Full Disclosure: Re: Flaw in Microsoft Domain Account Caching Allows Local Workstation Admins to Temporarily Escalate Privileges and Login as Cached Domain Admin Accounts (2010-M$-002)

["Stefan Kanthak" <stefan.kanthak () nexgo de>]

"Jeremy SAINTOT" <jeremy.saintot () gmail com> wrote:


> Correct me if I'm wrong, but here is what I think of that :
You are wrong!

> A Domain user that is a Local admin of his workstation is different than 
> a Domain user which is Domain Admin.
A local administrator has all the powers on his computer, while a domain
administrator as all the powers in the domain/AD.
Typically domain administrators are members of the "Administrators" group
too.

> Then, a local admin whose account is an AD account can run scripts *on 
> his local machine* in the name of the domain admin.
Right. The local machine but MUST NOT be able to query the AD, else the
cached credentials are not used.

> This includes the possibility of dumping the Domain Admin password hash 
> and even *all the domain accounts password hashes* (ie: psexec + pwdump 
> against the DC, with the privileges of the domain admin).
WRONG!
Read the OP again. CAREFULLY. The computer needs to be unplugged from the
network.
There is NO POSSIBILITY to access OTHER domain members with cached
credentials.

> An exploitation scenario could be the following for an unprivileged 
> domain user:
>
> - Become local admin of his workstation (bunch of methods out there)
> - Run script ad the Domain Admin with this technique)
> - Recover Domain admin or Domain Users password hashes.
> - Crack the passwords and become Domain Admin (ie: Administrator of all 
> workstations and servers in the domain).
>
> My two cents !
That's inflation: 2 cents worth nothing.

Stefan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/