Intresting problem

[TheTempest]

Hey,

As an assignment for a friend of mine in an information security class, he was told to get all of the info that he could out of the SAM on a Windows 2000/XP Box.

As i showed him links to pwdump2/walksam and other like...i started to wonder.

Is there anything i'm missing? As far as i know, for the assignment he is allowed to have phyiscal access to the machine. But what if he didn't? I know that RPC can be used in conjucntion with regedit to view remote computers regiestry but i'd be curouis to know a bit more on the underlying properties that allow that technique to work.

I'm sure these questions seem simple, but i'm have about a years experence in Compueter Security so dont be afraid to post a hex dump or shell code.

Thanks

PS Is this in the right forum?

[nihil]

QUOTE:

"i'd be curouis to know a bit more on the underlying properties that allow that technique to work."

The Administrator is a brain-dead sub-moron would be a nice start

If you have physical access you "own"..........this is why the FBI and Secret Service take all your kit away?

If you have a totally unprotected system, it might as well be on the hacker's living room carpet?

The rest are shades of grey (gray to my US readers )

Good luck

EDIT: That is about as specific as I am prepared to be...............I do not think that anyone will post any scripts or whatever..............we really are not that sort of site.....as in "not in front of the children (skiddies) dear"

Unfortunately this is a public forum, so anyone can read it, so we have to be somewhat discrete?.............I am sure that you understand?

[Computernerd22]

The Administrator is a brain-dead sub-moron would be a nice start

But what if the administrator disable the dump file by going to the Control Panel > System > Advanced > Startup and Recovery and change the options for 'Write Debugging Information" to None. Then it would be pointless.

[nihil]

I guess that Administrator just failed the selection test

Cheers

You suggested a fairly fundamental defence? my point is that we cannot discuss some of the more specific points of attack in an open forum?

OK I trust most of the people on this site, and I do not know of any members that I actively distrust.

But guests can read what we post.............that is my "problem"....yes, it is frustrating.

Cheers

[TheTempest]

Originally posted here by nihil
QUOTE:

"i'd be curouis to know a bit more on the underlying properties that allow that technique to work."

The Administrator is a brain-dead sub-moron would be a nice start

If you have physical access you "own"..........this is why the FBI and Secret Service take all your kit away?

If you have a totally unprotected system, it might as well be on the hacker's living room carpet?

The rest are shades of grey (gray to my US readers )

Good luck

EDIT: That is about as specific as I am prepared to be...............I do not think that anyone will post any scripts or whatever..............we really are not that sort of site.....as in "not in front of the children (skiddies) dear"

Unfortunately this is a public forum, so anyone can read it, so we have to be somewhat discrete?.............I am sure that you understand?

hey,
first off...i'm no script kidde...and i'm sorry if you didnt mean it like that but thats how i took it. however, i can totaly understand you not wanting other (guests) to be able to use this knowledge for bad (evil) however, this purpose is for education of the SAM and the kernels way of authenticating...

Thanks