On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password.
I am wondering how is this possible, and I can't figure out a valid scenario, so I'm asking here.
This has been made by an attacker who then created an administrator account and re-logged in through his brand-new own-created account.
EDIT: ok, I now got the logs: in the Windows Event Logs there are some actions performed by a user that use a SID instead of a username. Those actions leads to a successfull login as sadmin, the renamed Administrator account, and that is the violation.
So he doesn't created a new account but he exploited the administrator one.
-
You mention this was made by an attacker - was this a pen test?– DoomgooseSep 11, 2018 at 15:27
-
No, this was not a pen test– FlashSep 11, 2018 at 15:33
-
2This is impossible to explain without logs. Logs are your data; any explanation is based on what's logged. "There is a logged access"---what is in this log entry, and what other events happened shortly before/after. Without that information, no one can provide meaningful help.– DoubleDSep 11, 2018 at 17:27
-
@Flash - if you have the event logs at hand, this would help an answer. There could very well be an exploit in use here, especially considering this is on a Windows 2003 server. How do you know there were no credentials used? Was this observed by eye, through a SIEM tool event or a raw log?– DoomgooseSep 11, 2018 at 20:36
-
After some struggle, I now have the logs. I'm trying to update the answer to ask your questions.– FlashSep 18, 2018 at 8:30
Add a comment
|
2 Answers
As Chris already mentioned, an exploit could be run against the RDP server, or another gained access via another service (Telnet, SSH, Apache Server, etc...). Whether this was via a zero-day exploit or a brute force attack, is another matter.
Two exploits come to mind though, CVE-2008-4250 and CVE-2012-0002. However, without logs, I cannot know for certain. Furthermore, my answer is restricted to remote access attack vectors. Physical attack vectors have not been considered.
-
The CVE-2012-0002 seems to be the most probable scenario, but I can't be sure.– FlashSep 18, 2018 at 8:50
Highest chances are they either found a valid exploit on the RDP version on this system and they gained access without credentials, or they found an exploit at another exposed service running in the same machine, got administrative access through it and launched an RDP connection to their new user. Scenario no.2 (gaining access from another service) could happen in other ways as well. That could include physical access (badusb, infected files through USB, quick access to keyboard when no one was looking etc), payload drop through malicious emails or fake web pages and way more, sometimes beyond imagination. So, there are lots of possible and VALID scenarios, since everything running in this server (including the server itself) sounds outdated.
answered Sep 11, 2018 at 16:24
