NT的密碼究竟放在哪

根據(jù)以前的發(fā)現(xiàn),windowsNT密碼雖然不象Windows95那樣以簡單加密形式包含在一個文件里面,而是一些雜亂的暗碼,分別藏在7個不同的地方。這篇最新發(fā)表的文章告訴我們WindowsNT密碼隱藏的第八個地方。Date: Mon, 22 Feb 1999 11:26:41 +0100
/ _/ D/ l7 [' [+ `6 z. H9 H
From: Patrick CHAMBET <[email protected]>
0 P5 W3 X# Q8 ?  I
To: [email protected]
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
" X8 ]0 b& j. Y% L$ J6 f3 QHi all,
We knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
- B/ B4 y+ T+ T! l/ ^IIS 4.0 uses its own configuration database, named "metabase", which can
be compared to the Windows Registry: the metabase is organised in Hives,
* Q; I+ O( t) E- q  sKeys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
5 L" y" g6 E' g* q* u  bThe IIS 4.0 metabase contains these passwords:
. Z) k( R* N% y/ k! t6 E- IUSR_ComputerName account password (only if you have typed it in the
MMC)
- IWAM_ComputerName account password (ALWAYS !)
3 q" s# g+ w4 [& |% }" l9 Y- UNC username and password used to connect to another server if one of
- ?7 ^1 |- y  Y$ G2 y) O. M( b. nyour virtual directories is located there.
- The user name and password used to connect to the ODBC DSN called
9 k3 g) e, H4 z4 v& z! f"HTTPLOG" (if you chose to store your Logs into a database).
0 K% {2 d1 X! q; L# t0 Z/ F2 GNote that the usernames are in unicode, clear text, that the passwords are
3 ^% \4 E- P' n! _2 p& l, v% H  v1 Bsrambled in the metabase.ini file, and that only Administrators and SYSTEM
have permissions on this file.
BUT a few lines of script in a WSH script or in an ASP page allow to print
9 F3 I: L. n) W# U! u$ H! fthese passwords in CLEAR TEXT.
The user name and password used to connect to the Logs DSN could allow a
malicious user to delete traces of his activities on the server.
Obviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
- }6 M+ h& m# qproblem I am reporting yet. Here is an example of what can be gathered:
2 d3 M8 F* g- v! Q; j( U"
IIS 4.0 Metabase
9 r7 u- k6 w  v5 _. I% K  p3 p* V: m0 W?Patrick Chambet 1998 - [email protected]
--- UNC User ---
1 F9 E5 e! X, v$ p) u- qUNC User name: 'Lou'
+ y9 M: @7 t# q% AUNC User password: 'Microsoft'
UNC Authentication Pass Through: 'False'
--- Anonymous User ---
9 A$ X0 S% n- }6 h( I9 XAnonymous User name: 'IUSR_SERVER'
) t9 m5 [; `; Z( v2 i2 ]Anonymous User password: 'x1fj5h_iopNNsp'
  U0 ?, f: d: o. b, `7 g5 xPassword synchronization: 'False'
--- IIS Logs DSN User ---
& \, _9 P! F- b' g3 fODBC DSN name: 'HTTPLOG'
ODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
* _1 R- a+ Z9 i2 {3 VODBC User password: 'xxxxxx'
--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
7 m$ c0 D2 N- g% ~4 zWAM User password: 'Aj8_g2sAhjlk2'
Default Logon Domain: ''
"
For example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
8 l1 {! P, G" eserver (a). He need not to be an Administrator. He can be for example
4 k; d1 P9 @- J! T- J+ A( C" ian IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
0 M& W; L" ^5 p+ ~9 L  _  sdirectory located on another server, say (b).
Now, Bob can use these login name and passord to logon on server (b).
And so forth...
Microsoft was informed of this vulnerability.
9 `$ j$ j: O- M_______________________________________________________________________
$ F: z) |$ z7 J  R* @Patrick CHAMBET - [email protected]
% S3 Z  g9 e- y. R: J7 L# k( Z+ {MCP NT 4.0
Internet, Security and Microsoft solutions
/ D( K/ }! n2 y1 d1 M4 u% z2 je-business Services
IBM Global Services
- }# |4 i8 i+ \9 E