Penetration Testing mailing list archives
LSADump2 Crashing Systems
From: oh face <0h.fac3 () gmail com>
Date: Fri, 2 Sep 2005 17:31:09 -0400
In my recent pen-test experience, LSADump2 has been crashing Windows boxes. I was able to verify this on fully patched Windows XP and 2003. In further examination, LSADump2, when executed, killed the "lsass" process, and with the "winlogon" process still running, the system was forced to reboot. As far as I know, LSADump2 is utilizing a DLL injection technique to dump the contents of LSA secrets. Question: 1. Has anyone had this experience? If so, is there a safe method to execute this tool? 2. When I tested LSADump2 on various Windows boxes, not all fully patched boxes were affected by this issue. What configuration of Windows is exactly causing "lsass" to fail? Cheers. ------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- LSADump2 Crashing Systems oh face (Sep 02)
- Re: LSADump2 Crashing Systems Petr Merta (Sep 03)
- <Possible follow-ups>
- RE: LSADump2 Crashing Systems Ghetti, Tim (Sep 11)
- Re: LSADump2 Crashing Systems RCS (Sep 12)
- Re: LSADump2 Crashing Systems Nicolas RUFF (Sep 16)
- Re: LSADump2 Crashing Systems oh face (Sep 23)
- Re: LSADump2 Crashing Systems Andrew Clarke (Sep 26)
- Re: LSADump2 Crashing Systems RCS (Sep 12)