175

Was the teacher right to do this? Yes and no. One might be tempted to say that giving a student administrative rights is highly problematic, and leaving them unattended even more so. And to some degree, I even agree with it. You may have added a new administrative user, changed the admin credentials, installed a rootkit or more. But... Acting maliciously ...


22

The teacher logged me in as administrator for doing a short task, is the whole system now compromised? No. but I was able to reset the administrator password with lusrmgr. Now it is, congratulations, you have performed a criminal activity. Was the teacher right to do this (is it a critical problem)? You haven't stated what the task was that you were ...


2

It's a mix of many factors, and two main ones are trust and responsibility. Teacher did valuable amount of trust to you as a partner to perform that job. This is nothing exceptional. Let say, staff from consulting company (A) can be granted with admin rights on a server(s) belonging to another company (B) if business situation requires it (even an access to ...


1

What could the teacher have done differently? The obvious answer is that the teacher should have used elevated permissions/user access management to run only what needed to run with elevated permissions, rather than logging in with an admin account. It's not foolproof*, but done correctly it would have limited the amount of damage you could do. It's also ...


1

What kind of stuff can an attacker do with this vulnerability? I will assume that my request looks like this: GET /editPassword?userID=163495&password=myNewPassword In this case, an attacker can simply change the userID and thus edit the password of another user. Even if it's just read access, by having the user supply the ID, it can be changed to ...


Only top voted, non community-wiki answers of a minimum length are eligible