PRO+ Premium Content/Information Security magazine

Thank you for joining!
Access your Pro+ Content below.
February 2002

Reduce Windows command line scripting risks with least privilege

Scripts can augment security, but their use also entails a certain degree of risk. Many scripts require administrative access. If an attacker can gain write access to such a script, he'll be able to add anything he wants to it, which means he can run arbitrary programs in whatever security context the script runs. For instance, what if an attacker accesses the FindPics.cmd script running on a server that's both an NT 4.0 PDC and a general file server (a bad idea to begin with, but let's overlook that for the moment)? The server is locked down pretty tight -- except that the directory in which FindPics.cmd resides has the default NTFS Everybody, which has Full Control permissions. A clever attacker could add a couple of lines, such as: Rdisk /S- Copy %SYSTEMROOT%\Repair\sam._ g:\Users\EvilUser\Data The following day, he could remove those lines, bring home sam._, expand it and spend the next week getting every single user ID and password in the domain. This is a simplistic and somewhat silly attack, to be sure, and even basic ...

Access this PRO+ Content for Free!

Features in this issue

Columns in this issue

  • Security startups: Recipe for success

    by  Robert Logan

    Stir one part technologist with one part experienced CEO and some VC money and you have the recipe for successful security startups.

  • Secure reads: The CISSP Prep Guide, CISSP Exam Cram

    by  SearchSecurity staff

    Although efficient study guides for cramming before the CISSP test, The CISSP Prep Guide and the CISSP Exam Cram won't advance the infosec profession and are likely plagiarized.