NT的密碼究竟放在哪

根據(jù)以前的發(fā)現(xiàn),windowsNT密碼雖然不象Windows95那樣以簡(jiǎn)單加密形式包含在一個(gè)文件里面,而是一些雜亂的暗碼,分別藏在7個(gè)不同的地方。這篇最新發(fā)表的文章告訴我們WindowsNT密碼隱藏的第八個(gè)地方。Date: Mon, 22 Feb 1999 11:26:41 +0100
. j$ o4 U+ O8 [
From: Patrick CHAMBET <[email protected]>
* j. O6 s/ G9 M+ s& V% N" _
" |" \1 l; w9 a  h- U0 _To: [email protected]
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
1 |+ B0 t6 V  I: x! `; \* P$ ^We knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
be compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
$ g$ o! L0 b2 gC:\WINNT\system32\inetsrv\MetaBase.bin
The IIS 4.0 metabase contains these passwords:
! u+ m. z1 ]; }) p) a8 S  P& }- IUSR_ComputerName account password (only if you have typed it in the
* \# N, V9 d) i2 M7 f" \1 zMMC)
- IWAM_ComputerName account password (ALWAYS !)
' t9 ?; e" K5 L/ {( C% t- UNC username and password used to connect to another server if one of
your virtual directories is located there.
+ U4 L/ k8 z& T+ }- The user name and password used to connect to the ODBC DSN called
2 K# s8 h% l. ^0 D) E6 ["HTTPLOG" (if you chose to store your Logs into a database).
Note that the usernames are in unicode, clear text, that the passwords are
srambled in the metabase.ini file, and that only Administrators and SYSTEM
have permissions on this file.
BUT a few lines of script in a WSH script or in an ASP page allow to print
0 ?8 u3 w- `) u# G% c) a$ g( n0 Y% Zthese passwords in CLEAR TEXT.
  x8 u3 f# ]2 s$ b' y( C8 F  iThe user name and password used to connect to the Logs DSN could allow a
' D3 I% I/ P) U* `" j3 g3 T+ {; Tmalicious user to delete traces of his activities on the server.
9 e0 M5 x1 s" [  l& X9 sObviously this represents a significant risk for Web servers that allow
2 _1 I& Y0 j- a& A* z6 L1 klogons and/or remote access, although I did not see any exploit of the
problem I am reporting yet. Here is an example of what can be gathered:
"
IIS 4.0 Metabase
0 @7 L# @+ f# h! Y0 @+ I! \?Patrick Chambet 1998 - [email protected]
: o& ]3 F: `! {& f--- UNC User ---
+ S- [* p# {# h* V! }* e" I9 bUNC User name: 'Lou'
UNC User password: 'Microsoft'
UNC Authentication Pass Through: 'False'
--- Anonymous User ---
Anonymous User name: 'IUSR_SERVER'
& t) `" P; ]' I9 HAnonymous User password: 'x1fj5h_iopNNsp'
Password synchronization: 'False'
/ o& ^5 \( `, H3 p. U! A$ [# r--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
! ~1 F2 ]) n' U4 SODBC table name: 'InternetLog'
- L$ r7 [# E" r  v6 cODBC User name: 'InternetAdmin'
2 l9 K2 r: ?. R" ^6 g! x( XODBC User password: 'xxxxxx'
--- Web Applications User ---
' d& e) U( R* u' g+ `8 zWAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
5 O% w- H+ d& X7 U: m+ |' VDefault Logon Domain: ''
"
For example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
server (a). He need not to be an Administrator. He can be for example
an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
directory located on another server, say (b).
Now, Bob can use these login name and passord to logon on server (b).
And so forth...
Microsoft was informed of this vulnerability.
_______________________________________________________________________
Patrick CHAMBET - [email protected]
% g3 p: T6 j/ U) e9 p4 ]( g7 TMCP NT 4.0
Internet, Security and Microsoft solutions
e-business Services
IBM Global Services
9 l& n% x; F% ?1 J5 }4 t. |. G