NT的密码究竟放在哪

根据以前的发现,windowsNT密码虽然不象Windows95那样以简单加密形式包含在一个文件里面,而是一些杂乱的暗码,分别藏在7个不同的地方。这篇最新发表的文章告诉我们WindowsNT密码隐藏的第八个地方。Date: Mon, 22 Feb 1999 11:26:41 +0100

/ z: V( [; `8 S( ]# v: hFrom: Patrick CHAMBET <pchambet@club-internet.fr>

To: sans@clark.net
/ ^' ]/ Z# C. GSubject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
We knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
* \2 ?6 N$ h2 |4 w) {% S( e( Hbe compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
! D  l+ Y. [1 A% RThe IIS 4.0 metabase contains these passwords:
- IUSR_ComputerName account password (only if you have typed it in the
  v& h, p6 P8 p3 e3 ~3 V0 s& e: RMMC)
- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
your virtual directories is located there.
7 c: ^" Z* U& [/ p& p- The user name and password used to connect to the ODBC DSN called
"HTTPLOG" (if you chose to store your Logs into a database).
) P& t) ^. X: \: B3 {6 gNote that the usernames are in unicode, clear text, that the passwords are
; C0 V" l4 U3 ?# w' msrambled in the metabase.ini file, and that only Administrators and SYSTEM
& \+ q; A$ H3 D* v$ Chave permissions on this file.
BUT a few lines of script in a WSH script or in an ASP page allow to print
# S9 m6 E5 o3 U# X# N$ b& {' p6 Fthese passwords in CLEAR TEXT.
- X9 N. Y1 a1 r, K5 N1 gThe user name and password used to connect to the Logs DSN could allow a
malicious user to delete traces of his activities on the server.
; F4 p% J5 K# _' `' z/ t+ O  eObviously this represents a significant risk for Web servers that allow
2 J3 ~: G) |9 i/ w$ \& xlogons and/or remote access, although I did not see any exploit of the
problem I am reporting yet. Here is an example of what can be gathered:
6 u: R8 G: m; ?, }"
IIS 4.0 Metabase
?Patrick Chambet 1998 - pchambet@club-internet.fr
) _7 _' S4 v9 f8 `- Y, u* R--- UNC User ---
: ~+ Q, }# G' d5 u+ I2 @, FUNC User name: 'Lou'
UNC User password: 'Microsoft'
UNC Authentication Pass Through: 'False'
( q3 Y& q' a# [( I; o1 f9 v--- Anonymous User ---
( |/ ~: W: T: d6 ?$ R% z5 ]* aAnonymous User name: 'IUSR_SERVER'
- n' H6 _" E  e9 E  sAnonymous User password: 'x1fj5h_iopNNsp'
) j+ H& k2 Z. ]- _$ z6 n. j. LPassword synchronization: 'False'
--- IIS Logs DSN User ---
* C# R) P# a  m( _ODBC DSN name: 'HTTPLOG'
  W% `3 R! v: P: tODBC table name: 'InternetLog'
/ p8 [( z5 ?" ^3 V8 U& eODBC User name: 'InternetAdmin'
ODBC User password: 'xxxxxx'
- w. f. B3 a+ E6 o" X--- Web Applications User ---
2 n& X- w6 r* [3 V* ^WAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
; C. ]8 n/ D  n' fDefault Logon Domain: ''
"
For example, you can imagine the following scenario:
( ]( ^- I$ I! H2 X* B  y+ rA user Bob is allowed to logon only on a server hosting IIS 4.0, say
+ d: o; R3 u9 Vserver (a). He need not to be an Administrator. He can be for example
an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
1 j- _, n/ \' h& Mdirectory located on another server, say (b).
Now, Bob can use these login name and passord to logon on server (b).
And so forth...
Microsoft was informed of this vulnerability.
_______________________________________________________________________
Patrick CHAMBET - pchambet@club-internet.fr
0 R  ^. k0 R# ^, F) w4 T! O( tMCP NT 4.0
Internet, Security and Microsoft solutions
e-business Services
IBM Global Services