Microsoft Windows SMB Registry : Winlogon Key Permission Weakness
High Nessus Plugin ID 10429
SynopsisLocal users can gain SYSTEM privileges.
DescriptionThe registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon is writeable by users who are not in the admin group.
This key contains a value which defines which program should be run when a user logs on.
As this program runs in the SYSTEM context, the users who have the right to change the value of this key can gain more privileges on this host.
SolutionUse regedt32 and set the permissions of this key to :
- admin group : Full Control
- system : Full Control
- everyone : Read