#46891 - 2003-10-17 03:53 PM
Re: Piping files in kix
|
Richard H.
Administrator
   
Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
|
What text files?
Open the compiled exe with notepad. You will see all the text strings in the executable, including the command line (and the password).
If the command line is encrypted then it is more secure, otherwise it doesn't take much of a hack, does it?
quote: Also....the temp files remove themselves when the script is complete and users do not have the ability to access a machine remotely nor can they access their console while the script is executing so it would be very hard for them to even get to these text files in the first place
How do you stop them opening the executable after they are connected? Or copying the executable and taking it home to play with? Or re-running/terminating it until they get the temporary files?
You (and anyone else who comes across this thread) need to understand that finding plain text passwords in executables is as simple as opening them with notepad.
It may well be that this level of obfuscation is sufficient in your environment, but if you have users sophisticated enough to use L0phtCrack they won't be misdirected for long.
If you understand the implications of what you are doing and feel that the risk is acceptable then go ahead, but I know our security auditors would blow a fuse.
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
1 registered
(Allen)
and 1198 anonymous users online.
|
|
|