Nvidia update service has created a local user on several of my boxes. Does anyone know its password? I recon it could possible be leveraged as an entry way for an attacker.
wmic useraccount list full AccountType=512 Description=Used to deliver NVIDIA program updates Disabled=FALSE Domain=Stationary FullName=UpdatusUser InstallDate= LocalAccount=TRUE Lockout=FALSE Name=UpdatusUser PasswordChangeable=TRUE PasswordExpires=FALSE PasswordRequired=TRUE SID=S-1-5-21-3740843305-4162061290-2760509455-1004 SIDType=1 Status=OK
EDIT: I've dumped the hash now and it looks like this:
The hash starting iwth AAD3 and ends with 4EE is just LM hash for blank password and in this case it means that the password is over 14 characters and it cannot be stored as LM hash. The last hash (F100) is the NTLM hash which I would like to see cracked :)