Re: issues with syskey in NT 4.0

On Friday 06 December 2002 03:03 pm, Kolde, Jennifer E. wrote:
> But you need administrator privileges to run either tool. An attacker
> trying to break in can't use pwdump2/pwdump3 to get the hashes. An
> attacker who already has administrator privileges doesn't need those
> tools because he already has enough access to do what he wants...

I misunderstood the issue, it sounded like syskey was being touted as the end-all solution for preventing access to the password hashes. Even after gaining administrative access, the password hashes are useful to an attacker trying to access another resource with overlapping users (unix systems with shared passwords, other domains, etc). With the number of other methods available to gain SYSTEM/admin access from a local account (DebPloit, shatter attacks, writable paths, debug registry entries, etc), it didn't occur to me that using syskey would have any practical effect on preventing local users from gaining administrative access.

-HD Received on Fri Dec 6 16:20:42 2002