NT的密碼究竟放在哪

根據(jù)以前的發(fā)現(xiàn),windowsNT密碼雖然不象Windows95那樣以簡單加密形式包含在一個文件里面,而是一些雜亂的暗碼,分別藏在7個不同的地方。這篇最新發(fā)表的文章告訴我們WindowsNT密碼隱藏的第八個地方。Date: Mon, 22 Feb 1999 11:26:41 +0100

From: Patrick CHAMBET <pchambet@club-internet.fr>
  V( o) |1 Q; a
+ m- k$ o6 i* k5 o+ H" m  RTo: sans@clark.net
: y$ h( R' r. {1 d5 D+ Y% BSubject: Alert: IIS 4.0 metabase can reveal plaintext passwords
7 H. B+ Y5 j/ K, ?Hi all,
$ t) ]2 d8 j, J2 H. h& p! }/ `We knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
# Q: H5 t9 k' w8 c. s; i3 Q$ Vbe compared to the Windows Registry: the metabase is organised in Hives,
1 y6 e) @( O% H( A. }( z; k8 j% ~Keys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
1 i  G5 g& C) J; e  ZThe IIS 4.0 metabase contains these passwords:
- IUSR_ComputerName account password (only if you have typed it in the
MMC)
, |9 h5 R/ L* `- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
your virtual directories is located there.
- The user name and password used to connect to the ODBC DSN called
"HTTPLOG" (if you chose to store your Logs into a database).
Note that the usernames are in unicode, clear text, that the passwords are
srambled in the metabase.ini file, and that only Administrators and SYSTEM
have permissions on this file.
, [* r2 ~3 d# L7 G( Q! C. MBUT a few lines of script in a WSH script or in an ASP page allow to print
% N+ ^% [2 n8 Z, U8 z, pthese passwords in CLEAR TEXT.
6 G/ b# c$ h: |$ l4 \4 zThe user name and password used to connect to the Logs DSN could allow a
malicious user to delete traces of his activities on the server.
$ B6 o  b7 ~8 e% t' S: EObviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
problem I am reporting yet. Here is an example of what can be gathered:
"
IIS 4.0 Metabase
?Patrick Chambet 1998 - pchambet@club-internet.fr
+ ]  j  ^  y2 `& N$ V--- UNC User ---
6 G1 N  _7 y3 i2 t& s* pUNC User name: 'Lou'
5 E5 r# y0 v3 D0 dUNC User password: 'Microsoft'
( `  _/ k. x0 N1 `UNC Authentication Pass Through: 'False'
4 M5 G- w! D' E3 m--- Anonymous User ---
8 p4 ^9 |# c& cAnonymous User name: 'IUSR_SERVER'
5 d+ O9 A% E- c/ B. o7 _& v7 dAnonymous User password: 'x1fj5h_iopNNsp'
( }0 B# h/ V5 ~% K) o+ _Password synchronization: 'False'
8 ]1 a- Q$ D1 i) K--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
ODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
4 E" u* F/ X, Q- k$ q! h8 oODBC User password: 'xxxxxx'
--- Web Applications User ---
: k' d3 k! t6 @9 ?7 u' d, y' iWAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
Default Logon Domain: ''
"
For example, you can imagine the following scenario:
* j, V7 `6 \, l4 }A user Bob is allowed to logon only on a server hosting IIS 4.0, say
server (a). He need not to be an Administrator. He can be for example
an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
: w& W+ d2 b! e/ d2 M& Kdirectory located on another server, say (b).
Now, Bob can use these login name and passord to logon on server (b).
And so forth...
Microsoft was informed of this vulnerability.
_______________________________________________________________________
Patrick CHAMBET - pchambet@club-internet.fr
MCP NT 4.0
Internet, Security and Microsoft solutions
e-business Services
IBM Global Services
6 _# i( z+ x4 {3 Y* y