• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

teaching insecurity, proving instrcutor wrong

K

Kaos

[H]ard|Gawd
Joined
Oct 14, 2003
Messages
1,328
I have an inexperienced instructor (when it comes to server OS) teaching my active
directory class. He made a claim stating that the windows 2000 server is basically
secure out of the box, to which i challenged him.

He then said "fine, then gain administrative rights on my domain and i will give
you an A on the first exam in the class"

which is just like music to my ears.

I immediately started to footprint possible ways to do this...i would need access
to the management console on his DC as admin.

I looked at a few ways to do this with what i had on hand and started figuring out
how long it would take.

following an exploit that i found a while ago (or the theory behind it) what I then
did was wait until the class went to lunch. I convienently left my keys in the lab
and asked another teacher to unlock the door so i could boot down my server and get
my keys.

I then took the instructors drive out (we use removable drives for movement between
various labs) and moved to a workstation out of the view of the window next to the
door. The instrcutor had already setup active directory and was no longer logging
onto the local machine, i noticed this just watching how he is logging on (lcd
projector). I then used my nt password reset cd to blank the local machines admin
password.

While explaining the attack afterwards, the teacher laughed "ha!" at this point in
time. and then said "the local admin doenst have priveleges to AD so it looks like
youre taking my test!" I then told him to hold his horses.

So i logged onto the machine as local admin.

i then proceded to my old buddy, regedit.
i first made a backup...after all he is my instrcutor.
inside of regedit lies the HKEY_USERS\.Default\Control Panel\Desktop
key in which holds some nifty info....when logging onto a win2000 box you must
press ctrl+alt+del to get to the login screen which is basicallyan application that
you can replace with cmd.exe

i had to look this next part up to complete it but you also have to change the
registry values for screensavetimout (in seconds) and screensaveactive (0 or 1)

i then rebooted his drive and attempted to login
after the ctrl+alt+del the normal login window doesnt come up anymorre
a command prompt does...with administrative priveledges.
Im a windows commandlinist, if i can run something from command line id prefer
to..i then knew that i could either create an mmc or just use the active directory
users and computers console to create a new user with administrative priveledges,
and turn on a built in account (replicator) so it would be less obvious which
account i was using. I just set the registry values back to normal using the backup
I made and then voila.

I move his drive back to his tower, and reboot it.

At this point...I know i have my A.

Class resumes after break, I make a point to be late from break.

So the teacher asks when i plan to "hack" his system. I then tell him that its
already done. I boot to my xp pro partition, and join to his domain logging on
with my privelegded account. He says ok and tells me that i have my grade. He then
says "i dont see how that is hurtful to a server though" and deletes my user
account, like i expected him to.

I then told him to give me a few minutes and I would show him.

About twenty minutes later I was ready to show him what i had cooked up. I knew that he was about to apply sp4 and encrypt his drive as part of the upcoming labs and he would have to reboot, which i took advantage of. so what i did was simply wrote a batch file that deleted ntldr. *just so's everyone knows,he had arelatively close ntbackup of his system, i would not have performed this withough knowing that he did*

i gained access to place the batch on his machine with the replicator account by exploiting the rootshare, when you login it asks for credentials, which i had.

i copied the batch to the rootshare (c$)
Code: 
\\[i]servername[/i]\c$
the batch has to have a /ARH switch in it to be able to force deletion or Readonly and Hidden files

Code: 
@echo off
del /ARH ntldr
del /ARH "ntldr"

i put both deletion lines in because i was unsure of which would work and i was trying to work fast. I could have also blasted boot.ini and other files as well..but i was going for speed.

i browsed the network neighborhood to his machine and using the same credentials i scheduled a task to run the batch file in a short amount of time, it would have an effect upon the next reboot. So he added his enryption and applied sp4 and did his reboot.

in the lab environment the school is not worried about viruses and therefore all machines have 0 virus/spyware protection, save mine which is of my own doing.

upon reboot instructor receives a friendly message

Code: 
ntldr is missing
press ctrl-alt-del to restart

no safe mode.
disc is encrypted.
tools available on hand did not allow for an instant fix, he would have to
reinstall and restore from backup because he could not write to the drive the way he encrypted the disk.

I then explained to him the entire process i took to achieve this. From getting access to a locked room and then bypassing his local security to gain a foothold over the domain accounts i succesfully brought down his server. If it were a corporation, that might mean thousands of dollars of downtime, and all ive gotta be is a janitor coming in to clean the floor in the middle of the night to get a key to the server when there may be no users logged in to notice.

It may seem farfetched scenario for a janitor to do so...but you never know how a company will protect their assets.

Converse...
I would like to know better ways of completing this process, specifically without reboots being involved, any insight as to the current method that i used or another possible method would be greatly appreciated.

cheers,
kaos
 
Excellent lesson learned in security right there.

