While playing with starting processes in the winlogon secure desktop and unlocking a machine without a password (remoteunlock.exe), I experimented with using ZwCreateToken through ztokenman.exe to start a process as a user without knowing their password.
Combined with psexec, this allows you to run something as a user that’s interactively logged on, while their workstation is locked and without knowing their password.
Start a process on the winlogon desktop, used when the machine is locked:
- psexec /s \\%computer% cmd /c c:\windows\temp\psexec /accepteula /x /d /s cmd
From this command prompt, run ztokenman.exe and:
- In the Process drop-down, select a process owned by the user (eg explorer.exe)
- Click DumpProcessToken
- In the 'Create a Process With the Current Token' text-box, type cmd.exe
- Click 'CreateProcessAsUser with Current Token'
From the cmd.exe that opens, this should be under the context of the interactive user of the workstation. For example, if you run net use, you should see the connections the user has.
This uses an undocumented API - ZwCreateToken, after calling OpenProcessToken to duplicate a token from an existing process.
Is this actually useful for anything? Probably not, but it’s interesting nonetheless. Note that remoteunlock.exe will actually provide access to the desktop for the interactive winlogon session, even if the machine is locked.
References
RunAsEx and ztokenman:
http://www.codeguru.com/cpp/w-p/win32/cursors/article.php/c6745/
Unlocking XP/2003 without passwords
http://waynes-world-it.blogspot.com/2008/04/unlocking-xp2003-without-passwords.html
RemoteUnlock.exe
http://www.codeproject.com/KB/system/RemoteUnlock.aspx
3 comments:
Am I missing something or isn't one of the biggest security vulnerabilities I've ever seen? I have not tried this myself yet but if I'm following your post, any user can start a process on a remote system as the logged on user? Please tell me I've missed something critical here.
Hi Jeff,
The assumption is that you have the rights to start a psexec /s session on the remote computer, therefore requiring administrative access to that remote workstation. This post was just rambling thoughts really, however the remoteunlock.exe utility is much more of a security risk in my opinion, anyone with admin rights to a remote workstation can shove the winlogon secure desktop and SAS aside, displaying the 'locked' interactive users desktop for all to use:
http://waynes-world-it.blogspot.com/2008/04/unlocking-xp2003-without-passwords.html
Definitely another reason not to give users admin rights to their desktops. In this scenario, if I add Domain Users, or any domain group for that matter, to the local administrator's groups, that user could take advantage of this combination. But even having PSEXEC access would be bad enough.
Do you know how this would work with Vista and UAC?
Post a Comment