windows privilege escalation?

i was in the computer lab at my school today and i noticed that a few of the computers had not been logged off, so i went to log them off and noticed that several of them had a different background. when i looked into it further, i noticed that all of the accounts with different backgrounds were regular student accounts and that they had full admin privileges, which they definitelyshouldnt have had. i think it's safe to assume that they ran some sort of program that did it for them, i'd just like to find out what it was and how it worked, i'm guessing it was some popular windows rootkit or something, can somebody maybe give me their opinion on what they think it was and what i should do about it?(i've got all their account names ;)). the compromised boxes were running windows xp professional SP1 and i'm pretty sure all of their security measures were done with poledit.

How do you know they had 'full admin' privs?

tell your administrator, definatly, and maybe do a google search for privilage rootkits or something like that.

What it could have been is the may have been just logged in as the local computer administrator so they could install some new programs or whatever but were not logged in as the domain admin.

I would say, check out this thread:

http://www.antionline.com/showthread...hreadid=265821

Jareds411 had a similar problem as you, and the recommendation was to alert your admin anonymously.

good luck,
-ik

Ok, Honestly if I were still in school (its been a few millenium since I was) I would be tempted to keep this under my hat, and see what I could do with the "admin" accounts.

But most likely that won't get you anywhere you wanna go.

I personally wouldn't worry too much about just straight out informing the admin of what you observed. In most cases being straight forward about something like this, in a tactful way will be respected by any admin with half a brain. If I was your admin, I would want to see, and would be interested in knowing how my security was bypassed, not shoot the messanger... :)

Of course you can try the email or letter to him/her without ever giving up who you are... I just dont see the point.

:)

I very much doubt they used poledit..... That was pre Win2k...

I think you meant the LSP or the GP, (Local Security Policy or Group policy). If they managed to use group policy your admin is... er.... screwed... because they would require domain admin rights to do that.... and student with domain admin rights invariably has better grades than their actual work would imply.... ;)

Send your admin a script in a suitably socially engineered email that adds a user to the AD with Domain admin rights and you'll find out 2 things:-

1. Admin is a dumbass that reads email in the context of a domain admin, (I'm guilty of this...)

2. Admin is silly enough to be socially engineered into clicking an attachment or link, (I'm not guilty of this..)

If he's really stupid he won't be able to work out what you did.... :rolleyes:

If he's smart he'll slap you upside the head and tell you to "try and be creative".... :D

I highly doubt that any student got admin privledges and then forgot to log out. Some schools have students that are good with networks and computers help out the school system admin for voluntary credits, because that's a requirment to get into alot of colleges. So the system admin gives them some more priveldges on their accounts to make helping out easier. That's just what goes on in my school anyway, I'm guessing the same goes on in yours and many others...

well, i'm positive that the student accounts aren't supposed to have those privileges. they arent't like administrator privs like the school network admins would have, they just have the privileges to do whatever they want on that machine locally. they can read/write anywhere, run regedit, change the background, install things, etc. i know that there isnt any way that they got these privs legitimagely either.

well, i'm positive that the student accounts aren't supposed to have those privileges. they arent't like administrator privs like the school network admins would have, they just have the privileges to do whatever they want on that machine locally. they can read/write anywhere, run regedit, change the background, install things. i know there isnt any way that they would have gotten these privs legitimately. i dunno what to search on google, i've tried windows rootkits and several other things, i expect that there's some well known program that they used for it, but maybe not... how else could they have done it?

Quote:

---

Originally posted here by slinky2004
well, i'm positive that the student accounts aren't supposed to have those privileges. they arent't like administrator privs like the school network admins would have, they just have the privileges to do whatever they want on that machine locally. they can read/write anywhere, run regedit, change the background, install things, etc. i know that there isnt any way that they got these privs legitimagely either.

---

Actually, there's a very good chance they got those legitimately. Users at my school have the same rights, although they aren't admin accounts. Chances are you have another lazy admin.

It is a pretty good chance they got it legitimatly, admins give a certain amount of computer savvy and trustworthy students higher priveledges to help the admin do certain stuff like install patches for certain software on certain machines, and in return the students get volunteer credits...

actually, all of the accounts belonged to freshmen, so either the admin hasnt locked the freshmen's accts up or the some of the freshmen got together hacked the computers they were on. i guess there's an equal chance of both.

If they didn't get admin privileges from the admin then they probably just went to cmd and typed in:
at /00:00 /i taskmgr (fill in 00:00 with a time coming up soon)
once taskmgr opened, killed explorer and opened another with system privileges for that machine
I believe White Scorpion was first to point out this privilege escalation method.

As for what to do about it, you could try just talking to the admin, they may not even believe you or they may freak out, but if they didn't give them admin they will definitely want to know about it.

It really doesn't matter how the admin privs got there. What really matters is that you changed the password and kept the admin capable account for yourself... right? :D lol jk...

