NT的密碼究竟放在哪

根據(jù)以前的發(fā)現(xiàn),windowsNT密碼雖然不象Windows95那樣以簡單加密形式包含在一個文件里面,而是一些雜亂的暗碼,分別藏在7個不同的地方。這篇最新發(fā)表的文章告訴我們WindowsNT密碼隱藏的第八個地方。Date: Mon, 22 Feb 1999 11:26:41 +0100

- M% P( @/ s' f5 ?  w6 G2 WFrom: Patrick CHAMBET <pchambet@club-internet.fr>

To: sans@clark.net
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
7 k& e9 f; y7 z6 jWe knew that Windows NT passwords are stored in 7 different places across
( Z$ a' v5 ^( ]the system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
be compared to the Windows Registry: the metabase is organised in Hives,
$ Q: R* Q( {3 xKeys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
The IIS 4.0 metabase contains these passwords:
  ]: U( ~/ ~7 B% o3 ^' m- IUSR_ComputerName account password (only if you have typed it in the
MMC)
5 }; u" u, n  R6 r! h& B- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
your virtual directories is located there.
0 x* J' v& _/ ~$ ~/ e1 P: O- The user name and password used to connect to the ODBC DSN called
- e7 g+ E! ^2 g"HTTPLOG" (if you chose to store your Logs into a database).
7 }3 ]5 T$ D' Z  }Note that the usernames are in unicode, clear text, that the passwords are
srambled in the metabase.ini file, and that only Administrators and SYSTEM
+ E2 U$ \! ]# R- Vhave permissions on this file.
BUT a few lines of script in a WSH script or in an ASP page allow to print
these passwords in CLEAR TEXT.
6 j- t8 S' ]  o; j: eThe user name and password used to connect to the Logs DSN could allow a
( [# h3 ~; R& M. U( G0 gmalicious user to delete traces of his activities on the server.
Obviously this represents a significant risk for Web servers that allow
- Q* j$ x6 s1 a+ S: r' k9 D1 @logons and/or remote access, although I did not see any exploit of the
problem I am reporting yet. Here is an example of what can be gathered:
"
1 b7 f# n( G8 [( F8 W$ C3 kIIS 4.0 Metabase
5 @4 a) I9 L. |7 Y1 U% I% H?Patrick Chambet 1998 - pchambet@club-internet.fr
--- UNC User ---
UNC User name: 'Lou'
UNC User password: 'Microsoft'
; i- [5 C1 L: _UNC Authentication Pass Through: 'False'
' e( e7 Y4 b4 s! N4 M--- Anonymous User ---
Anonymous User name: 'IUSR_SERVER'
# C+ ~  h/ n4 _- EAnonymous User password: 'x1fj5h_iopNNsp'
Password synchronization: 'False'
" A! `3 M9 }* ]+ e--- IIS Logs DSN User ---
/ j4 c9 x8 y6 S0 UODBC DSN name: 'HTTPLOG'
ODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
9 x( ]- V7 C! v- S; BODBC User password: 'xxxxxx'
2 {5 c% H% g9 v9 H) t- h' b- o/ L--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
# I1 n/ Y" ?: W/ YDefault Logon Domain: ''
8 R# \$ J$ k8 W; ^8 |"
. @6 {1 F% v9 D8 i* UFor example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
server (a). He need not to be an Administrator. He can be for example
" [. @2 S7 e  [. S* r+ _7 p+ yan IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
: y2 o1 g/ D, x% Q6 o, h" F8 _the login name and password of the account used to access to a virtual
directory located on another server, say (b).
Now, Bob can use these login name and passord to logon on server (b).
) r" U5 {* t* @, E6 hAnd so forth...
9 H8 P* z( U5 f8 E( J+ T7 A- sMicrosoft was informed of this vulnerability.
_______________________________________________________________________
Patrick CHAMBET - pchambet@club-internet.fr
6 w- }  t& g: y7 A: YMCP NT 4.0
7 z! r5 p$ J: x$ ~% aInternet, Security and Microsoft solutions
: e8 B) n( Y* F0 ie-business Services
IBM Global Services
# J) d( v' N+ ^5 Y% G