4 ms·

Install persistence, stealth like clearing logs, gather more information from AD, run code that wouldn’t otherwise be possible. But no let’s just forget all of

• AnIdiotOnTheNet 7y ago
  > gather more information from AD What good is the computer account for this when you already have the user account? > But no let’s just forget all of the reasons we use group policy and principles of least privileges. By that rationale, computer accounts should have far fewer privileges than the actual user account anyway, so again having local admin isn't worth much. > run code that wouldn’t otherwise be possible Namely? > Imagine if your initial foothold is user with Steam installed. You just got SYSTEM for free. And I'm struggling to see how that adds much to my problem of someone having a foothold on a user workstation already. And that's ignoring the circumstances of Steam being installed on the workstation in the first place AND the user having installed some untrustworthy game with it in the window since the game's appearance on Steam and its detection and removal. Which is also not to mention that this means the user has the ability to install software and is therefore infinitely more likely to just download some malicious installer from the nefarious portions of the internet that they can access with a web browser.
  • 0xDEFC0DE 7y ago
    >Namely? Powershell, friend. Changing execution policy requires privileges. Guess what SYSTEM gives you? Plus you can disable windows defender and install any nasty things you want! Pretty sure you’d need system to snoop/inject traffic too. If you have other services or applications installed (like IT setting up your workstation), those things can now be read/changed where they otherwise wouldn’t be with just user access. This can lead to other information leakage about other parts of the network or services. >And I'm struggling to see how that adds much to my problem of someone having a foothold on a user workstation already. No fucking shit, but you don’t let them walk into system just because they got user. You’re taking the stance that any compromise means death and that’s directly opposite of defense in depth, so you clearly don’t believe in that. That’s just being lazy mate. Why not just chmod 777 everything and call it a day? >Which is also not to mention that this means the user has the ability to install software and is therefore infinitely more likely to just download some malicious installer from the nefarious portions of the internet that they can access with a web browser. Because they don’t know Steam is insecure by design! They trust Steam! That’s the problem! This isn’t common knowledge and since Steam won’t fix it, it needs to become common knowledge.
    • AnIdiotOnTheNet 7y ago
      > Powershell, friend. Changing execution policy requires privileges. Guess what SYSTEM gives you? PowerShell execution policy is stupid easy to bypass. You simply pass the '–ExecutionPolicy Bypass' parameter when launching the script. Of course, since you already have complete control of the user account, being able to run PowerShell isn't nearly as big a deal as the fact that you can run anything at all. > Plus you can disable windows defender and install any nasty things you want! Windows defender, like pretty much all AV software, is crap anyways and won't detect most of the things you'd be interested in doing. It's a low-effort screen for well known malware. Case in point: it didn't catch your malicious installer when Steam downloaded and ran it in this scenario did it? > Pretty sure you’d need system to snoop/inject traffic too. That may well be true, but considering I pretty much already have full control of the user account and can therefore do everything it can do on the network without injecting anything, I'm not sure what is gained. > No fucking shit, but you don’t let them walk into system just because they got user. Eh, it isn't really worth my effort to try and prevent it when all they'll have to do is fire a UAC prompt the user will almost certainly just click through anyway. Especially considering what little (basically nothing) it gets the attacker. > Because they don’t know Steam is insecure by design! They trust Steam! That’s the problem! This isn’t common knowledge and since Steam won’t fix it, it needs to become common knowledge. So here's the scenario you're talking about: A user has installed Steam on their work computer. They use Steam to download an installer that is actually malicious and this fact has not been caught by Valve yet. Steam, who's entire purpose is to install games, runs the installer. Consequently, the user account is now owned by an attacker. ...And even if this vulnerability were patched ALL OF THE ABOVE WOULD STILL BE TRUE!
      • 0xDEFC0DE 7y ago
        >PowerShell execution policy is stupid easy to bypass. You simply pass the '–ExecutionPolicy Bypass' parameter when launching the script. GPO prevents this but if you have local system you can override that locally and then change execution policy. I’m sorry, I don’t say this often but you don’t know what you’re doing so I’m not going to take the time for the rest of your post. I’d encourage you to research this more if you like it.