Re: Bypassing NTFS ACL

From: Frank Knobbe (frank_at_knobbe.us)
Date: 02/22/05

  • Next message: Thomas Brennan: "RE: Bypassing NTFS ACL" 
    To: chris@compucounts.com
Date: Mon, 21 Feb 2005 22:52:59 -0600

    On Fri, 2005-02-18 at 15:49 -0500, chris@compucounts.com wrote:
    > I know there are plenty of simple solutions to this problem such as
    > joining the group, taking ownership of the directory, etc, however I'm
    > looking for a slightly more difficult solution that wouldn't be noticed.
    > I want to bypass the ACL.

    > Is there any means of bypassing the ACL while the system is online
    > without rewriting it?

    Users and Groups with the Backup/Restore user privilege can bypass file
    ACLs. Unless Auditing of User Privileges is enabled AND someone reviews
    the logs, chances are good that the addition of that User Right to your
    account goes unnoticed.

    When it comes to files ACLs, no one is more powerful than the Backup
    account :)

    > I'm going to reiterate: Yes there are plenty of other ways to do this,
    > but I want to be difficult :) This could come in handy later on.

    "Difficult" AND "handy later on" usually means root kit :)

    Cheers,
    Frank

  • Next message: Thomas Brennan: "RE: Bypassing NTFS ACL"