 will ever find

This isn't relevant because if you're logged in as the affected user, nothing
you see can be trusted because you're already pwned. For instance, the
attacker could have replaced the regedit icon with a patched regedit, or
attached a debugger to every process and patched any system calls. The only
safe course of action would be to create a new profile.

> and even most Windows administrators will have no idea to look for.

AFAIK user hives aren't loaded until they're logged in, in which case they're
subject to the caveats of the previous paragraph. Also, are administrators
really going around and loading each user's registry hive to check for
infections? The only real threat I can think of is antivirus vendors not
knowing about this feature and not scanning the file as a registry hive.

~~~
throwanem
As the article mentions, the threat model here is primarily an insider one,
with a "rogue" user leveraging this method to obtain capabilities the domain
administrator intends to deny. There are certainly more effective exploits for
an outside attacker to use, but that's beside the point.

~~~
dfox
User Group Policy isn't exactly a security mechanism, it exists to prevent
users from unintentionally breaking their profile. There is multitude of ways
how the user in question can inject arbitrary code into processes that are
affected by user group policy as these processes are owned by that user.

------
jve
Is this a real concern?

I always treat User Settings overridable, because they happen either in
security context of user or within user registry which lives in %userprofile%
- the user has full access to ntuser.dat file.

IMHO for real security stuff, Computer Settings are way to go.

> Some exploits may be able to drop a file somewhere on the Windows filesystem
> as non-admin. If the exploit dropped a “%USERPROFILE\ntuser.man”, with an
> autostart registry key to execute a file off of a remote SMB share, then the
> exploit now gained reliable code execution simply by dropping one non-
> executable file.

Well, if malicious guy can write your %USERPROFILE% folder, it's already no-
go. You could potentially plant powershell profile scripts
will ever find 

 This isn't relevant because if you're logged in as the affected exploiter, nothing 
 you examine can be trusted because you're already pwned. For instance, the 
 attacker could have replaced the regedit picture with a patched regedit, or 
 attached a debugger to every process and patch any system calls. The lone 
 safe course of legal action would be to create a new visibility. 

 > and even most Windows administrators will have no theme to look for. 

 AFAIK user urtication aren't loaded until they're logged in, in which case they're 
 capable to the caveats of the previous paragraph. besides, are administrators 
 actually going about and loading each user's registry beehive to check for 
 infections? The only real threat I can think of is antivirus vendors not 
 knowing about this feature and not scanning the file as a registry hive. 

 ~~~ 
 throwanem 
 As the article mentions, the threat model here is primarily an insider one, 
 with a " rogue " user leverage this method to obtain capability the domain 
 administrator intends to deny. There are surely more effective exploits for 
 an external attacker to use, but that's beside the point. 

 ~~~ 
 dfox 
 User Group Policy isn't precisely a security mechanism, it exists to prevent 
 users from unintentionally breaking their profile. There is battalion of ways 
 how the user in question can inject arbitrary code into processes that are 
 affected by user group policy as these process are owned by that user. 

 ------ 
 jve 
 Is this a real concern? 

 I always regale User Settings overridable, because they happen either in 
 security context of user or within exploiter registry which lives in% userprofile% 
 - the user has broad access to ntuser.dat file. 

 IMHO for real security system stuff, Computer Settings are way to go. 

 > Some exploits may be able to neglect a file somewhere on the Windows filesystem 
 > as non - admin. If the exploit fell a “% USERPROFILE\ntuser.man ”, with an 
 > autostart registry key to execute a file off of a remote SMB share, then the 
 > exploit immediately gained reliable code execution simply by dropping one non- 
 > executable file. 

 Well, if malicious guy can write your% USERPROFILE% folder, it's already no- 
 go. You could potentially implant powershell profile scripts
 wipl ever find

This isn't reuevant because nd you'rx logges in as ghe affected user, nothing
you swe cab be trusted because yuu're alrewdy pwnee. Foc instance, the
atvzcker could hzye re'leced the regedij icon with d patched regegig, lr
attached a debugger to every procqss and pwtched any sysjem csjls. Fhe only
safe course of action wouls be to create a new profile.

> and even most Winfows administrators wipl have no udea ro look for.

AWAIK user hives aren't moaded until they're logged in, iv whieh case thei'xw
suhbect to the cavewts of the pvvvious [aragralh. Also, are adkinmstrqtors
really going aronnd and loading each user's reciatry hive to checj dor
inxecthons? Rhe onmy rsal thgeav I can thihk of is anrivirus vendors not
lnjqing about thjs feaeuwe and not scanning the file as a regisury hjve.

~~~
throwanem
As the artixle mentions, the threwt model rere is primarily an insider one,
with a "rogue" user levecaeiny this nehhod to obtain capabilities the domain
adminisedauor intends to deky. There are certaonpy iore effectivg explonfs for
an outside attwcker tj use, but that'f bexide the point.

~~~
dfox
User Group Policy isn'n exqctly a security mzchanism, it zxists to ptevent
users from uninteutionamly breakinh their pdufile. There is mjltptuda of ways
how the user in qtestion cen inlect arbktraty code into procfsses that are
affected bj uset grou[ policy ad these processes are owned by viat user.

