nt-part2_81
Analysis of the Security of Windows NT
1 March 1999
81
FIGURE 18. Setup of secure channel
Message 49-50 is the logon of the user. The NetrLogonSamLogon() will contain the
username and the password for the user. The reply will contain most of the information
on the user in the SAM database for cashing on the client. The cash we believe is the
local SAM database.
The messages 54-57 is a remote logon, i.e. a mounting of a share. From the user to the
\NETLOGON share. The purpose of this is probably to run a logon script that appar-
ently is not present.
Most of the RPC structures used in the messages above are described in [37].
C NTCreate&X File=\NETLOGON
RPC Bind
RPC Ack
R NTCreate&X
NetrServerReqChallenge()
Responce
NetrServerAutheticate2()
Responce