NT的密码究竟放在哪

根据以前的发现,windowsNT密码虽然不象Windows95那样以简单加密形式包含在一个文件里面,而是一些杂乱的暗码,分别藏在7个不同的地方。这篇最新发表的文章告诉我们WindowsNT密码隐藏的第八个地方。Date: Mon, 22 Feb 1999 11:26:41 +0100

From: Patrick CHAMBET <pchambet@club-internet.fr>

+ G1 g2 Q+ {3 M: r% ~4 a6 Z* JTo: sans@clark.net
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
We knew that Windows NT passwords are stored in 7 different places across
' g, ?  S7 I1 \0 k7 K3 b9 Wthe system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
2 p$ J% x' s8 m9 ]be compared to the Windows Registry: the metabase is organised in Hives,
! ]( n  N$ K+ G0 y! P0 F7 k6 ?1 hKeys and Values. It is stored in the following file:
2 Z8 J( Y* ?0 [3 Y% k( rC:\WINNT\system32\inetsrv\MetaBase.bin
+ j6 q; F4 o) Y$ xThe IIS 4.0 metabase contains these passwords:
- IUSR_ComputerName account password (only if you have typed it in the
. A0 H& U* n3 DMMC)
) O/ L7 L# Z" t; ~' N- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
3 H# B0 B0 I( L6 ~  Oyour virtual directories is located there.
- The user name and password used to connect to the ODBC DSN called
"HTTPLOG" (if you chose to store your Logs into a database).
( g# o, S( \: T6 ^% VNote that the usernames are in unicode, clear text, that the passwords are
, E) a% \, D& N* h9 ]3 N+ L6 ]! Esrambled in the metabase.ini file, and that only Administrators and SYSTEM
9 n5 y3 j6 r: n7 y  `# ]2 O+ phave permissions on this file.
* I9 G* n$ G" c$ ^BUT a few lines of script in a WSH script or in an ASP page allow to print
9 L  a# ^: Z2 p, F" Jthese passwords in CLEAR TEXT.
The user name and password used to connect to the Logs DSN could allow a
1 j+ d3 K; ?, ~* C) k- Ymalicious user to delete traces of his activities on the server.
* I- F6 m1 L, k+ M& }Obviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
0 E7 `) F1 Q( Jproblem I am reporting yet. Here is an example of what can be gathered:
"
IIS 4.0 Metabase
1 F7 }7 E  `% f* N?Patrick Chambet 1998 - pchambet@club-internet.fr
) M$ a* k. B  ^3 y2 |: A5 e--- UNC User ---
3 b$ z3 t) o& p  R3 o7 p) k  XUNC User name: 'Lou'
UNC User password: 'Microsoft'
3 y) J+ e% e% y& n7 r% q" RUNC Authentication Pass Through: 'False'
--- Anonymous User ---
Anonymous User name: 'IUSR_SERVER'
Anonymous User password: 'x1fj5h_iopNNsp'
1 W3 j. E. G- n* tPassword synchronization: 'False'
--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
ODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
ODBC User password: 'xxxxxx'
3 R: L9 Y" T0 X2 a$ b--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
- T/ O$ _/ }' B8 {- dWAM User password: 'Aj8_g2sAhjlk2'
Default Logon Domain: ''
4 b* v8 w& s9 }/ L! [5 a"
For example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
, V9 M+ z- S0 X2 \  cserver (a). He need not to be an Administrator. He can be for example
an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
directory located on another server, say (b).
+ ~( p$ _9 V: TNow, Bob can use these login name and passord to logon on server (b).
And so forth...
1 j% W9 `: J$ a. E( u4 z3 t. wMicrosoft was informed of this vulnerability.
, |. D. j/ s; @  Q, D* v9 |_______________________________________________________________________
  H5 ?/ \0 b2 u- J/ i1 M8 Y3 kPatrick CHAMBET - pchambet@club-internet.fr
MCP NT 4.0
Internet, Security and Microsoft solutions
e-business Services
IBM Global Services
* H- Z, q: w5 O0 Z( I9 R0 ?