WinXP recovery console... again

Just read an article here.

Quote:

---

Windows XP, which has been marketed by Microsoft as "the most secure version ever," has been found to have a flaw so bone-headed that it renders passwords ineffective as a means of keeping people out of your PC.

Reader Tony DeMartino alerted me to the problem, which all administrators of Windows XP machines should immediately take to heart:
Anyone with a Windows 2000 CD can boot up a Windows XP box and start the Windows 2000 Recovery Console, a troubleshooting program.

Windows XP then allows the visitor to operate as Administrator without a password, even if the Administrator account has a strong password.

The visitor can also operate in any of the other user accounts that may be present on the XP machine, even if those accounts have passwords.

Unbelievably, the visitor can copy files from the hard disk to a floppy disk or other removable media - something even an Administrator is normally prevented from doing when using the Recovery Console.

---

Funny... I found this out by mistake several months ago and started a thread about it.
See the thread here.

Nice info Phish!!

That can be informative to my understanding of XP.
M$ should throw away Winbloze and work on a *nix OS.
haha! - that will never happen

i cant believe i missed that post phish thats really a great find. could be very usefull.

although you probably know this by now you can use dos style truncation to navigate the directories:

My Documents == mydocu~1

the first six characters then "~1" if two directories share the first six letters than the second in alphabetical order would be ??????~2 etc

Tedob1:

Yeah, i figured that out now how to move around in command prompt better. I had tried many of those variations of commands and some of them worked. I just posted that too early before doing some more playing around.

I did some more testing after I found that little trick out.

Normally you can't copy/delete/move/copy etc. in recovery console.... even as admin, but using 2k boot disks you can do all those in XP.

What happened originally was I renamed my admin account and the XP recovery console doesn't let you specify the UID you are logging in with... it automatically chooses ADMINISTRATOR.

If you don't have an ADMINISTRATOR account (like me, I renamed it to JOEUSER) you are SOL... unless you have 2k disks handy ;)

I don't think many people who responded to my original post realized what I was trying to say. Never thought to report it... but whatever. I just thought it was cool that I found a security bug in XP! ;) Since then I'm always trying little things to get around securty... but have only found a couple more things.

This is one I can't find a fix for though.... unless you disable booting from floppy and cdrom, which most of my PCs are setup that way anyhow.

Hey Phish, did you find out if there is a fix for that, or if they are working on it?

AciDriveHB: I'm not sure if there is a fix.

The way I fixed it was to disable letting users boot to floppy and cdrom.

You do that in the bios. You can set the options you want and password protect it so anyone without the bios password can't change your options.

Even if someone had a bios password cracker, which would need floppy boot access anyway... I have little locks on the back of PCs that also have a tie wrap through them so I know if the box has been opened. This helps prevent people from pulling the bios battery which will reset the passwords and set the bios to default settings.

i definitly have to follow your posts more closely!

too bad you didn't get the recogognition for it. it might look good on a resume.

Quote:

---

too bad you didn't get the recogognition for it. it might look good on a resume.

---

Tedob1:

I just emailed the guy who reported it... so maybe I can get recogongnition for it after all! ;) That'd be cool!

Knowing my luck... I'll get hauled into court in violation of the DMCA!... that would suck... all for troubleshooting! lol

I just checked the MS site. No KB article and no acknowledgment of the issue yet.

Get ready, a hotfix should be on the way sometime next week! :-)

Quote:

---

Get ready, a hotfix should be on the way sometime next week! :-)

---

Nah, they'll save that one for their next 150mb service pack... ;)
It'll only take 11hrs for dial up users do download, so the systems will still go unpatched.

They prolly figure that if you aren't watching who has physical access to your machines... its your fault. Even though it is their screwup.

Anyone with physical access could easily just pull the HD, make a copy and it might just be less work than messing with boot disks and copying to single floppys. Then they'd have all the time they wanted to search the HD... not a few min... thats what video/web cameras are good for.

LOL phish,

As I'm sitting here, I'm actually testing the exploit and it sure as hell works! Well, looks like we have to block booting not only with floppys but now with CDs!

Good grab!

Phish, I have all my machines boot straight to the main HD and nothing else anyways because of speed preformance. Plus to add, I don't want anyone being able to figure out a way around my security, and I guess I've been ahead of my time for years... I knew something like this had to be possible.

And yeah, who wants to download hotfixes like that? Though I'm surprised they won't just wait and put it in another Service Pack that will only be good for screwing up your computer and giving you a reason to format. Or say they aren't going to really worry about it because Xp Second Edition will be out shortly ;-)

How daft can you get... This is NOT a bug in M$ software (for a change)

Although many people don't seem to understand it, if someone can get physical access to boot off another medium, they don't need your administrator password to do *ANYTHING* !

Even things that the lame XP recovery console doesn't let you do, you can *STILL DO* with the right tools.

It is not a bug for them to let you do this, indeed, they cannot prevent it. There is at least one Linux boot disc that will let you recover an NT/2000 administrator password (+ many commercial tools)

slarty, I believe Phish has stated that he does NOT allow booting to any other media. If the Admin account has a password, and Recovery Console will allow you to use the Admin account WITHOUT a password, this is a bug!

Cheers,
vegas

If the administrator was smart and didnt want the users to have high access they would just take the cdrom out of the boot path and put a password on the bios... also the a: out aswell stopping using programs like the linux boot disk that changes passwords (cant remember name) - also bluecon will give the user the ability to change passwords aswell if the cd is able to be booted

so really i would just take the cdrom and floppy out of the boot path and password the bios.. only the administrator needs to access it

[edit] this was already mentioned above but it is still useful info and there is some extra .. my bad [/edit]

I am not sure how some of your companies are setup but the last company I did contract work didnt have network admins at most of the sites. All the server work and maintenance was done remotely via dameware or remote desktop. if the server was shutdown, they had lights out boards. What I did notice though was that every server was provided with a key on it, locked in front and back... there was a security camera at the top to see who was playing with the thing and when....yet as I went to more sights I began to notice server rooms were left unlocked (shared as the printer room, go figure). Some servers were out in hallways.. Then to top it off many had their servers unlocked cause it was more convienent when they had to replace the backup tapes (all they had to do was replace tapes daily). The reason i go on about this is because even though boot options were set to only boot from hard drive, and permissions for bios were inherently taken from the AD settings and couldnt be changed. If someone didnt have it setup like this, there is no bios password because most ppl dont set it on a server, all you have to do is reboot change options and reboot again. now you can use whatever exploit you need to do what you want. so in short great find. something to be on the lookout for.

-if someone wants into something badly enough they will find a way into your mighty castle...(ex. The big wooden trojan horse)

a lot of people wont want into something really badly they will just accidently stumble accross things from doing stuff of which they have no idea of what they are doing.. it is impossible to secure something 100% but u can secure something from people who dont really know much.

Or they will want into something and just give up after it is too hard or they dont succeed the first time.

(This is in my experience)