[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Windows 7/8 admin account installation password stored in the clear in LSA Secrets


I've often found this behaviour during security assessments for corporate Clients.

It should indeed be considered a vulnerability, especially in enterprise scenarios where for instance it can be leveraged by a regular notebook user to escalate privileges and be able to access all other corporate user's notebooks (including their bosses';).



On Thu, 11 Jul 2013, Dnegel X. wrote:

1. I didn't find an explanation about this behavior that deals with
installation password, although this LSA Secret is well known to
contain passwords, mainly from Windows XP era. Could you provide a
It also hasn't been fixed in Window 8 released this year.
2. You could e.g. retrieve a password from one vulnerable machine
(where physical access or admin shell is possible) and use it against
more secure ones sharing same admin password, typically when a Windows
image is replicated over a network to multiple machines.

Anyhow, having a cleartext password residue somewhere without
documentation looks like a sad bug to me.


On Thu, Jul 11, 2013 at 7:35 PM, Rob <synja@xxxxxxxxxxxxxxxxx> wrote:
Two things:
1. This was made public sometime in 2012 or earlier IIRC.
2. Exploiting this requires the same permission levels that would be
required to change or access the password anyway. Where's the realistic
security threat?


Marco Ivaldi                          OPSA, OPST, OWSE, QSA, ASV
Senior Security Advisor
@ Mediaservice.net Srl                Tel: +39-011-32.72.100
Via Santorelli, 15                    Fax: +39-011-32.46.497
10095 Grugliasco (TO) - ITALY         http://www.mediaservice.net/
PGP Key - https://keys.mediaservice.net/m_ivaldi.asc