Physical security is a huge element in almost any situation.


Imagine if you were a corporate insider, you could have just installed a keylogger dongle between the computer and the keyboard and got the administrators password there too.

could have been crazy seemless hacking.

Good job btw, excellent use of brain/knowledge.

-randyc
 
I love proving arrogant instructors wrong. Good work, all around. Including social engineering the other instructor.

 
I forgot to include that i had to log into active directory recovery mode to run regedit, then i launched the active directory users and computers console after rebooting and getting the command shell by typing

mmc dsa.msc

which pulls up the necessary console.

im trying the same with 2003 but have been unsuccessful thus far.
 
Excellent.

I once had a teacher, well ... you couldn't call her a teacher.

First day, she went over the 2003 server editions, she started with "Standard, Enterprise and Datacenter" and then she said, "Web is the most expensive, and is used for web servers."

She tried to teach us Active Directory, she didn't know it but we were able to figure it out.

She just regurgitated the book. We had to study "printing under NT" wow, that's a whole 10 minutes at most. She said "LPR and LPD are the two types". Well, my friend asked what's the difference (even though he knew) and her response was "Cost".

I could go on for hours.
 
awesome job, you definetly showed him a lesson. nice job with that. i love proving teachers/professors wrong.

that was a pretty sneaky attack, and it looks like you executed it very well.

keep up the great work :cool:
 
I love this story. I had to instructors who had problems. One was an OS teacher. He didn't know how symmetric multi processing worked. The other was a networking instructor who didn’t know the difference between network classes. She would get stuck on something and ask me or one of the other two guys in the back of class for the answer.

The worst thing is that they never want to admit they are wrong.
 
thank you for the kind comments,

the exploit was quite simple any of you could have pulled it off. I go to school for network security, where im forced to take the prereq's no matter what. For some reason most teachers seem to believe that you need to be a programmer to be a penetration tester, i just think you need to be creative. What are your thoughts on this matter?
 
I agree with you. Anyone who can scour the web can pull off a 'sploit. A programming backgorund may help for some though... :D

 
im from the mindset that i can pull most duties from scripts...be it a batch, perl, or bash (shell) script, i can accomplish most tasks this way. windows is very easy to exploit this through because i dont need to cron or at something, i can simply drag an item to the tasks folder and bam, its done
 
Great work man. This makes me proud of my [H]ard Brethren! If you haven't read it already, The Art of Deception by Kev Mitnick is a great book.
 
In my library of secuirty related books are:

the art of deception
the art of intrustion
network+ study
security+ study
network standardization
TCP/IP: Ins and Outs
Hacking Exposed: 1st through 4th Editions
Hacking Exposed: Windows 2003 Server
Google Hacking
Wifi Toys
Anti-Hackers Toolkit
Hacker Techniques and Incident Handling
Fundamentals of Network Security
Securing the windows platform
Securing the linux platform
Web Security and Web Ethics
Auditing E-Commerce
Legal and security issues
security policy and implementation
WAN security
Advanced GPO for the enterprise

Of course i havnt read ALL of them, i only got into computers about a week before i registered here which was october of 03, id say ive read about half of them though.

How about your libraries? anything i should add?
I have most of the works published about or by minick, but..most of them arent worth mentioning.

almost forgot the linux books
Moving to Linux
Linux Operating System
Red Hat linux 9 Profesional Secrets
Unix for beginners
been using unix/linux since i got my ibook in may of 04, im still working at learning it, any resources you all may have would be greatly appreciated.
 
i have Running Linux which was recommended to me by a professor. Supposed to be a good book about Linux.

Also for one of my security classes we had to read Secrets and Lies by Bruce Schneier. Its not earthshattering but i thought it was a good read. Might be too basic for the original poster but for others it is a good book. He provides insights on things i never would have thought about.
 
did you get your A ??

nice work... although i hardly know what you did

edit: i think you should b0rg your school computers :)

 
How did you log into the DC using a local user account. On a DC all local user accounts are disabled and you do not even get an option to logon to the console via a local account.
 
I reset the local admin account so that i could have access to regedit

the login process was then modified so i could have access to a command prompt, which had administrative priveledges, then i ran the command to launch the active directory users and computers console which would allow me to change passwords, add user accounts, delete user accounts etc...

