Re: Windows 7/8 admin account installation password stored in th
1. I didn't find an explanation about this behavior that deals with
installation password, although this LSA Secret is well known to
contain passwords, mainly from Windows XP era. Could you provide a
link?
It also hasn't been fixed in Window 8 released this year.
2. You could e.g. retrieve a password from one vulnerable machine
(where physical access or admin shell is possible) and use it against
more secure ones sharing same admin password, typically when a Windows
image is replicated over a network to multiple machines.
Anyhow, having a cleartext password residue somewhere without
documentation looks like a sad bug to me.
Xavier
On Thu, Jul 11, 2013 at 7:35 PM, Rob <synja@synfulvisions.com> wrote:
> Two things:
> 1. This was made public sometime in 2012 or earlier IIRC.
> 2. Exploiting this requires the same permission levels that would be
> required to change or access the password anyway. Where's the realistic
> security threat?
>
> Rob
>
討論串 (同標題文章)
完整討論串 (本文為第 2 之 3 篇)：