[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePrivileges and Login as Cached Domain Admin Accounts (2010-M$-002)

On 12/13/2010 11:19 AM, Michael Bauer wrote:
An administrator is very different there are many levels of
administrative control in windows to say an admin is an admin is

I disagree. There's only one level of pwned.

There is a big difference between a local admin and a domain

Yes, local vs. network is sometimes a useful distinction.

But joining a machine to the domain gives it a bit more power to attack other stuff on the domain. And how many domain-joined systems do not also include Domain Admins as Local Admins?

There are many types of admin in windows and all of them have
different levels of permission.

I disagree.

I would be very scared to have anyone
taking care of any of my systems windows or NIX who thought an admin
was an admin and root is root.

You ought to be scared anyway.
There's a new local exploit here every few days or weeks.

Here is a reference showing the
different SIDs for some common windows accounts.

If you take time to read it you will see there are numerous types of
windows administrator all with different permissions.

I know MS set out to define all these different capabilities and so on. My impression is that much of that was suggested by Orange Book. But they supposedly obtained this Orange Book certification yet still installed notepad.exe as world-writable by default.

In practice, those distinctions rarely hold up under scrutiny. Remember "Guest User" vs "User" vs "Power User"? MS has greatly de-emphasized the utility of boundaries between privileges them in the OS over time, preferring instead to invent new ones that were more relevant to the times. Witnesseth the recent discussions about the elevation token and IE protected mode.

The best you can hope for is to maintain an effective boundary between normal users and root/admin. But usually as soon as you install a few off-the-shelf Windows or shareware apps, it's gone. Try this: install your favorite "productivity" app in a non-default directory, e.g. C:\, then look at the filesystem permissions on its executable folder (and everywhere it might load DLLs from). Then note that (just a wild guess) it probably runs some dll-preloader and system tray icon processes for everyone who logs in - even Admins.

Even on a pristine OS install, the next local escalation bug is just a matter of time, and that's just the published ones. The bad guys likely have plenty already.

If you're lucky, you might be able to maintain an effective security boundary between a local computer and the network. Don't waste your time trying to protect machines from users who have unsupervised physical access anyway.

- Marsh