Im assuming its a problem with how windows authorizes before proper authetication.
Instead of the logon.scr coming up (normal boot, server is running) when ctrl-alt-del is pressed, in 15 seconds teh command prompt comes up with administrative priveledges, which allowed me access to the proper AD console.

honestly, set up a test 2000 server and ill post step by step how to do it.
 
once you were on as local admin couldn't you also just use a password cracker to get the domain admin password? then he can't even delete the user account. you could change the password, load up the box with warez and pr0n, tell him it was his turn to try and crack YOUR server and clean it up, and ask him how that affects the server in a business. heheheh

anyway, glad the teacher was cool about giving you the grade and all. he could've been too proud to admit defeat, but he seems somewhat cool about it . . . even after you forced him to reinstall ;)
 
the problem with cracking passwords (in my opinion) is that i could take too long. My main password that i use in most cases took 2 months for my p4 box to brute force running 24/7. I of course would try a dictionary attack as well, but even with my 91.2 MB dictionary it didnt hit it.

on the subject of folding:
we have 4 labs of 2.8ghz p4 boxes, with each lab having 32 machines, we have 1 video editing lab with 40 3.0 ghz p4 boxes in them as well, and then the library boxes are 2.0ghz machines and there are about 15 of those.

Sadly, the admin denied my request many months ago. 500ish ghz going to waste.
 
If i remember corectly you can'ty auth agaist local accounts and they are all disabled. does the Nt offline password rester allow you to enable local accounts on a DC? And doesn't the DS restore mode use a diff password than either the local or domain admin account?
 
you are correct in that assumption, i never actually logged into the dc during the "attack" i logged into the local computer to modify the registry to alter the login process. The nt reset disc just allowed me local admin access so i could modify the reg.

Ill look for the guide that inspired the exploit and post a link, give me a few minutes.
 
...gain administrative rights on my domain...
Click to expand...

His definition of "secure" is obviously pretty narrow.

Get him to leave an "out-of-the-box" install of win2k connected directly to the internet for a few hours..

"secure" my ass.
 
If you had a little bit of time and you wanted to make sure that the instructor didn't know that you had reset his admin password. What I have done in the past is to get a ghost image of the hard drive, then I use ghostwalker to extract the SAM file and then I let l0pthcrack go to town.

Granted that the brute force might take sometime, however it allows me to get the admin password without the admin knowing I had been there.
 
The OP demonstrated the 3rd immutable law of security.

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore
Click to expand...

As for potential ramifications, you could have went for the gusto. Some companies resort to having their employees take jobs at rival companies for all kinds of industrial espionage and attacks. If company A wanted to disrupt the services of company B, then its entirely feasible that someone could do the kind of attack you did.
 
This thread reminds of something I went through at one of my old jobs.

The IT guy told me the server room was secure because the door was locked and was alarmed.

I then pointed out that I could pop a few cieling tiles, crawl through, an yank all the power cords, and cables to their T1 lines tied to customers, and be out before the cops showed up.

Physical security is often overlooked.
 
If u wanted to ruin a big business computer network through physical access.. Just bring gasoline and a match.

And I highly doubt that any OS is secure out of the box.
 
serbiaNem said:
If u wanted to ruin a big business computer network through physical access.. Just bring gasoline and a match.

And I highly doubt that any OS is secure out of the box.
Click to expand...


Before this turns into a Linux is more secure the Windows debate, regardless of the OS, system security is entirely in the hands of the admin. You can have a good admin on a Windows box and a bad admin on a Linux box just as easily as the other way around.

No OS is secure out of the box because by the time the CD is pressed there are already going to be exploits available for known vulnerabilities. Its just a fact of life.
Its akin to when you buy a computer and its already outdated by the time you take it out of the box. Hell, if OSes were secure out of the box then what's that say for an OS you bought that doesn't have the latest hotfix or security patch :confused: IT is the fastest moving industry in the world, so naturally its gonna be damn near impossible to keep up.
 
I very well agree on the last comment, any OS is vulnerable to something.
One thing that i learned early on as well....

no matter how good you think you are, there is always[/i] someone better (smarter) than you.
 
serbiaNem said:
If u wanted to ruin a big business computer network through physical access.. Just bring gasoline and a match.

And I highly doubt that any OS is secure out of the box.
Click to expand...

Cattle prod, less mess but just as effective after a couple pokes at the guts.
 
Kaos said:
I very well agree on the last comment, any OS is vulnerable to something.
One thing that i learned early on as well....

no matter how good you think you are, there is always[/i] someone better (smarter) than you.
Click to expand...


Well that's not necessarily true.

But complacency is the enemy of even the smartest smarty-pants.

I've always taken a: "assume it's not secure and never will be, no matter what you do" approach.
 
Back in the day I pulled something like this off with an IP spoofer and a dictionary attack. Of course, that was pre-W2K. Taught the whole class that common passwords == bad.
 
lc4 is great, jTr is good, cain and able, theres so many. brutal gift for osx is a really good ftp/pop3 bruteforcer.

ive heard that ms calculator opens up port 132 while its running sometimes...wide open.
anyone care to comment on the validity of that? and its implications?

im try to just post similar items in the same thread so i dont have 50 security related threads running around.
 
You must log in or register to reply here.
Back
Top