Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Related:
Local Admin has Domain Admin rights

"Pass-through authentication" on Windows systems allows for the possibility for user accounts with the same name and password to impersonate one another, even though they may not be intended to have the same privileges.

Example:

Say we have a standalone PC, not joined to any domain. The PC is called MyPC, and it has an account called MyAdmin. The password for MyAdmin is, unoriginally, password.

Then we have a domain called MyDomain. The network administrator decided to call a Domain Administrator account MyAdmin and, in a demonstration of sheer incompetence, gave it a password of password.

For whatever reason, a completely unfiltered network connection exists between MyPC and all of the computers on MyDomain.

Any person who can log in to MyPC as MyPC\MyAdmin can exercise full Domain Administrator privileges on any system in MyDomain, as if they had actually logged in as MyDomain\MyAdmin, without being prompted to enter any additional credentials.

Intuitively, this seems wrong because (though they may have the same basic username & password) MyPC\MyAdmin and MyDomain\MyAdmin are two different user accounts, created in different scopes, with different permissions. However, what actual security risks does this pose? How can those risks be mitigated, or how are they already mitigated by design? Does the risk change if the "rogue" MyAdmin is a local account on a computer that is joined to the domain instead of just a random standalone system?

share|improve this question
2  
I don't see how this creates any issues. If you have unfettered access to a network hosting a domain, and credentials for a domain administrator, I fail to see how having a machine that has a local user with the same username and password creates any new points of vulnerability. You're already a domain administrator, and you can do essentially anything you please with or without pass-through auth. –  Xander Oct 24 '13 at 16:27
2  
If you're suggesting that a local user could accidently discover or unwittingly use domain administrator privileges by coincidentally having a local account with the same credentials as a domain administrator, I don't know that I'd consider that a valid threat. To me that's essentially identical to considering it a threat that I could accidently log into a web application using someone else's email address and password, and would have access to their information and the rights assigned to them instead of my own. –  Xander Oct 24 '13 at 16:32
    
Do you have links to further information on the scenario you suggest? I can find no other documentation that this should work. Both NTLM's NEGOTIATE_MESSAGE and AUTHENTICATE_MESSAGE should contain the domain name. –  David Oct 24 '13 at 19:15
    
@David AviD's answer to the linked Related question is my primary source. From experience, I've seen this work from one non-domain PC to another but I haven't tested it myself when trying to authenticate to a domain. –  Iszi Oct 24 '13 at 19:19
1  
@David that is the common misconception - the domain is just the authenticating source, not part of the authenticated identity (yes, the domain can only verify this user for this domain, but the authentication process does not involve the domain name). –  AviD Oct 24 '13 at 21:05

1 Answer 1

Here's the tricky part about the problem in your question: It doesn't exist. No no, I'm not being snarky. Hear me out.

You have a Domain administrator account with the password password (or any password of that sort), and the attacker created a local account with the same username and password. Without needing to create a local account, the attacker can simply user the username MyAdmin and the password password to login and use MyDomain\MyAdmin.

The problem has nothing to do with the pass-through authentication scheme, the problem is with using such passwords. Even if you, for example, disabled the whole functionality, the attacker can still use the username and password combination.

If it makes you sleep better at night, you can completely disable incoming NTLM authentication traffic by setting the following security policy in Group Policy \Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Incoming NTLM traffic to Deny all domain accounts.

share|improve this answer
    
The weakness of the password is not meant to be the key issue here. It could just as easily be a random password of any length, so long as the "rogue" account has the same username/password (whether by design or sheer coincidence) as the authorized Domain Admin. –  Iszi Oct 24 '13 at 16:00
    
@Iszi The weakness of the password isn't at all the point of this answer. The point of this answer is simply: If someone already has the password (be it 30 random characters) they don't really need the pass-through authentication, they can simply login using the username ans password. –  Adnan Oct 24 '13 at 16:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.