Re: Abusing Windows 7 Recovery Process

[sec <sec () whatsploit me>]

If you're not able to boot from another OS because the firmware is
locked down, booting from removable media is disabled, and a software
crypto product is installed, this is a handy way to bypass all that. If
you have non-administrator credentials that get you past the bootloader
or the entire boot process hasn't been made secure, this is an extremely
trivial exploit requiring no special tools.

I'm making the assumption that the software (or hardware?) crypto is
correctly tied to that machine's TPM to prevent removing the disk and
booting it on another machine.

Depending on the exact configuration of the target machine, this would
enable the retrieval of sensitive data assumed to be secure, or else
insertion of a trusted machine with malicious payload into a secure
environment.

I can think of quite a few environments I've encountered where all of
the above assumptions stand.


On 2013-06-29 14:49:16 (+0200), Alex wrote:
> Or just add an account to SAM file with local admin privs (while booting from another OS). Nothing new or special imo.
>
> Am 2013-06-28 19:46, schrieb Anastasios Monachos:
>
> > > > Hi List;
> >
> >
> >
> > The following may be of interest: 
> > http://intelcomms.blogspot.com/2013/05/owning-windows-7-from-recovery-to-nt.html[http://intelcomms.blogspot.com/2013/05/owning-windows-7-from-recovery-to-nt.html]
> >  in particular to those performing physical attacks on Windows 7.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/