Hacker Reveals Easiest Trend To Hijack Privileged Windows User Session Without Password

You may hold out aware of the fact that a local Windows user alongside organisation rights as well as permissions tin reset the password for other users, but did y'all know that a local user tin also hijack other users' session, including domain admin/system user, without knowing their passwords?

Alexander Korznikov, an Israeli safety researcher, has of late demonstrated that a local privileged user tin fifty-fifty hijack the session of whatsoever logged-in Windows user who has higher privileges without knowing that user's password, using built-in ascendance business tools.

This play a joke on industrial plant on virtually all versions of Windows operating organisation as well as does non require whatsoever exceptional privileges. Korznikov is himself unable to figure out if it is a Windows characteristic or a safety flaw.

The upshot discovered past times Korznikov is non only new, every bit a French safety researcher, namely Benjamin Delpy, detailed a similar user session hijacking technique on his blog to a greater extent than or less half-dozen years ago.

Korznikov calls the assault a "privilege escalation as well as session hijacking," which could let an assaulter to hijack high-privileged users' session as well as hit unauthorized access to applications as well as other sensitive data.

For successful exploitation, an assaulter requires physical access to the targeted machine, but using Remote Desktop Protocol (RDP) session on a hacked machine; the assault tin hold out performed remotely every bit well.

Video Demonstrations as well as PoC Exploit Released!

Korznikov has also provided a few video demonstrations of a successful session hijacking (using Task manager, service creation, every bit good every bit ascendance line), along alongside Proof-of-Concept (PoC) exploit.

Korznikov successfully tested the flaw on the newest Windows 10, Windows 7, Windows Server 2008 as well as Windows Server 2012 R2, though to a greater extent than or less other researcher confirmed on Twitter that the flaw industrial plant on every Windows version, fifty-fifty if the workstation is locked.

While Microsoft does non deem it to hold out a safety vulnerability as well as to a greater extent than or less experts argued that a Windows user alongside administrative permissions tin produce anything, Korznikov explained a uncomplicated assault scenario to explicate how a malicious insider tin easily misuse this flaw:

"Some banking concern employee accept access to the billing organisation as well as its credentials to log in. One day, he comes to work, logging into the billing organisation as well as root to work. At lunchtime, he locks his workstation as well as goes out for lunch. Meanwhile, the organisation administrator gets to tin role this exploit to access employee's workstation."

"According to the bank's policy, administrator's concern human relationship should non accept access to the billing system, but alongside a twain of built-in commands inwards windows, this organisation administrator volition hijack employee's desktop which he left locked. From now, a sysadmin tin perform malicious actions inwards billing organisation every bit billing employee account."

Well, no doubt, alternatively an assaulter tin also dump out organisation retention to shout out back users' passwords inwards plaintext, but this is a long as well as complicated procedure compared to simply running tscon.exe alongside a session expose without leaving whatsoever describe as well as using whatsoever external tool.

The upshot has been known to Microsoft since final half-dozen years, as well as thus it's probable the companionship doesn't visit it a safety flaw every bit it requires local admin rights on the computer, as well as deems this is how its operating organisation is supposed to behave.