NT的密码究竟放在哪

根据以前的发现,windowsNT密码虽然不象Windows95那样以简单加密形式包含在一个文件里面,而是一些杂乱的暗码,分别藏在7个不同的地方。这篇最新发表的文章告诉我们WindowsNT密码隐藏的第八个地方。Date: Mon, 22 Feb 1999 11:26:41 +0100

9 }/ f7 H/ _/ |" a1 s3 @From: Patrick CHAMBET <pchambet@club-internet.fr>
( {6 |" E+ P' T  j" o; j( K
To: sans@clark.net
/ t* v1 A' e! L+ C) ?& ]" E6 NSubject: Alert: IIS 4.0 metabase can reveal plaintext passwords
  P$ z  d  K" [9 Y' S1 `5 O. ]Hi all,
We knew that Windows NT passwords are stored in 7 different places across
9 Q- o/ J- n) b" p: S+ e2 _( dthe system. Here is a 8th place: the IIS 4.0 metabase.
: T* G+ t  q; qIIS 4.0 uses its own configuration database, named "metabase", which can
6 ]2 G3 I( x* }" l# e7 R5 W: ^. Rbe compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
The IIS 4.0 metabase contains these passwords:
. v6 z$ V6 @" o- IUSR_ComputerName account password (only if you have typed it in the
# w$ S! B" \- o+ T: N/ F: m2 z+ C0 iMMC)
  \7 H' G4 n: ]- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
7 W7 }1 o, j  q0 f+ Q, Jyour virtual directories is located there.
- The user name and password used to connect to the ODBC DSN called
* o; B# Q& X6 ?9 E; \* ^, R"HTTPLOG" (if you chose to store your Logs into a database).
Note that the usernames are in unicode, clear text, that the passwords are
srambled in the metabase.ini file, and that only Administrators and SYSTEM
have permissions on this file.
# F4 j! \  N; E7 x  ]) LBUT a few lines of script in a WSH script or in an ASP page allow to print
$ }5 i, e9 o9 u, ~these passwords in CLEAR TEXT.
, k( {6 D0 w, j$ ~" q$ }( S, OThe user name and password used to connect to the Logs DSN could allow a
malicious user to delete traces of his activities on the server.
Obviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
$ M3 R7 y% Q$ _+ A& R; S4 H6 Gproblem I am reporting yet. Here is an example of what can be gathered:
" u  q9 J% S2 f. g  {3 r9 N"
, I, U% J. y5 E3 _3 L# MIIS 4.0 Metabase
- K' H7 U" _& d7 I% L/ Z?Patrick Chambet 1998 - pchambet@club-internet.fr
--- UNC User ---
UNC User name: 'Lou'
UNC User password: 'Microsoft'
* q1 `- m2 [' l$ J! F8 l5 BUNC Authentication Pass Through: 'False'
--- Anonymous User ---
Anonymous User name: 'IUSR_SERVER'
. z7 }  X. m: HAnonymous User password: 'x1fj5h_iopNNsp'
% t1 P# E+ ?( MPassword synchronization: 'False'
( B6 x" ~; {& h--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
7 N, J& @' S0 d9 ?( yODBC table name: 'InternetLog'
9 M5 T, B6 p+ H. ]6 D8 \! K) k* wODBC User name: 'InternetAdmin'
ODBC User password: 'xxxxxx'
$ R* \9 }: E% H6 b+ G: H--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
Default Logon Domain: ''
- U! f" X- E3 O1 E/ @- ?' h; U: \' F"
For example, you can imagine the following scenario:
% e+ G# y- M, l8 |+ b1 \4 }A user Bob is allowed to logon only on a server hosting IIS 4.0, say
( ?. j+ I) c0 N; d8 Yserver (a). He need not to be an Administrator. He can be for example
an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
7 R6 P8 C, b- J1 {: c* ^directory located on another server, say (b).
Now, Bob can use these login name and passord to logon on server (b).
; s$ ?7 I2 S4 p5 X  o* M) i  S8 G0 EAnd so forth...
. b5 G# C* H( y* H  Y. E% fMicrosoft was informed of this vulnerability.
$ }8 i$ y2 v' [. L$ x( j2 s% {( }_______________________________________________________________________
Patrick CHAMBET - pchambet@club-internet.fr
: @2 |8 e  P/ nMCP NT 4.0
Internet, Security and Microsoft solutions
& ]" W5 S( x% ]& }, g/ Z% U) R; Ge-business Services
IBM Global Services