BugTraq
Re: Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePrivileges and Login as Cached Domain Admin Accounts (2010-M$-002) Dec 13 2010 04:20PM
StenoPlasma @ ExploitDevelopment (StenoPlasma exploitdevelopment com) (1 replies)
Stefan,

For you information:

Cached domain accounts on a local system are not stored in the SAM. They
are stored in the SECURITY registry hive. When a cached domain user logs
in to the system, they do not authenticate against the SAM (As you can see
in my article, I am not editing the SAM).

-----------------------------------------------------
StenoPlasma at ExploitDevelopment.com
www.ExploitDevelopment.com
-----------------------------------------------------

-------- Original Message --------
> From: "Stefan Kanthak" <stefan.kanthak (at) nexgo (dot) de [email concealed]>
> Sent: Monday, December 13, 2010 7:53 AM
> To: bugtraq (at) securityfocus (dot) com [email concealed], full-disclosure (at) lists.grok.org (dot) uk [email concealed]
> Subject: Re: Flaw in Microsoft Domain Account CachingAllows Local
Workstation Admins to Temporarily EscalatePrivileges and Login as Cached
Domain Admin Accounts (2010-M$-002)
>
> "George Carlson" <gcarlson (at) vccs (dot) edu [email concealed]> wrote:
>
> > Your objections are mostly true in a normal sense.
>
> And in abnormal sense?
>
> > However, it is not true when Group Policy is taken into account.
>
> Group Policies need an AD. Cached credentials are only used locally,
> for domain accounts, when the computer can't connect to the AD.
>
> > Group Policies differentiate between local and Domain administrators
>
> Local administrators don't authenticate against an AD, they authenticate
> against the local SAM. No GPOs there!
> And: a local administrator can override ANY policy, even exempt the
> computer completely from processing Group Policies.
>
> > and so this
> > vulnerability is problematic for shops that differentiate between
> > desktop support and AD support.
>
> Again: this is NO VULNERABILITY.
> An administrator is an administrator is an administrator.
>
> [braindead fullquote removed ]
>
> Stefan

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus