NT的密码究竟放在哪

根据以前的发现,windowsNT密码虽然不象Windows95那样以简单加密形式包含在一个文件里面,而是一些杂乱的暗码,分别藏在7个不同的地方。这篇最新发表的文章告诉我们WindowsNT密码隐藏的第八个地方。Date: Mon, 22 Feb 1999 11:26:41 +0100
8 j! N; G3 Q5 P8 u3 j! x7 N
% b9 C; {8 h) Z8 LFrom: Patrick CHAMBET <pchambet@club-internet.fr>
% q) b+ Y; s8 K8 E" v* R- L, R: \
  `# E3 l& }  ]" ]3 ]To: sans@clark.net
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
  |+ T, R3 n9 O8 F) ^Hi all,
* c' ]4 h1 z/ g8 _% |3 x6 b7 ZWe knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
/ q4 d. c3 Q/ ~/ w9 w7 ]IIS 4.0 uses its own configuration database, named "metabase", which can
, ]5 v" F# U2 [be compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
The IIS 4.0 metabase contains these passwords:
; k3 _7 B& b, ]& r! |' M- IUSR_ComputerName account password (only if you have typed it in the
MMC)
- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
( D& J5 W. p! N* Gyour virtual directories is located there.
) w3 }. r/ ?8 U3 z& Q4 j- The user name and password used to connect to the ODBC DSN called
, ^8 H9 A, n  c$ U. O"HTTPLOG" (if you chose to store your Logs into a database).
Note that the usernames are in unicode, clear text, that the passwords are
# _& ^/ F( ~1 psrambled in the metabase.ini file, and that only Administrators and SYSTEM
have permissions on this file.
- h% L9 t" T% |7 m( W' i; `BUT a few lines of script in a WSH script or in an ASP page allow to print
/ J# _- D6 i1 n4 m+ P& ]! Rthese passwords in CLEAR TEXT.
% T  v4 H% N9 D. h$ I2 M  MThe user name and password used to connect to the Logs DSN could allow a
& l; J! F1 k: |2 z- ^5 Pmalicious user to delete traces of his activities on the server.
! z: _+ m6 V4 O9 ]Obviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
2 b- k8 \) l' Y. Y/ P, u3 A/ Eproblem I am reporting yet. Here is an example of what can be gathered:
"
3 z) p7 J* h, X# W5 j! rIIS 4.0 Metabase
?Patrick Chambet 1998 - pchambet@club-internet.fr
  o- A. v, f5 g0 u" u( ]3 u--- UNC User ---
) J) N) K% S8 cUNC User name: 'Lou'
UNC User password: 'Microsoft'
UNC Authentication Pass Through: 'False'
--- Anonymous User ---
Anonymous User name: 'IUSR_SERVER'
' G  a# T+ p# j7 T& k) x; N' _- `Anonymous User password: 'x1fj5h_iopNNsp'
8 Z7 A, S& v4 J- Y; B' tPassword synchronization: 'False'
- {1 K' l" o; R* B9 {--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
# o& }- Z7 }0 [ODBC table name: 'InternetLog'
, @* k5 C8 n4 bODBC User name: 'InternetAdmin'
# `1 K0 ]% H0 G7 a& uODBC User password: 'xxxxxx'
--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
Default Logon Domain: ''
8 y8 S$ ], B+ v$ r5 d# p, {$ \* w"
For example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
' Q5 C0 A$ t- {6 Z* @) x3 h9 Userver (a). He need not to be an Administrator. He can be for example
# W0 k' x+ U) Z5 m9 `8 _& Aan IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
$ j( ?, A$ a, b1 J$ O# a/ l4 Z: Udirectory located on another server, say (b).
% Z- H. L, h" O; ~, fNow, Bob can use these login name and passord to logon on server (b).
And so forth...
Microsoft was informed of this vulnerability.
) U. X/ {9 {) J2 E' H_______________________________________________________________________
& b# L; G* a2 |Patrick CHAMBET - pchambet@club-internet.fr
MCP NT 4.0
5 ]6 G/ ]( d6 {8 A: C9 EInternet, Security and Microsoft solutions
e-business Services
IBM Global Services
2 g$ p& Y& V  b6 m  b* t% N