Security Diaries All About Security
Related Articles
In this article, we are going to discuss the permissions in windows. I am not going to in-depth analysis but what I will try to do is to give an overview of how windows handle permissions. This is going to help you in privilege escalation of windows.
These are the list of things that we will be discussing:
- User accounts
- Service accounts
- Groups
- Resources
- ACLs and ACEs
Windows Accounts
User accounts: We can consider these as a collection of settings, configurations bound to one identity. Usually, the local administrator account is created by default while installation and there is a possibility of guest accounts as well.
Service accounts: These accounts are used to run services on windows. Login functionality is disabled for these accounts i.e we cannot log in to windows using services account. Some of the examples of these accounts are LOCAL, NETWORK and SYSTEM. The SYSTEM services account will have the highest privileges.
Windows User Groups Management
Groups: Groups are used to categorize the users and to make management easy. For easy permission management of all the users related to a specific category.
There are two types of groups.
- Regular groups: a group which contains a set of users like administrators and normal users.
- Pseudo groups: This group is dynamic which contains users based on interactions.
Resources
Resources are nothing but a file, directory, and registry. Its any entity that a user is trying to access
ACLs and ACEs:
ACL: Access control list will control the user’s permission to specific resources like file, directory and registry
ACE: Access Control Entry controls the relationship between a user and access right.
The difference between ACL and ACE is, ACL controls whether a user has access to a specific file or not and ACE controls the same user has editing rights or only view.
These are few things which help in understand windows privilege escalation going forward.
