Microsoft Windows 2000 Directory Services Restore Mode Blank Password Vulnerability
BID:2133
Info
Microsoft Windows 2000 Directory Services Restore Mode Blank Password Vulnerability
| Bugtraq ID: | 2133 |
| Class: | Design Error |
| CVE: |
CVE-2001-0048 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 20 2000 12:00AM |
| Updated: | Jul 11 2009 04:46AM |
| Credit: | Discovered by John Sherriff and publicized in a Microsoft Security Bulletin (MS00-099) on December 20, 2000. |
| Vulnerable: |
Microsoft Windows 2000 Server Microsoft Windows 2000 Advanced Server |
| Not Vulnerable: |
Microsoft Windows 2000 Professional |
Discussion
Microsoft Windows 2000 Directory Services Restore Mode Blank Password Vulnerability
During the boot process, Windows 2000 Server provides a number of operating system modes to assist an Administrator in troubleshooting and restoring a damaged system configuration. In the event that the "Configure your Server" tool was implemented on a system in order to promote it to domain controller status, a blank password will be assigned to the operating system mode 'Directory Service Restore Mode'. This would allow a malicious user who had physical access to the machine to log on in Directory Service Restore Mode with administrative privileges.
The "Configure your Server" tool is used in order to promote a server to become the first domain controller in a forest, which is set of Active Directory domains. The vulnerability lies within the fact that during implementation of the tool, a null password will be assigned to Directory Service Restore Mode. Any user who could physically access the machine would be able to log onto the machine and perform administrative duties that can be exercised in Directory Service Restore Mode. This would also give the user the capability to install a malicious program which would be executed after reboot.
When the password for Directory Service Restore Mode is modified, it is synchronized with the password of the Recovery Console. Therefore, the Recovery Console is also designated a blank password in this situation.
The DCPROMO tool which accomplishes the same task as the "Configure your Server" tool is not affected by this vulnerability.
Successful exploitation of this vulnerability could lead to a full compromise of the system or the domain.
During the boot process, Windows 2000 Server provides a number of operating system modes to assist an Administrator in troubleshooting and restoring a damaged system configuration. In the event that the "Configure your Server" tool was implemented on a system in order to promote it to domain controller status, a blank password will be assigned to the operating system mode 'Directory Service Restore Mode'. This would allow a malicious user who had physical access to the machine to log on in Directory Service Restore Mode with administrative privileges.
The "Configure your Server" tool is used in order to promote a server to become the first domain controller in a forest, which is set of Active Directory domains. The vulnerability lies within the fact that during implementation of the tool, a null password will be assigned to Directory Service Restore Mode. Any user who could physically access the machine would be able to log onto the machine and perform administrative duties that can be exercised in Directory Service Restore Mode. This would also give the user the capability to install a malicious program which would be executed after reboot.
When the password for Directory Service Restore Mode is modified, it is synchronized with the password of the Recovery Console. Therefore, the Recovery Console is also designated a blank password in this situation.
The DCPROMO tool which accomplishes the same task as the "Configure your Server" tool is not affected by this vulnerability.
Successful exploitation of this vulnerability could lead to a full compromise of the system or the domain.
Exploit / POC
Microsoft Windows 2000 Directory Services Restore Mode Blank Password Vulnerability
See discussion.
See discussion.
Solution / Fix
Microsoft Windows 2000 Directory Services Restore Mode Blank Password Vulnerability
Solution:
Microsoft has released patches which will eliminate this vulnerability. The patch also includes the SETPWD tool which allows the administrator to modify the value of the Directory Service Restore Mode and Recovery Console password. The command syntax for the tool is:
SETPWD [/s:servername]
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Server
Solution:
Microsoft has released patches which will eliminate this vulnerability. The patch also includes the SETPWD tool which allows the administrator to modify the value of the Directory Service Restore Mode and Recovery Console password. The command syntax for the tool is:
SETPWD [/s:servername]
Microsoft Windows 2000 Advanced Server
-
Microsoft Q271641
http://download.microsoft.com/download/win2000platform/Patch/q271641/N T5/EN-US/Q271641_W2K_SP2_x86_en.EXE
Microsoft Windows 2000 Server