Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So I did the ultimate silly thing: I lost my domain admin password for my Server 2008 R2 box.

Sure, I could just re-install but that's going to be a huge pain. I tried rebooting with the Windows Install DVD and replacing utilman.exe with cmd.exe, but switching to C: displayed no files.

I can still log into the machine as a regular user, though.

And I see there's been some local privilege escalation vulnerabilities patched in the last couple months (specifically MS13-046 looks promising). And it's been a little while since I've logged in to apply MSFT patches (which oddly enough was what I was trying to log in to do).

Are there any publicly available exploits for these bugs? I don't see any in Metasploit. Or is there just a better way altogether? I full physical access to the machine, but I think BitLocker is enabled (which is why I think replacing utilman.exe failed).

share|improve this question
3  
This is a great way to put a Blackhat question and make it look like an acceptable question. –  Adnan Jun 1 '13 at 8:00
1  
@FeralOink Thank you. We all try our best here. –  Adnan Jun 1 '13 at 16:14
3  
@Adnan I think many questions here can be seen as disguised blackhat questions... And even if the guy turned out to be blackhat, we couldn't know that so noone can blame this site (or anyone in particular) for having helped to get his domain hacked, especially when he has not been applying patches. –  Luc Jun 2 '13 at 9:50
2  
FWIW I'd agree with @luc just because something could be misused doesn't mean it's not a legitimate question :) if that were the case then pretty much all pen-testing questions would be out of bounds... –  Rоry McCune Jun 2 '13 at 10:51
2  
@Adnan I'll be honest, I'm a little surprised that this discussion is even happening. It's a legitimate question, although I'm not sure how to prove it. I deal with exploits regularly and it is my belief that using one in this case is the only way to achieve my desired result. I'm open to being proven wrong, so if it makes the question more legitimate to you I can remove my suggestion of using an exploit. But, let's be honest, that's a little silly, isn't it? –  mikhailzhan Jun 2 '13 at 15:36

1 Answer 1

If you've got a local account but not a domain admin, IIRC you could try metasploit with the psexec payload to put meterpreter down on the server and then use the getsystem command to try and get admin on the box.

EDIT Per @void_in this won't work with W2K8 and UAC, to you'd need to use an exploit to elevate privileges, e.g. the MS12-042 one linked in comments

if that's succcessful you can dump the domain password hashes and try and crack them (this will be easier if you can remember anything about the password like length or character set that you did/did not include).

What I'm not sure about, but which might work is, if you can use getsystem on the domain controller whether you can then use meterpreters add user commands to add a new domain admin, may be worth a try :)

share|improve this answer
    
Just to clarify one point, getsystem won't work on Server 2008 due to UAC. First you will have to bypass the UAC through exploit/windows/local/bypassuac to use getsystem. The problem with that one is that bypassuac require Admin privileges, therefore, it is a lost cause from the start. –  void_in Jun 2 '13 at 12:06
    
There is one vulnerability though that is going to give you SYSTEM privilege from a normal account. It is through exploiting ms12-042 Kernel Sysret vulnerability. The exploit is available at github.com/shjalayeri/sysret –  void_in Jun 2 '13 at 12:08
    
I believe once I get local admin MSFT documents how I can reset the Domain Admin account (net user something). Also, the MS12-042 was patched. It looks like the last time I installed patched on the machine was in November 2012. :-/ –  mikhailzhan Jun 2 '13 at 15:33

protected by Community Apr 22 at 15:32

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.