5

So I did the ultimate silly thing: I lost my domain admin password for my Server 2008 R2 box.

Sure, I could just re-install but that's going to be a huge pain. I tried rebooting with the Windows Install DVD and replacing utilman.exe with cmd.exe, but switching to C: displayed no files.

I can still log into the machine as a regular user, though.

And I see there's been some local privilege escalation vulnerabilities patched in the last couple months (specifically MS13-046 looks promising). And it's been a little while since I've logged in to apply MSFT patches (which oddly enough was what I was trying to log in to do).

Are there any publicly available exploits for these bugs? I don't see any in Metasploit. Or is there just a better way altogether? I full physical access to the machine, but I think BitLocker is enabled (which is why I think replacing utilman.exe failed).

16
  • Must the password be recovered or is resetting the password without ever learning what the old value was acceptable (I doubt it can be done due to your bitlocker use, but I just want the clarification in case someone besides me knows a way) Jun 1, 2013 at 1:35
  • 3
    This is a great way to put a Blackhat question and make it look like an acceptable question.
    – Adi
    Jun 1, 2013 at 8:00
  • 3
    @Adnan I think many questions here can be seen as disguised blackhat questions... And even if the guy turned out to be blackhat, we couldn't know that so noone can blame this site (or anyone in particular) for having helped to get his domain hacked, especially when he has not been applying patches.
    – Luc
    Jun 2, 2013 at 9:50
  • 2
    FWIW I'd agree with @luc just because something could be misused doesn't mean it's not a legitimate question :) if that were the case then pretty much all pen-testing questions would be out of bounds... Jun 2, 2013 at 10:51
  • 2
    @Adnan I'll be honest, I'm a little surprised that this discussion is even happening. It's a legitimate question, although I'm not sure how to prove it. I deal with exploits regularly and it is my belief that using one in this case is the only way to achieve my desired result. I'm open to being proven wrong, so if it makes the question more legitimate to you I can remove my suggestion of using an exploit. But, let's be honest, that's a little silly, isn't it? Jun 2, 2013 at 15:36

1 Answer 1

2

If you've got a local account but not a domain admin, IIRC you could try metasploit with the psexec payload to put meterpreter down on the server and then use the getsystem command to try and get admin on the box.

EDIT Per @void_in this won't work with W2K8 and UAC, to you'd need to use an exploit to elevate privileges, e.g. the MS12-042 one linked in comments

if that's succcessful you can dump the domain password hashes and try and crack them (this will be easier if you can remember anything about the password like length or character set that you did/did not include).

What I'm not sure about, but which might work is, if you can use getsystem on the domain controller whether you can then use meterpreters add user commands to add a new domain admin, may be worth a try :)

3
  • Just to clarify one point, getsystem won't work on Server 2008 due to UAC. First you will have to bypass the UAC through exploit/windows/local/bypassuac to use getsystem. The problem with that one is that bypassuac require Admin privileges, therefore, it is a lost cause from the start.
    – void_in
    Jun 2, 2013 at 12:06
  • There is one vulnerability though that is going to give you SYSTEM privilege from a normal account. It is through exploiting ms12-042 Kernel Sysret vulnerability. The exploit is available at github.com/shjalayeri/sysret
    – void_in
    Jun 2, 2013 at 12:08
  • I believe once I get local admin MSFT documents how I can reset the Domain Admin account (net user something). Also, the MS12-042 was patched. It looks like the last time I installed patched on the machine was in November 2012. :-/ Jun 2, 2013 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .