noloadergmail.com]
Sent: Friday, December 10, 2010 6:38 AM
To: Thor (Hammer of God)
Cc: StenoPlasmaexploitdevelopment.com; full-disclosurelists.grok.org.uk
Subject: Re: [Full-disclosure] Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Login as Cached Domain Admin Accounts (2010-M$-002)
On Thu, Dec 9, 2010 at 10:07 PM, Thor (Hammer of God) <thorhammerofgod.com> wrote:
> What do you mean by "regular local administrator"? You're a local
> admin, or you're not.
I believe the OP's intent was to differentiate between Local Administrators and Domain (or Enterprise) Administrators. Corrections from StenoPlasma are welcomed.
> There are not degrees of local admin.
But there are different accounts, both domain and local, which have administrator rights and privileges on the local machine.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/