Penetration Testing mailing list archives
RE: Bypassing NTFS ACL
From: McClure David <david.mcclure () siemens com>
Date: Thu, 24 Feb 2005 17:10:55 -0500
Though some of the nastier rootkits are now much easier to detect: http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml -----Original Message----- From: Frank Knobbe [mailto:frank () knobbe us] Sent: Monday, February 21, 2005 11:53 PM To: chris () compucounts com Cc: pen-test () securityfocus com Subject: Re: Bypassing NTFS ACL On Fri, 2005-02-18 at 15:49 -0500, chris () compucounts com wrote:
I know there are plenty of simple solutions to this problem such as joining the group, taking ownership of the directory, etc, however I'm looking for a slightly more difficult solution that wouldn't be noticed. I want to bypass the ACL.
Is there any means of bypassing the ACL while the system is online without rewriting it?
Users and Groups with the Backup/Restore user privilege can bypass file ACLs. Unless Auditing of User Privileges is enabled AND someone reviews the logs, chances are good that the addition of that User Right to your account goes unnoticed. When it comes to files ACLs, no one is more powerful than the Backup account :)
I'm going to reiterate: Yes there are plenty of other ways to do this, but I want to be difficult :) This could come in handy later on.
"Difficult" AND "handy later on" usually means root kit :) Cheers, Frank ------------------------------------------------------------------------------- This message and any included attachments are from Siemens Medical Solutions USA, Inc. and are intended only for the addressee(s). The information contained herein may include trade secrets or privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you received this message in error, or have reason to believe you are not authorized to receive it, please promptly delete this message and notify the sender by e-mail with a copy to Central.SecurityOffice () shs siemens com Thank you
Current thread:
- Bypassing NTFS ACL chris (Feb 21)
- Re: Bypassing NTFS ACL Frank Knobbe (Feb 22)
- RE: Bypassing NTFS ACL Steve Fletcher (Feb 22)
- Re: Bypassing NTFS ACL Capixaba (Feb 25)
- <Possible follow-ups>
- RE: Bypassing NTFS ACL Thomas Brennan (Feb 22)
- Re: FW: Bypassing NTFS ACL James S. Ringold III (Feb 24)
- RE: Bypassing NTFS ACL McClure David (Feb 25)