bypassing win2k security.

Hi, I am requesting some help.

My company doesnt want some of my lower-level techs to have access to admin rights on company computers.

So I must find a way to install a device (such as a camera, etc.) on a windows 2000 pro box that doesnt have admin access rights. (in other words the user isnt conventionally aloud to install using the device manager) Now I heard rumors of a program called "DMC" that allows you to install devices to win2k from the command prompt. (I will probably need to create a custom installer for every device) If I dont figure this out im TOAST! Anyone who can tell me how to do this.. i will be in dept to you. (probably send ya $100)

Ill be checking on this forum constantly

Help me guys!!!!!


--The EvilSeed!!

Well, a little more info as to what you mean by "install a device" might be usefull in helping you.

If you only mean loading drivers, you can modify who is allowed to do so in the security policies (Control panel -> local security settings -> security settings -> local policies -> user rights assignments -> Load and unload device drivers

These settings can also be distributed via group policies in active directory if you use it.

As for other options, like I said, a better explanation of you current setup would be usefull:
Running win2k servers?
running active directory?
What kind of "administrative capabilities" do you want to delegate?
What do you mean exactly by "installing devices"?

Ammo

Why not just ask the Admin for rights?!?! Problem solved. If you already have admin rights, install the hardware for the lower-level techs and you won't have to worry about given them any more access.

AJ

Can't see a problem, ES, if nobody else answers your question i'll be back tomorrow after i find a new wheel seal for my boat trailer, but am too tired tonight. If you control the system, you got no problem. Don't be toast. :D

Nt4 servers running the domains PDC and BDC.. win2kpro workstations.
Now lets say I need to walk up to one of the workstations and install a program (photoshop), or a device (such as a digital camera, or a scanner) now I know the RUNAS command can update drivers. And I know i could SU admin rights temporarily (using a installer or something), but that would leave the system to big of a security hole I am told. So I need to find out how I can do this. And no I am unable to change the users profiles. I manage lowerlevel techs and helpdesk. So i need to find a workaround. Like I said before someone told me of a program called DMC if you find out what all registry keys and files a out of the box installer does then u can use DMC to do it. I dont know but its a rumor ive heard.. please guys.. help me figure this one out.

I dont think we have active directory.

How would loading using the "as user" setting leave a security hole. Once you are finished you quit being that account. Then you are returned to a lower level of access. So the camera can be used by the account but it cannot be reloaded, troubleshot etc. The only way this leaves a hole is if you have to tell the user what the password is.

So you can either go to the machine and set it up yourself or use a remote access tool (PC Anywhere is the most common) to take control of their machine remotely, put in the password which is encrypted and make the changes then make sure they are returned to their lower security level and the device works for them.

Now if the problem is that you or your techs are not going to be granted these privileges then the real problem is with the overall policies. Your "higher level techs" could easily set your team up a user account that allows you enough access to load the drivers without giving you full admin privileges. Win2K pro has a ton of tweakable security settings (be very careful of deny settings). If they are unwilling to do this then the problem is not with the method to accomplish this but the support you are receiving for your team. In that case you might want to take this to management and try to explain to them, in small words with lots of pictures, why you cannot install software and hardware without the proper permissions.

One final thing, if you do not have the permissions in the windows arena a DOS tool will still not be able to modify the registery or write the proper drivers to the proper locations. Win2K is not built on a DOS shell the same way the Win9x was. DOS runs as a shell over the NT kernel and therefore permissions in the NT kernal are inherently obeyed by the DOS shell.

Moca is right evil seed. It will not leave a security hole if you use the "run as" option to install the hardware/software under your credentials, provided you have the proper rights to the local machine. Just don't let the user see your password when you execute the command - this is obvious, of course. You may, however, again, as Moca already stated, have a problem with the level of support that you are receiving from the various higher-ups in your company/department if this is not the problem.

Quote:

---

I dont think we have active directory.

