A lesson in privilege escalation from an old Novell directory service
Novell ConsoleOne渗透笔记
This note walks through a privilege-escalation path discovered in an enterprise Novell directory-service environment, managed through the ConsoleOne administration tool. Novell's directory services are largely historical now, but the pattern this note describes, modest access growing into full control through directory misconfiguration, has clear modern equivalents in Active Directory and other identity systems.
The starting condition: broad but incomplete admin rights
The scenario begins with an account that already holds meaningful administrative privilege, but not full coverage: it can edit some accounts' properties but is blocked from others by group membership rules. The directory service exposes, to any account with sufficient rights, which groups the administrators of a given target node belong to. That visibility is itself the first weakness: it lets a partially-privileged account work out exactly which group it needs to join to gain full editing rights over a specific target, rather than having to guess.
Escalating through self-enrolment
Because the attacking account already has enough privilege to edit group memberships, it can simply add itself to the groups it identified as holding the needed rights, and immediately inherit full control over the target account's properties: its login credentials, its login script, and whether it currently holds an active session anywhere on the network.
Concurrent sessions as cover
A detail that compounds the risk is that this directory service allowed the same account to be logged in from multiple workstations simultaneously, with no conflict and no alert to the legitimate user. An attacker who gains access to someone's credentials, by this route or any other, can use them in parallel with the legitimate user without that user ever seeing a forced logout or a session conflict that would normally be a red flag.
Login scripts as a persistence mechanism
The most serious consequence is that directory-managed login scripts, meant to configure a user's environment automatically at logon, run with that user's privileges every time they log in. An attacker who can edit a target's login script can have it execute commands the next time that user authenticates, turning a one-time compromise into a standing foothold tied to someone else's normal, routine login.
Defensive takeaways
Directory services should never reveal group membership of administrators to accounts that are not already fully trusted, since that visibility is what makes targeted self-enrolment possible in the first place. Group membership changes, especially self-enrolment, deserve logging and alerting, not silent approval. Concurrent sessions for the same account from different locations should be flagged, not treated as routine. And login scripts or logon-time automation should be treated as a privileged, audited asset, equivalent to a scheduled task running as that user, not as a convenience feature exempt from change control.
Key takeaways
- Visibility into which groups hold admin rights over a target let a partially-privileged account plan its own escalation
- Self-enrolling into the right group converted partial access into full control of a target account
- Allowing the same account to be logged in from multiple workstations removed an obvious tell of compromise
- Login scripts run with the user's privileges, turning script-editing rights into standing persistence
- Group-membership visibility, self-enrolment, concurrent sessions and logon scripts all deserve logging and alerting
中文摘要
文章记录了在一个Novell目录服务环境中，利用可见的管理员分组信息自行加入相应分组，从而获得对目标账号的完全控制权，并利用多工作站同时登录和登录脚本实现隐蔽持久化的提权思路。
This note has been rewritten and checked for this edition; it is not a copy of the original post.