Re: [Full-disclosure] Undeletable user account.



Quoting James Bower <hando311@xxxxxxxxxxx>:

Hi all, one of my servers has recently been compromised. No suprise but the hacker created himself a user account. The problem is that I can't seem to delete the account. The account is not part of any group. When you look at the account it and go to Member Of it doesn't show anything. When I try to delete it as the local admin I

You might find an interesting answer here:

http://neworder.box.sk/newsread.php?newsid=13948

I have used the exploit described therein and it does work as advertised.

t

-------------------------------------------------
Email solutions, MS Exchange alternatives and extrication,
security services, systems integration.
Contact:    services@xxxxxxxxxxxxxx


_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: Windows Passwords
    ... "Windows Vista for Dummies" manual. ... I started by creating a test user account. ... The reason I say this is that, when I turned the Guest ...
    (microsoft.public.windows.vista.general)
  • Re: Help Me Understand User Accounts
    ... When you log off and log back in as the limited user you'll be able to ... you'll need to set up a new email account (under the new ... limited user account) the same as you had before, ... Administrator accounts are the default type of account ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Windows Service Account
    ... you can use the find IIDentity to the user to give folder permissions ... The OP does not need to find which user account is running the Windows ... Local System account has mighty ...
    (microsoft.public.dotnet.general)
  • Re: DC Temporarily Off-line, Remaining DC Struggling
    ... suspects this issue is related to the account and roaming profile. ... Please make sure all user accounts are replicated to win2k3 DC. ... Does this issue only occurs if the user account uses ...
    (microsoft.public.windows.server.active_directory)
  • Re: Logoff / Slow Bootups / Outlook attachements / Outlook Not res
    ... When you logon the problematic user account on the good user's computer, ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)