Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various authentication mechanisms (e.g. NTLM, Kerberos, etc.) for use in application protocols.

What attacks, if any, are possible against SSPI? Can authentication be downgraded to an easily-breakable (or null) mechanism by an active attacker? Is it possible to pull NTLM or other hashes out of the packets and crack them?

share|improve this question

1 Answer 1

I haven't seen anything exploitable in the wild with regards to SSPI but had I to guess, I would say an impersonation attack to escalate privileges would be a likelihood. There was an instance some time ago where WinSSPI had an issue: See here and here.

I'm going on a whim here and thinking that the way MS is using SpGetContextToken can be abused locally (system): "A handle to the context to impersonate." .. "Do this, using the credentials of N user." From the network side, if someone pulls out an NTLM hash, there is no need to crack it anymore. One can just "pass the hash"

share|improve this answer
I think you misunderstood impersonation. On Windows, the term is used to mean a handle or object created under the context of another user whose credentials (or evidence, to use the official term) you have. For example, an administrative user can create a process that impersonates the limited user Bob, using evidence that he is an administrator. The admin doesn't need to know Bob's password in this case. Bob can't do the opposite (i.e. impersonate admin) because Bob can't provide any evidence that he's allowed to do so, but he may be able to impersonate Alice if he knows her credentials. –  Polynomial May 29 '13 at 14:04
I didn't downvote, but I suspect whoever did did so because you didn't provide any evidence for your claims. –  Polynomial May 29 '13 at 14:06
;) Downvoting, upvoting, makes no difference to me most times. I enjoy being able to collaborate. Everyone is entitled to an opinion ;) –  munkeyoto May 29 '13 at 15:47
Classic misunderstanding/confusion between social engineering and impersonation. –  Dark_Cyber Jul 4 at 23:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.