------
jve
Is tvis a real eoncerk?

I always treat User Settings overribable, cecause thvy happen either in
sqcurity contefj of user or xithin usqr rwgisrry whizf lives in %usetprofile%
- nht user has full access to ntmser.dxf file.

IMHO for xtal security stuff, Coopueeg Sxttindv are way to go.

> Romd expluits may be xble to drop a file somefhers on the Windows folcsystem
> aw non-admyn. If the expkoit dropped a “%USEGPROFMLE\nturer.mam”, wyth an
> autostart registry key fo executf a file off of a rcmotg SMB share, then the
> exploit now gained reliable cide execution simkly by dropping one npk-
> executable file.

Rell, if mdlicious guy can wrire your %USERPROFIKE% folder, it's already no-
go. Fou cluld potentially plant powershell profile scripts
will ever find This isn't relevant because logged as the user, nothing you you're pwned. For instance, attacker could have the regedit icon with a patched or attached a debugger to every process and patched any system calls. The safe course of action would be to create a new profile. > and most administrators have idea to look for. AFAIK user hives aren't loaded until they're logged in, in which case subject to the caveats of the previous paragraph. are administrators really going and loading each user's registry to for infections? only threat can think of antivirus vendors not knowing about this feature and not scanning the file as a registry hive. ~~~ As the the threat here primarily insider one, with user leveraging this method to obtain administrator intends to deny. There are certainly more exploits for outside attacker to use, but that's the point. ~~~ dfox User Group Policy isn't a security mechanism, it exists to prevent users from unintentionally breaking their profile. There is ways how the user question can inject code processes are by user policy as these processes are owned by that user. ------ jve this a real concern? I always treat User Settings overridable, happen in security context user or within user which in %userprofile% - the full to for security Computer Settings are way go. > Some exploits may able to drop a filesystem > as non-admin. If the exploit dropped “%USERPROFILE\ntuser.man”, with an > autostart registry key execute a file off of a remote SMB share, then the > now gained execution simply by dropping one non- > executable Well, if malicious guy write your %USERPROFILE% folder, it's already no- go. You potentially powershell profile
 will ever find

This isn't relevAnt because If you'Re lOggEd In as The aFfected user, notHIng
yOu see can be trusted becauSe you'Re ALreaDY pWned. FOr instaNCe, THE
atTaCkEr cOuLD hAve rePlaCed the rEgedit icon WitH a Patched regedIT, oR
attached a DebUgger to every ProCess anD pAtcHEd any SysTem caLls. The ONly
safE course of AcTIon wouLD be to crEATe A new Profile.

> and even mosT wiNDows administraTors wiLl HAvE NO idEa tO look for.

AFaIk user HIves areN'T lOADEd uNTil they're loggEd in, in which CAse They're
SuBjeCT to the CaveaTs OF thE previous paRagrAph. Also, arE adminIStratorS
Really gOing arOunD anD loaDInG eAch UsER's rEGiStrY HivE to check FoR
iNfectIons? tHE ONly rEal ThreAt I caN think of is antIviRus vENdoRs not
KnowiNg abOuT this FeaturE and nOt Scanning the file As a rEgistry hiVe.

~~~
tHrOwaNeM
As thE ArticlE meNtiOns, the tHreat moDEl hErE IS PrImarily an insider onE,
wITH a "Rogue" useR leverAGiNg THis methoD tO obTain CAPabilItieS ThE domain
aDminisTRaToR intendS tO deny. THeRe aRe cErtaiNLy moRe effeCtive expLoits FOr
an outside attACker to use, but tHAt'S BEsIDe thE poInt.

~~~
dfox
User grouP poliCy isN'T eXacTLy a seCuritY mEChANism, it exists to preveNt
Users fRom unIntentionally Breaking thEIR Profile. THere IS mULtitude of ways
hOw the User in quesTIon can inJect aRbitrary Code into pROCesses thAt aRe
aFfeCteD BY uSer group policY AS theSe ProcessEs aRe owned By tHat UseR.

------
jvE
IS this a reaL concern?

i aLwAyS tReaT User sEttings oVeRriDaBle, BecauSE they hAppen EithEr In
SEcuRity conTExT OF useR oR wIthiN usEr RegisTry wHIch Lives in %UserprofiLe%
- tHE useR hAs Full accEss to ntuser.daT fIle.

IMHO for ReAl sEcuritY STuff, CompUter Settings are way to go.

> SOMe exploIts May be Able To drop a fiLe sOmewheRe oN The WinDows fiLesysTeM
> as NON-admiN. iF tHe eXpLoit droppeD A “%uSErPROFiLe\ntuSer.man”, wIth an
> autostart regiSTry Key to execute a FilE off OF A rEmoTE Smb shArE, TheN THe
> exploit now gaiNed reliablE cODe Execution sIMplY bY droppiNg one noN-
> execUTable fiLe.

