"Jeremy SAINTOT" <jeremy.sain...@gmail.com> wrote:
> Correct me if I'm wrong, but here is what I think of that : You are wrong! > A Domain user that is a Local admin of his workstation is different than > a Domain user which is Domain Admin. A local administrator has all the powers on his computer, while a domain administrator as all the powers in the domain/AD. Typically domain administrators are members of the "Administrators" group too. > Then, a local admin whose account is an AD account can run scripts *on > his local machine* in the name of the domain admin. Right. The local machine but MUST NOT be able to query the AD, else the cached credentials are not used. > This includes the possibility of dumping the Domain Admin password hash > and even *all the domain accounts password hashes* (ie: psexec + pwdump > against the DC, with the privileges of the domain admin). WRONG! Read the OP again. CAREFULLY. The computer needs to be unplugged from the network. There is NO POSSIBILITY to access OTHER domain members with cached credentials. > An exploitation scenario could be the following for an unprivileged > domain user: > > - Become local admin of his workstation (bunch of methods out there) > - Run script ad the Domain Admin with this technique) > - Recover Domain admin or Domain Users password hashes. > - Crack the passwords and become Domain Admin (ie: Administrator of all > workstations and servers in the domain). > > My two cents ! That's inflation: 2 cents worth nothing. Stefan _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
