CVE-2021-1675 icon indicating copy to clipboard operation
CVE-2021-1675 copied to clipboard

Published 20 hours ago • verified publisher icon calebstewart

PR to support local group definition

Open mclbn opened this issue 4 years ago • 4 comments

Hi,

Under a localized Windows (i.e. French), the name of the local admin group might be different (i.e. "Administrateurs"). This PR adds a new "Group" parameters that patches the hardcoded DLL in the script with the specified value.

Cheers.

Marc

mclbn avatar Jul 05 '21 08:07 mclbn

I'm curious. why not use SIDs to resolve the name of the Administrator Group? like so:

[System.Security.Principal.SecurityIdentifier]::new("S-1-5-32-544").Translate([System.Security.Principal.NTAccount]).Value

jschpp avatar Jul 05 '21 09:07 jschpp

The DLL would need to be updated. Currently, the group name is specified as a literal string constant, which could be modified at runtime before dropping the payload, but couldn't be any longer than the original string (L"Administrators"). If it was separated out into a global variable with some padded space like the user name and password, that would be feasible and less likely to cause some sort of overflow situation in DllMain.

calebstewart avatar Jul 05 '21 20:07 calebstewart

Hmmm... I'd need to test this in my side but I'm pretty sure you could do SID resolution in the DLL itself. Let me get back to you on that

jschpp avatar Jul 06 '21 13:07 jschpp

Hmmm... I'd need to test this in my side but I'm pretty sure you could do SID resolution in the DLL itself. Let me get back to you on that

Yeah that doesn't seem to be as easy as I thought oO sooo much LSA stuff I know nothing about^^

If it was separated out into a global variable with some padded space

This should be much much easier. So this gets my vote :-)

jschpp avatar Jul 07 '21 16:07 jschpp