I have local admin access to every PC. I help out around the school with tech issues. There are two ways I think they could have done it.

1) If you logon as local administrator, you can add domain users to the local admin group (assuming the domain didn't disable that, ours did).

or:

2) On that PC, they created a new user with their name and gave themselves admin priviledges. They used their name because the username shows on the XP start menu and they wouldn't want a faculty member noticing...either way, they got the local admin accounts.

They could have gotten local admin accounts by being a Tech Team member or something...or they took the SAM files home and cracked them with Lopht Crack (http://www.atstake.com/products/lc/) or Cain 2.0(www.oxid.it).
There is a nice SAM editor I have. You can change the admin password, and create accounts..all via a Linux bootdisk with a command prompt.

Hope this helps.

A_T

PS - Why do anything about it? Blackmale the little bastards into giving you the password.

yeah, i guess they could have cracked it that way, but it's starting to seem alot more likely that the admin forgot to lock the comps for the new freshmen accounts, lol.

Quote:

---

PS - Why do anything about it? Blackmale the little bastards into giving you the password.

---

Cuz I wear teh white hat ;)

Quote:

---

It is a pretty good chance they got it legitimatly, admins give a certain amount of computer savvy and trustworthy students higher priveledges to help the admin do certain stuff like install patches for certain software on certain machines, and in return the students get volunteer credits...

---

*raises hand* guilty.

Really, just say 'mr. admin, why did i find accounts with admin privilages that students were using?' It may be legitimate, but ask, just to be sure.

Two other possibilities:

1. There is some app on those computers that needs admin level access to run (or the admin is too lazy to figure out the correct minimal file permissions).

2. The used a Linux or PE Builder boot disk and change the administrator password, then added their account to the local admins group:
net localgroup administrators myaccount /add

3. if they just copied of the SAM and SYSTEM file and cracked it using SAMInside and L0phtcrack then could find out the admin password on one computer, and set them selves up to be admins on other boxes remotely after connecting to a file share on them as admin (hope that made sense):

at \\Some-school-box 11:51am net localgroup administrators myaccount /add

Quote:

---

If they didn't get admin privileges from the admin then they probably just went to cmd and typed in:
at /00:00 /i taskmgr (fill in 00:00 with a time coming up soon)
once taskmgr opened, killed explorer and opened another with system privileges for that machine
I believe White Scorpion was first to point out this privilege escalation method.

---

This would only run if the admin is implementing very poor security on the box. If they can run this command, there are many many additional ways to escalate privilages. Allowing end users to perform administrative tasks such as TASKMGR is an absolute no no.

Also. It is hard to say how they got root. It could be as easy as booting the NTpassword crack floppy or it could be more complex such as sniffing NTLM sessions then running l0pht or the like against the collected hashes.

If you ask me, this sounds like piss poor administration is your real issue, not the security incident.

PS

The command wont run as written.

It should be:
C:\AT 00:00 /i taskmgr

The extra "/" will hose up the command. ;)

sounds like lazy lazy admin(s). we got them everywhere.

can't be arsed to do the job properly - so they just setup a half-assed job, patch it and forget about it.

those types of admins are a crackers best friend. you just scope them out and their systems and then go "shopping in a candy store" so to speak.

don't say anything.

:-)

Jebo:

You are proving yourself to be a complete and utter idiot....

Quote:

---

you just scope them out and their systems and then go "shopping in a candy store" so to speak.

---

This is not a piss-ass little script kiddie site. I just negged you so I can't neg you again for your dumbass, unethical attitude... Wish that I could...

Ladies and gentlemen:

This is a "BAM"

I love cooking....

BAM

There you go Tiger ;)

MLF

Quote:

---

Originally posted here by Jebo Majku
don't say anything.

---

Squee-San No you do say something like BAM BAM-BAM!

Quote:

---

Originally posted here by Tiger Shark
Jebo:

You are proving yourself to be a complete and utter idiot....

This is not a piss-ass little script kiddie site. I just negged you so I can't neg you again for your dumbass, unethical attitude... Wish that I could...

---

I felt sorry for him earlier. After reading a couple of his posts, that feeling disappeared. So with that said... nice post! /insert smiley with big grin and thums up.

Quote:

---

Originally posted here by Tiger Shark
Jebo:

You are proving yourself to be a complete and utter idiot....

This is not a piss-ass little script kiddie site. I just negged you so I can't neg you again for your dumbass, unethical attitude... Wish that I could...

Ladies and gentlemen:

This is a "BAM"

I love cooking....

