Printable View
Greetings everyone! I'm hoping that someone can point me in the right direction to find answers to the following question:
If a user is a member of the local administrator group on a 2000 Server box, what methods might that user employ to elevate their privileges on XP workstations connected to the same network?
TIA
zooligan
First post eh. Be very careful when asking this type of quesiton.
Being very careful would entail giving more information then what is presented. Otherwise it just looks like your're trying to scam something.
In theory, they can't gain access to the domain. However, in practice, they can gain domain rights of anybody who logs on locally (including grabbing their password probably).
So I guess the main attack would be to plant a keylogger then generate some error which encourages the domain administrator to log on locally using their password.
This is a weakness - most domain admins don't think twice about logging on locally to workstations with a domain admin account if there is a problem.
Slarty
Contacting the network administrator is the easiest and safest way based on the info you have given.
**************************************************
First post eh. Be very careful when asking this type of quesiton.
Being very careful would entail giving more information then what is presented. Otherwise it just looks like your're trying to scam something.
**************************************************
Um... yeah. First post.
OK, more info:
I have the pleasure of maintaining a GIS server (the 2000 box mentined above), and at times must allow others local admin access on the box (for installation of software extensions, testing and development of GIS software customizations or standalone programs, etc) and am wondering what methods someone who is a member of the local admin group on this box *might* use to gain rights elsewhere on the network should they choose to do so.
Is that what you meant by more info???
Would the SAM contain domain account information? IF not a key logger would be sneaky.
The reason why more info was needed, is that many people post on this forum with similar posts, and you can never tell if ones intentions are for security reasons or say how to break into a schools computer lab.
Just deny the local account rights on the domain and be don with it
Playing devils advocate here. Are you asking if granting them local admin rights compromises your XP workstations at all?
In principle none, but in practice the keylogger method I showed above. There is a way around this:
1. Educate the domain admins to never log on as a domain admin account anywhere except the domain controllers
2. Enforce this with a policy - deny local logons to anywhere except the domain controllers to the domain admin account(s) - domain admin accounts are only required for domain user administration
3. Give each of your administrators separate accounts for different purposes - encourage them to only log on to them on specific machines - for example, a "normal" account for day-to-day stuff, a "workstation admin" account (which has admin on the workstations) and a "server admin" account with local admin on the servers.
This will cause them a lot of hassle of course. But it's the only way.
Even so, someone logging on locally as an account with local admin rights on *any* other machine in the domain, instantly gives them away to anybody else with local admin rights as soon as they log on.
The only solution that would be totally proper, would be to log on as a local admin account only, and have a different password for every machine. But it'd be terribly inconvenient.
Slarty
*******************************************************
Even so, someone logging on locally as an account with local admin rights on *any* other machine in the domain, instantly gives them away to anybody else with local admin rights as soon as they log on.
*******************************************************
What does this mean, exactly??
Suppose you have two groups, "Workstation admins" and "Server admins", neither of which is in "Domain admins", hence they don't have control over Active Directory; neither of them has admin rights on any domain controller, and neither of which has admin privileges on the other group's machines.
If a workstation admin ever logs into a server, or vice versa, then that group can potentially gain the others' passwords. This is because, with local admin rights, you can take control of a machine remotely and use the other users' permission to do whatever your want.
Slarty
hey zooligan - you wouldn't happen to be in Atlanta would you?
another way... i'm not gonna go into details is to install a script/batch to run at startup which will automatically add an user into to domain admin group given that it is run while authorised person is logged in.