Windows domain administrator account theft is possible

Play for me that post
Voiced by Amazon Polly
Windows domain administrator account theft is possible

In my previous Question and Answer post I talked about hack Windows local administrator account , which is possible with playing on Utilman and Ease of Access. Following this article you can simply change password of any of local accounts or create a new one. It’s really old an known vulnerability, but it’s still work even on newest Windows Server 2016. Key information is that if you don’t care about physical access to your server (physical but also management console and virtual console if it’s a vm) someone can access OS as local administrator. Not good. Worse thing is that local server administrator can also steal domain admin account, or any other. Dangerous is most higher if admins in your environments use to leave RDP session on server instead of sign out. If this situation appears, this post is 100% actual. Windows domain administrator account theft is possible

What is the background?

Let’s imagine that someone who used Utilman vulnerability are already logged into one of your server and you don’t know that. Other of administrator just end his work, disconnect RDP session (not sign out!) and go home. He has domain administrator role so in other words on the server domain administrator account is still logged in. It’s time for our villain. Why?

Procedure to steal Windows domain administrator account

Our black character who already has access to server as local administrator can download simple tool called Process Hacker and install it or run from portable version. In program window all active processes are visible as in Task Manager build in Windows OS but Process Hacker can something more.

Windows domain administrator account theft is possible
Process Hacker window

If you go to process started as other domain account (remember that you’re login in as local administrator) you can right click on it and choose Miscellaneous and Run as this user… option.

Windows domain administrator account theft is possible
Run as this user… option

In newly opened window just type cmd and confirm by clicking OK.

Windows domain administrator account theft is possible
Cmd Run as domain administrator

Now go to new cmd window and type whoami to determine as who it started.

Windows domain administrator account theft is possible
Two cmd windows at the same time but started as different admins
Is that really dangerous?

Yes it is. If you have cmd started as domain administrator you can do everything. Create new domain account which is member of domain admins group and then log as this user? No problem. Start powershell as domain admin from cmd and remotely manage all computer in domain? Also not so hard to do.

Conclusion

Always take care about physical access to servers. In any case if it’s a physical access, administration with management console or console in hypervisor, always have knowledge who can manage them to avoid surprises.

Take care!

Leave a reply:

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.