---

yikes. it's just not my day in popularityville.

it's not about script kiddies - it's about, "if you are incompetent - why should *I* help *YOU"!. i don't believe in "us techs stick together"! i believe in "everyone pulls their own weight". too many tech's these days don't give a cr@p and just prefer coasting for their pay cheque. you have equipment and users you are responsible for - learn to keep on your toes and secure & maintain it properly. you have eyes. you have a brain. use it!

if you are not very organized. learn to *become* organized. you want a helpful post - here:

best security advice I picked up in last 5 years was,

The security manager's daily checklist and the accompanying matrix

modify it to your own environment and use it!

if you jump in and keep helping them along - they will always expect another tech to come by and keep helping them.

Quote:

---

it's not about script kiddies - it's about, "if you are incompetent - why should *I* help *YOU"!. i don't believe in "us techs stick together"! i believe in "everyone pulls their own weight". too many tech's these days don't give a cr@p and just prefer coasting for their pay cheque. you have equipment and users you are responsible for - learn to keep on your toes and secure & maintain it properly. you have eyes. you have a brain. use it!

---

If this is your position, then why this?

Quote:

---

you just scope them out and their systems and then go "shopping in a candy store" so to speak.

don't say anything.

:-)

---

Perception is reality. I think you should learn to communicate a little better before posting. Start there and then worry about bad admins. While I didn't "BAM" you this time, if you continue to annoy us with posts like this, I will deliver a special one just for you.



--TH13

Well, I am not going to BAM him for two reasons:

1) It is very entertaining reading the responses his posts generate ;)

2) I think what we have here is a disgruntled employee ... Maybe someone who thinks they deserve more recognition or a promotion which they did not receive. They are burned out and sour on life.

To the second, all I can suggest is find contentment in doing your job the best you can.
Nobody is saying you have to help everybody, only those who you can, when you can, and when they are willing to listen. With the right attitude you can turn those “ lazy “ admins around and inspire them ( or shame them ) into productive aggressive workers.

Helping people ( but not necessarily sticking your nose where it doesn’t belong, you’ll have to learn the difference ) not only helps them but can help you. It helps you learn, makes your job easier, and can earn you respect from your peers. Some day one of those people you left hanging because you felt they were incompetent may be your boss.

Wouldn’t it be nice if they had respect for you?

Quote:

---

Originally posted here by IKnowNot
Well, I am not going to BAM him for two reasons:

1) It is very entertaining reading the responses his posts generate ;)

2) I think what we have here is a disgruntled employee ... Maybe someone who thinks they deserve more recognition or a promotion which they did not receive. They are burned out and sour on life.

To the second, all I can suggest is find contentment in doing your job the best you can.
Nobody is saying you have to help everybody, only those who you can, when you can, and when they are willing to listen. With the right attitude you can turn those “ lazy “ admins around and inspire them ( or shame them ) into productive aggressive workers.

Helping people ( but not necessarily sticking your nose where it doesn’t belong, you’ll have to learn the difference ) not only helps them but can help you. It helps you learn, makes your job easier, and can earn you respect from your peers. Some day one of those people you left hanging because you felt they were incompetent may be your boss.

Wouldn’t it be nice if they had respect for you?

---

good post. and you are absolutely right - i am pretty disgruntled and not very happy with how IT is progressing. too many business suits/sales guys infiltrating IT who think you don't have to know that much about IT to do IT anymore. nuff said!

back on topic. i am very shocked at the reponses as well.

I will go out of my way to help another IT guy if I see the following:
a) - if he/she asks for help. re: security matters - i don't scan other peoples networks for holes! we have a very capable security dept. whos job it is to do that for the whole campus, and they do a great job doing it.
b) - a real genuine problem that is worth my time. not something that can be solved by looking at the first page results of a google search or by reading the FAQ of the manual.
c) - i will be even more willing and available if I see that the person made a genuine effort to solve the problem on his/her own. if they actually detail what they did so far and how they have come up short. posting a question on a forum and waiting for people to respond does not count as an effort.

Quote:

---

Originally posted here by thehorse13
If this is your position, then why this?




Perception is reality. I think you should learn to communicate a little better before posting. Start there and then worry about bad admins. While I didn't "BAM" you this time, if you continue to annoy us with posts like this, I will deliver a special one just for you.



--TH13

---

i can see how you can interpret that from my post. i got to learn to use smileys more often. i think i may have meant it in a sarcastic manner when I posted it.

Quote:

---

Originally posted here by Jebo Majku
i can see how you can interpret that from my post. i got to learn to use smileys more often. i think i may have meant it in a sarcastic manner when I posted it.

---

That's what I assumed (sarcastic mode = on) when I read your post. My english must be worse than average... :confused:

But then, this is AO. Shoot first ask later behaviour has been proven to get rid of idiots effectively. :D Never done it myself though ("Warning: insufficient ammo to kill enemy"). And how we define idiots might be debatable. Sometimes it's not about what you're saying, but who's saying that...

Next time just use the [sarcasm] tags. No, they're not feature of AO (yet).

Peace always,
<jdenny>