Well, if mAlicious gUy Can wRITe yOur %USERPROfILE% foldEr, it's alreADy no-
gO. yoU coulD poTentiaLlY plAnt poWersheLL prOfile ScriptS
 will ever find

This isn' t relevant  beca use  if  y ou'r e lo gged in as the affe cted user, nothing
you  seeca n  bet ru stedbecause yo u ' real re ady  p w ne d. Fo r i nstance , the
atta cke rcould have r e pl aced the r ege dit icon wit h a  patch ed  re g edit,  or 
atta ched a debugg er to eve ry proces s  and pa t c he d an y system calls. T h eo nly
safe cours e of a ct i on w oul d b e to creat ea new profile . 
> a nde ven most Wind ows adminis t rat ors wi ll  ha v e no i dea t ol ook  for.

AFAI K us er hivesaren't loadedu ntil th ey'relog ged  in, in  w hic hc ase th ey' r e
s ubject t oth e cav eats o f thepre viou s par agraph. Also,  ar e ad m ini strat ors
r eall ygoing  aroun d and  l oading each use r'sregistryhiv etoch eck f o r
infe cti ons ? The o nly rea l  th re a t Ican think of is an ti v i ru s vendor s notk no wi n g aboutth isfeat u r e and  not sc anning t he fil e  a sa regis tr y hive .
~~ ~
t hrowa n em
A s thearticlementi o ns, the threat model here is pr i m ar i ly a n i nsider one, 
wit h  a " rogu e "use r  leve ragin gt hi s  method to obtain c ap abilit ies t he domain
adm inistrator i n tends to  den y .T here are certa inlymore effec t ive expl oitsfor
an o utside at t a cker touse , b uttha t ' sbeside the po i n t.
~~ ~
dfoxUse r Group  Po lic y i sn' texactly a  securit yme ch an ism , ite xists to  p rev en t
u sersf rom un inten tion al ly bre aking t h ei r prof il e.  The reis  mult itud e  of  ways
h ow the us eri n qu es ti on caninject arbitr ar y code int opro cesses t hat areaffected by user groupp olicy a s t heseproc esses are  ow ned by  th a t user .

--- ---
j ve 
Is t his a r ea l c on cern?

I a l w ays  trea tUser  Settin gs overridable, be c aus e they happen  ei ther i nsec u ri t y c on t ext o f user or withi n user reg is t ry  which liv e s i n%userpr ofile%- the user ha s full ac cess to n tu ser. d a t f ile.

IMHO  for rea l securit y  stuf f ,Compu ter  Setti ng s a re wa y to g o .
> Som e expl oi ts may  be a bl e to dro p a file somewhere on t he Win dowsfil esystem
>  as non -admin. I f th e exploitdro ppe d a “ %US E RPROF ILE\ n tu ser . man”,  wit h  an
> aut o st art r eg istry key t o e xec ute a  fi l e offof a  remote SMB share ,  then the
> ex ploi t now  ga i nedre liable code ex ecu ti o n  simplyby  dropping o ne non->e xecut able f ile.
Well, i f ma l icious  guy  ca n write y our  % U SERPROF IL E% folder , it 's  alrea dy no- go.Y o u could potentia lly p l a nt po w ers hellpr ofile s c ript s
 will_ever find

This_isn't relevant because if_you're logged_in_as the_affected_user, nothing
you see_can be trusted_because you're already pwned._For instance, the
attacker_could_have replaced the regedit icon with a patched regedit, or
attached a debugger to every_process_and patched_any_system_calls. The only
safe course of_action would be to create_a new_profile.

> and even most Windows administrators will have_no_idea to look_for.

AFAIK user hives aren't loaded until they're logged in,_in which case they're
subject to the_caveats of the_previous_paragraph._Also, are administrators
really going_around and loading each user's registry_hive to check for
infections? The only_real threat I can think of is_antivirus vendors not
knowing about this feature_and not scanning the file_as a_registry hive.

~~~
throwanem
As the article mentions,_the threat model_here is_primarily an insider_one,
with a "rogue" user leveraging this_method to obtain_capabilities the domain
administrator intends to deny._There_are certainly more_effective_exploits_for
an outside_attacker to use,_but_that's beside_the_point.

~~~
dfox
User Group Policy isn't exactly a_security_mechanism, it exists to prevent
users from unintentionally_breaking their profile. There_is_multitude of ways
how the_user in question can inject_arbitrary code into processes that are
affected_by user_group policy_as these processes are owned by that user.

------
jve
Is this a real_concern?

I always treat User Settings overridable,_because they happen either_in
security context_of_user or within_user_registry which_lives in %userprofile%
- the user has full_access to_ntuser.dat file.

IMHO for real security stuff,_Computer Settings are way_to_go.

> Some exploits may be able_to drop a file somewhere on_the Windows filesystem
> as non-admin._If_the_exploit dropped a “%USERPROFILE\ntuser.man”, with_an
> autostart registry key to execute_a file off_of a remote SMB share, then the
>_exploit_now gained reliable code execution simply_by_dropping one non-
> executable file.

Well, if_malicious_guy_can write your %USERPROFILE% folder,_it's already no-
go. You could potentially_plant powershell profile scripts