---

Active directory will only work on a win2k controlled network!
As for the run as, just watch out for keyloggers!

Quote:

---

Originally posted here by DeadCr0w

As for the run as, just watch out for keyloggers!

---

Just as info ! Keyloggers are not always software made ! Check for hardware keyloggers to !

(man... I sure don't thrust users... !!!)

Got to thinking about this later last night.... Seems to me this "problem" should belong to the senior SysOp, not the help-desk / lower-level-tech personnel supervisor. Unless the upper-level techies and bosses have promoted themselves beyond their capabilities and trying to blame problems on a mid-level worker. Or..... Nawwwww, this ain't just a cleverly worded question from someone trying to figure out how to get admin rights, or find a rogue program to bypass the W2K security levels. (there, just slapped my keyboard hands for even thinking of that!) :)

is it true your re-starting IHG?

Couple of points to ponder/consider regarding the runas command and group policy...

EvilSeed stated that the network has NT4 servers as the PDC and BDC...which would remove active directory from the overall environment. This would also limit the amount of security policy settings available to restrict rights to certain groups of individuals on what they can and cannot do in the domain(s).

The "runas" command only runs in the current context of the person who is using it. How that could be construed as a security hole, I would like to see the proof of exploit. Now, the question becomes how much you need to limit the rights of low-level techs in the domain. If you know the machine name (NetBIOS name), why not restrict them to logging in just to those machines as administrator (or another name with admin rights) until the device installation is completed? Set up a temporary admin account that can only log into the machine locally, then delete the account from the SAM once the installs have been completed?

In the absence of a fully-integrated ADS network, using a temporary local admin acount may be the easiest overall solution.

Well, I had a look quickly for runas exploits/flaws, and found 2 of them...

Quote:

---

The "runas" command only runs in the current context of the person who is using it

---

Maybe, but as stated in this flaw documentation,

Quote:

---

After the RunAs utility has terminated, the user credentials supplied to execute the command are still stored (in cleartext) in memory.

---

Since the page file is only removed on a restart/shutdown AFAIK, not a logout/logoff, if the general user logs in afterwards, they could get the credentials used issued on the last use of RunAs, providing it was paged to disk and they can find it..


So, I'd say that's a way that using runas could open up a security hole.....

I found another one, but wasn't interested enough to actually go through it....
http://www.securitytracker.com/alert...v/1002731.html

You can get programs that elevate your priverliges in windoz such as getadmin, which get be downloaded of antionline.
I have also read once that you can delete the login script in the win32 folder, and on restart a little menu starts up and you can add yourself to the admin list....but thats sounds 2 easy.
also if you cant get to win32 or the system folder, you can open a shell of it through word by opening windows explorer at c:/winnt/win32. thats done in the immediate window of the macro editor. In win32 you can edit some of the priveliges if there isnt much security or if its badly set up.

Well guys this is what I tried to do. I tried to make a program (in visual basic) that my lower level techs could click on and it would bring up the runas /:user administrator and an directory they typed in.. now I tried putting the password for the administrator account as an argument in the command line. But RunAs will not allow this. So I went to microsofts website and downloaded the SU program for windows2k. (works the same as the XP and Linux vers.) so I tried to SU to administrator the same way I did with RunAs. The problem with that being that it was well doesnt allow you to put the password as a argument in the command line. The nice thing is that when you do a Winexec api call in VB you do not see the command line parameters, I know that is a stupid thing.. but I am not exactly trying to hide the password from a buncha hackers. .. Anyways I am back against a wall here again.. the inability to put the password as an argument has really got me. I tried doing findwindow api calls and having vb write the password in the command prompts password prompt, but thats just a tad beyond my skill since I have only been in vb for like a week.

Well guys im going to try your lil hacks you posted, and see what I can do with them. And Yes I am the IHG guy.. and some old members would like to pull IHG back together.. I will write another topic about this after I resolve this issue. And maybe, just maybe we will pull IHG back together and get back to hacking.

Thanks guys!