WinBatch Tech Support Home

Database Search

If you can't find the information using the categories below, post a question over in our WinBatch Tech Support Forum.

TechHome

WinBatch
Networks - Servers
Microsoft Client
wNT
plus
Services

Can't find the information you are looking for here? Then leave a message over on our WinBatch Tech Support Forum.

wntRunAsUser -- Security Side Effects 

Keywords: 	 wntRunAsUser -- security side effects

Question:

I've been searching around for what the "side effects" of granting the necessary rights to some user/group like "Domain Users" so that I could use wntRunAsUser to install patches to Internet Explorer for example on NT PCs.

Here's one question/response: 

> Now to the actual question. What affect will granting the "Domain Users"
> group the rights -- Act as part of the operating system aka
> "SeTcbPrivilege"; Increase quotas aka "SeIncreaseQuotaPrivilege" ; Replace
> a process level token aka "SeAssignPrimaryTokenPrivilege" -- have on
> security ?

This is a tremendously bad idea regardless of whether or not the
username and password can be recovered from the executable. Both
SeTcbPrivilege and SeIncreaseQuotaPrivilege are very powerful rights
that should only be available to the operating system. They should not
even be assigned to Administrators. You effectively provide the ability
to completely compromise the system by assigning those rights to a
user. Everything needed to write the necessary code is available
through MSDN.

SeIncreaseQuotaPrivilege has no affect in Windows NT 4.0. I don't know
about Windows 2000.
Looking for other inputs on this.

Also a lot of discussion has been around extracting the user-name/password combination from the compiled file. It looks hard to me but I've omnly peeked into a compiled file & searched for the string that I KNEW was the user-name/password and couldn't find either.

Any thoughts on how secure the user-name/password combination are in side the executable ? would an *.exe be more secure than a *.wbc ?

Answer:

  1. WBC files are very insecure. Someone with passing knowledge of WinBatch can usually get most of the source of of it.

  2. A Call to a WBC file can compromise the security of an exe. Theoretically the user could decode the WBC file, make his own and enable debugging.

  3. Exe security is iffy. With about $3000 of commercially available tools and the skills of the reasonably unreconstructed hacker most of the source can be extracted.

    However the same skills and tools can be used on pretty much any program in any language.

  4. There is a vague loophole in NT whereby the LocalSystem account can run wntRunAsUser with the default settings. If the user can schedule a job to be run by the AT command, the job will run (by default) usder the LocalSystem account and the wntRunAsUser can be done there anyway.

  5. It kind of depends on your security threats, the competitive value of the information on your systems, versus the ability to get the job done at all or at reasonable cost.

  6. As I understand the process, step one in securing an NT machine is to disconnect the network cables... 
Article ID:   W14477

Filename:   wntRunAsUser -- Security Side Effects.txt
File Created: 2000:05:30:13:14:44
Last Updated: 2000:05:30:13:14:44