Thibaud

Hi Infiltrator, thanks for the response, confirming my suspicion, and thanks for the link to the video, very nice.

Hi digip, Thanks for your answers. Yes, once in the website, an attacker could exploit other possible vulnerabilities and penetrate the company network even further. Yes, I fear retaliation by the company. It's an old-school management. That's why I haven't tested the exploit myself and I'm keeping things theoretical. But I'm hoping there must be some younger people in the company that are into the modern practices of the 21st century and that will do something positive with the disclosure. I carry inspiration from Google's article on rebooting security.

I found two security vulnerabilities in a friend's company and I'd like to do a responsible disclosure to that company so they fix it. For that, I need to know if it's possible to exploit the vulnerability and do an escalation of privilege so I can motivate my case for the disclosure. Here is the picture. I found a vulnerability in one of the company's websites with which I can obtain user ids and passwords to access that website. But the website in itself doesn't provide much useful information to an attacker, it's not interesting, so the risk if the website is exploited is moderate. What's most interesting, I know for a fact that the passwords to the website are synchronized with the passwords of the Windows users. That's to make it easier for users to remember their passwords; that's another security vulnerability. And the users have administrative privileges on their computers. And the risk if an account with administrative privileges is exploited is high as an attacker could penetrate the company's network. So both security vulnerabilities must be fixed. The problem is the following. The user ids on the website are different than the user ids of the Windows accounts. That's the catch, the passwords are the same but the user ids are different. My question is, supposing an attacker is on the same network as the target computer, can the attacker compromise the target computer knowing just the Windows administrative password (not the user id)? That's where my knowledge stops. I think the password alone is not enough, that the user id is necessary as well, but I bet it's possible to reveal user ids on Windows, I just don't know. Any comments? Thank you.