Re: Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePrivileges and Login as Cached Domain Admin Accounts (2010-M$-002)

From: StenoPlasma @ ExploitDevelopment <StenoPlasma@exploitdevelopment.com>
To: Stefan Kanthak <stefan.kanthak@nexgo.de>,bugtraq@securityfocus.com,full-disclosure@lists.grok.org.uk
Cc: George Carlson <gcarlson@vccs.edu>
Subject: Re: Flaw in Microsoft Domain Account CachingAllows Local Workstation Admins to Temporarily EscalatePrivileges and Login as Cached Domain Admin Accounts (2010-M$-002)
Date:


Stefan,

For you information:

Cached domain accounts on a local system are not stored in the SAM.  They 
are stored in the SECURITY registry hive.  When a cached domain user logs 
in to the system, they do not authenticate against the SAM (As you can see 
in my article, I am not editing the SAM).  

-----------------------------------------------------
StenoPlasma at ExploitDevelopment.com  
www.ExploitDevelopment.com
-----------------------------------------------------

-------- Original Message --------
> From: "Stefan Kanthak" <stefan.kanthak@nexgo.de>
> Sent: Monday, December 13, 2010 7:53 AM
> To: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
> Subject: Re: Flaw in Microsoft Domain Account CachingAllows Local 
Workstation Admins to Temporarily EscalatePrivileges and Login as Cached 
Domain Admin Accounts (2010-M$-002)
> 
> "George Carlson" <gcarlson@vccs.edu> wrote:
> 
> > Your objections are mostly true in a normal sense.
> 
> And in abnormal sense?
> 
> > However, it is not true when Group Policy is taken into account.
> 
> Group Policies need an AD. Cached credentials are only used locally,
> for domain accounts, when the computer can't connect to the AD.
> 
> > Group Policies differentiate between local and Domain administrators
> 
> Local administrators don't authenticate against an AD, they authenticate
> against the local SAM. No GPOs there!
> And: a local administrator can override ANY policy, even exempt the
> computer completely from processing Group Policies.
> 
> > and so this
> > vulnerability is problematic for shops that differentiate between
> > desktop support and AD support.
> 
> Again: this is NO VULNERABILITY.
> An administrator is an administrator is an administrator.
> 
> [braindead fullquote removed ]
> 
> Stefan 







Copyright © 1995-2018 LinuxRocket.net. All rights reserved.