BugTraq
Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Login as Cached Domain Admin Accounts (2010-M$-002) Dec 10 2010 01:06AM
StenoPlasma @ www.ExploitDevelopment.com (exploitdevelopmentdotcom gmail com) (1 replies)
Re: Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Login as Cached Domain Admin Accounts (2010-M$-002) Dec 10 2010 04:29PM
Stefan Kanthak (stefan kanthak nexgo de) (2 replies)
RE: Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Login as Cached Domain Admin Accounts (2010-M$-002) Dec 10 2010 06:12PM
George Carlson (gcarlson vccs edu) (2 replies)
RE: [Full-disclosure] Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePrivileges and Login as Cached Domain Admin Accounts (2010-M$-002) Dec 11 2010 12:15AM
Thor (Hammer of God) (thor hammerofgod com) (2 replies)
Re: [Full-disclosure] Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Login as Cached Domain Admin Accounts (2010-M$-002) Dec 13 2010 05:12PM
Andrea Lee (andrea kattrap net) (4 replies)
Re: [Full-disclosure] Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Login as Cached Domain Admin Accounts (2010-M$-002) Dec 13 2010 07:32PM
Stefan Kanthak (stefan kanthak nexgo de)
"Andrea Lee" <andrea (at) kattrap (dot) net [email concealed]> wrote:

> I hope I'm not just feeding the troll...

No. You just made a complete fool of yourself.-P
Read the initial post again.
CAREFULLY.
Especially that part about unplugging from the network.

> A local admin is an admin on one system. The domain admin is an admin
> on all systems in the domain, including mission critical Windows
> servers.

Correct so far.

> With temporary domain admin privs,

What are "temporary domain admin privs"?
If you meant to say "cached credentials", just use "cached credentials".

> the local admin could log into the AD

A local admin (or better: a local user account) CAN'T log into the AD.
Only domain user accounts can.

Cached credentials are stored for domain accounts only, and are only
used when the AD is NOT available during login. They are NEVER used to
login to another computer!

> and change permissions / passwords for another user or
> another user, thus getting full admin rights on all systems for a long
> period of time. Plus whatever havoc might be caused by having the
> ability to change rights on fileshares to allow the new domain admin
> to see confidential files..
>
> I would expect that the intent is to use another flaw for a normal
> user to become a local admin, and then jump to domain admin via this.

You got wrong expectations. And: there is no "jump"!

> So yes. In an enterprise environment, the "domain administrator" is "bigger".

GIGO!

Stefan

[ braindead fullquote removed ]

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus