NT的密码究竟放在哪

根据以前的发现,windowsNT密码虽然不象Windows95那样以简单加密形式包含在一个文件里面,而是一些杂乱的暗码,分别藏在7个不同的地方。这篇最新发表的文章告诉我们WindowsNT密码隐藏的第八个地方。Date: Mon, 22 Feb 1999 11:26:41 +0100

$ j, ?8 J+ c$ y9 gFrom: Patrick CHAMBET <pchambet@club-internet.fr>

' E: S" E" F9 x: w! _  y: V1 h- MTo: sans@clark.net
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
! I8 }* C, T, W, E! zWe knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
8 G) t, w: {" qbe compared to the Windows Registry: the metabase is organised in Hives,
- }# f4 ^* B( p, C  I* xKeys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
/ y# @% h( R  I, \2 m& jThe IIS 4.0 metabase contains these passwords:
" J# n2 D5 R  F" ^! ]& m- IUSR_ComputerName account password (only if you have typed it in the
$ l4 C% J* c& L" N% \3 vMMC)
- T9 o$ i! I+ K" @- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
* \) N. [* q+ O3 W% b. N2 [- X0 ayour virtual directories is located there.
- The user name and password used to connect to the ODBC DSN called
" M- B1 R5 @, L5 \4 a"HTTPLOG" (if you chose to store your Logs into a database).
Note that the usernames are in unicode, clear text, that the passwords are
srambled in the metabase.ini file, and that only Administrators and SYSTEM
have permissions on this file.
3 O7 o4 F2 i' w* K, S" @BUT a few lines of script in a WSH script or in an ASP page allow to print
- X; n3 y- w6 [: x2 Sthese passwords in CLEAR TEXT.
The user name and password used to connect to the Logs DSN could allow a
malicious user to delete traces of his activities on the server.
Obviously this represents a significant risk for Web servers that allow
) E8 t1 O) [# j* x( t$ v' m8 w1 k- G9 Nlogons and/or remote access, although I did not see any exploit of the
  X# u$ I, T& c5 s% c. j9 wproblem I am reporting yet. Here is an example of what can be gathered:
"
% C8 ?4 Y" y' ?. T  _7 O7 XIIS 4.0 Metabase
?Patrick Chambet 1998 - pchambet@club-internet.fr
3 v' h' }! ^+ d4 \+ j$ ~--- UNC User ---
UNC User name: 'Lou'
9 ~% k. V& K# j& _6 u$ Z3 BUNC User password: 'Microsoft'
* e  L! k0 b3 g' J9 m# h  xUNC Authentication Pass Through: 'False'
0 ^! N: y3 h8 H0 R. k, O3 F$ [--- Anonymous User ---
Anonymous User name: 'IUSR_SERVER'
Anonymous User password: 'x1fj5h_iopNNsp'
% E* n7 `4 e4 D0 \( oPassword synchronization: 'False'
6 S' i' q7 v3 r& \9 ^--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
% l9 {8 \; n& \% N9 t( p! xODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
ODBC User password: 'xxxxxx'
9 B6 g  H3 R' g--- Web Applications User ---
6 g* K! W, l2 |2 b: O8 e$ y, uWAM User name: 'IWAM_SERVER'
: R9 S4 C2 U1 [0 t) zWAM User password: 'Aj8_g2sAhjlk2'
% a) \5 e$ `3 o/ [9 R. k& O, v8 p! uDefault Logon Domain: ''
"
% c( ?; _$ R  C9 _7 TFor example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
0 N& c* F9 f! Y9 ^- h+ `server (a). He need not to be an Administrator. He can be for example
6 Z2 N$ M0 n5 f, J+ b! ~an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
, D' x/ i* F5 S# D9 Jthe login name and password of the account used to access to a virtual
) j! s7 ?( `1 q! B- b% cdirectory located on another server, say (b).
Now, Bob can use these login name and passord to logon on server (b).
And so forth...
3 o. |! \2 W& L% |' p# x  WMicrosoft was informed of this vulnerability.
& i. e+ u7 E) J( l3 t. K# S7 L: }_______________________________________________________________________
Patrick CHAMBET - pchambet@club-internet.fr
MCP NT 4.0
0 B: R; |0 r5 _3 M- E0 V4 b8 T  A$ KInternet, Security and Microsoft solutions
e-business Services
. ^9 x; {, b7 b! r5 T) _7 wIBM Global Services