Mini Pen Test Diaries Story:
The year was 2010, and I was onsite at a UK local authority doing an internal network assessment.
One of the tasks was - if given a standard, non-privileged, domain user account, with minimal access afforded to it - what could I do? Could I access sensitive documents? Could I login to systems I shouldn't be able to? Could I elevate myself. Standard stuff.
I got my account, and immediately started fishing around the main file share with the users home directories on it. To my immense surprise, I found out that I was able to access the content of every single users home directory. Including all the top level folks.
They must've accidentally given me some account in an IT group or something, so I check it out. Nope - groups look normal.
The permissions on the share look pretty normal too.
I play around with the account more and more and encounter zero resistance to anything, access wise.
Something must be very wrong - but what?
Finally I go over and speak to the IT people who I'd been working with.
"So," I said. "This account, it's supposed to have a very minimal permissions set right?"
"Yes, the lowest of the low." They reply.
"So how come I can get into all these files?" I ask, and show them my rummaging around the very senior peoples confidential files.
"You shouldn't be able to do that!!"
Now, the three of us are rapidly trying to figure out what the heck is going on. It's surprisingly difficult to figure out.
Eventually, I make what to this day remains one of my all time favorite pen testing discoveries.
This organisation, had somehow, managed to add the entire "Domain Users" group to the "Domain Admins" group!
All 1,500 people who worked there, had domain admin access. And after investigation, we found out it had been like that for 10 months.
Someone couldn't get something working, until they found this "fix".
Amazing.
For more, slightly less mini pen test diaries stories, check out https://infosecdiaries.com.
