Exploiting Windows authentication

Before we can exploit Windows authentication, we first must understand how it works, as well as the accounts, groups, and processes involved.

Everything executed in Windows will take place in the context of a user account, even low-level security provider modules. The user account contains a security identifier (SID). This SID determines the trusts and permissions afforded to the user and what operations that account can perform. For example, the SYSTEM account has access to the core operating system and is used by many applications as its running account in order to get the level of access needed to perform their tasks. If you launch Task Manager on your machine and select Details, the screen will show all the running processes and the user context of each process in the User name column. An example of the Task Manager dialog box with user context can be seen in the following figure:

Figure 5.2 – Process list with...