NT的密码究竟放在哪

根据以前的发现,windowsNT密码虽然不象Windows95那样以简单加密形式包含在一个文件里面,而是一些杂乱的暗码,分别藏在7个不同的地方。这篇最新发表的文章告诉我们WindowsNT密码隐藏的第八个地方。Date: Mon, 22 Feb 1999 11:26:41 +0100

From: Patrick CHAMBET <pchambet@club-internet.fr>

To: sans@clark.net
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
' E' h4 A% _2 \5 A' |9 bHi all,
We knew that Windows NT passwords are stored in 7 different places across
- `' Q% m1 S7 N+ E$ G+ u1 Jthe system. Here is a 8th place: the IIS 4.0 metabase.
6 x8 q, z: g* t# _# I  F9 V0 IIIS 4.0 uses its own configuration database, named "metabase", which can
" v) u& @* [' @7 D+ wbe compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
- e+ K5 K1 ~9 T0 g/ ?6 T5 jC:\WINNT\system32\inetsrv\MetaBase.bin
The IIS 4.0 metabase contains these passwords:
- IUSR_ComputerName account password (only if you have typed it in the
MMC)
4 J* v- J: |+ k1 ?6 s- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
your virtual directories is located there.
$ S( j7 ]4 W9 E# b* }. E& R- The user name and password used to connect to the ODBC DSN called
"HTTPLOG" (if you chose to store your Logs into a database).
Note that the usernames are in unicode, clear text, that the passwords are
srambled in the metabase.ini file, and that only Administrators and SYSTEM
have permissions on this file.
BUT a few lines of script in a WSH script or in an ASP page allow to print
4 X8 y) O7 p! Z4 z! nthese passwords in CLEAR TEXT.
4 w# i9 V/ H5 j, w7 x: {* zThe user name and password used to connect to the Logs DSN could allow a
malicious user to delete traces of his activities on the server.
. c9 [! h5 O* H- pObviously this represents a significant risk for Web servers that allow
# A3 ?, ^, Q( p8 elogons and/or remote access, although I did not see any exploit of the
problem I am reporting yet. Here is an example of what can be gathered:
"
* z+ H( c# A/ p' O- {' yIIS 4.0 Metabase
?Patrick Chambet 1998 - pchambet@club-internet.fr
--- UNC User ---
% L* l) X4 i: gUNC User name: 'Lou'
8 s# q  }7 ?9 C9 \UNC User password: 'Microsoft'
UNC Authentication Pass Through: 'False'
/ k. F. a" }9 ^# @9 D0 s& q--- Anonymous User ---
( `& x. l6 F6 a" O5 B3 wAnonymous User name: 'IUSR_SERVER'
Anonymous User password: 'x1fj5h_iopNNsp'
Password synchronization: 'False'
--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
ODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
ODBC User password: 'xxxxxx'
--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
1 \; ?* s# }- {# i5 X  P: P) CWAM User password: 'Aj8_g2sAhjlk2'
( R6 k- R) ?, Q3 q' ^Default Logon Domain: ''
"
8 X/ `! z  P+ a8 [/ S- V! q. ?9 n! r9 VFor example, you can imagine the following scenario:
; [5 R, P3 U! O# ~* @1 HA user Bob is allowed to logon only on a server hosting IIS 4.0, say
6 Q; T7 k! r" e2 d) Userver (a). He need not to be an Administrator. He can be for example
an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
0 G% s3 g9 p5 t' R: d$ bthe login name and password of the account used to access to a virtual
$ Z+ _+ f# f: e6 e/ ]! `/ Cdirectory located on another server, say (b).
$ m) K  E( n2 M) E, S5 q/ UNow, Bob can use these login name and passord to logon on server (b).
1 D- A9 i# z0 X+ sAnd so forth...
Microsoft was informed of this vulnerability.
_______________________________________________________________________
. i- T7 m" ]% ^0 XPatrick CHAMBET - pchambet@club-internet.fr
MCP NT 4.0
Internet, Security and Microsoft solutions
2 o* J* [( W) ~6 M' ]# A5 v7 fe-business Services
: W7 J  P! u# a* U. YIBM Global Services