Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Nvidia update service has created a local user on several of my boxes. Does anyone know its password? I recon it could possible be leveraged as an entry way for an attacker.

Details:

wmic useraccount list full

AccountType=512
Description=Used to deliver NVIDIA program updates
Disabled=FALSE
Domain=Stationary
FullName=UpdatusUser
InstallDate=
LocalAccount=TRUE
Lockout=FALSE
Name=UpdatusUser
PasswordChangeable=TRUE
PasswordExpires=FALSE
PasswordRequired=TRUE
SID=S-1-5-21-3740843305-4162061290-2760509455-1004
SIDType=1
Status=OK

EDIT: I've dumped the hash now and it looks like this:

UpdatusUser:"":"":AAD3B435B51404EEAAD3B435B51404EE:F100FC1DF3A5300A5C265BDC7CD81E39

The hash starting iwth AAD3 and ends with 4EE is just LM hash for blank password and in this case it means that the password is over 14 characters and it cannot be stored as LM hash. The last hash (F100) is the NTLM hash which I would like to see cracked :)

share|improve this question
    
Can you dump the password hash from the SAM? –  Zzz Jul 5 '12 at 0:38
    
I don't, but maybe you could find out using ophcrack.sourceforge.net and tell us more ;) –  Tie-fighter Jul 5 '12 at 2:01
    
I'll try dump it later today and start cracking it. If it is LANMAN it should not take so long. –  Chris Andrè Dale Jul 5 '12 at 8:30
    
If you are worried just disable the Nvidia update service itself. –  Ramhound Jul 5 '12 at 11:53
    
@Ramhound, not so worried. I am more interested in using it in pentests myself. –  Chris Andrè Dale Jul 5 '12 at 19:26
add comment

1 Answer

up vote 2 down vote accepted

NVidia seem to have done a reasonable job of locking this down appropriately.

I ran cain and abel, and dumped the service accounts password from LSA, it is using a very random looking password comprised of > 15 characters, using upper and lower case alphanumeric and specials like _(!, etc.

Additionally, the account is added to the deny log on locally security policies, so they appear to have thought about security on this. This is far better than having a service run under system with way more privileges.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.