Microsoft Windows NT 4.0 - User Shell Folders

EDB-ID:

19798


Author:

anonymous

Type:

local


Platform:

Windows

Date:

2000-03-09


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux , the course required to become an Offensive Security Certified Professional (OSCP)

GET CERTIFIED

source: https://www.securityfocus.com/bid/1042/info


The registry value 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup 

specifies the shared startup folder for all users on a system. This key is set to be writeable by any authenticated user. Therefore, any user could specify a folder with a shortcut to a program of their choice that will be run any time a user logs in, at the privilege level of that user.

Example: 

On a Domain Controller, a batch file containg the following commands:
--
net user attacker /add /domain
net group administrators attacker /add /domain
--
could be put into the folder c:\hackstartup.
Then the registry value 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup 
could be set to the string "c:\hackstartup".
The next time an administrator logs on to that machine, the 'attacker' account will be created and added to the Administrators group on the PDC of the domain.