NT的密码究竟放在哪

根据以前的发现,windowsNT密码虽然不象Windows95那样以简单加密形式包含在一个文件里面,而是一些杂乱的暗码,分别藏在7个不同的地方。这篇最新发表的文章告诉我们WindowsNT密码隐藏的第八个地方。Date: Mon, 22 Feb 1999 11:26:41 +0100
3 m* a& W4 m% U
" q4 _) q! g! k) R* e3 F* AFrom: Patrick CHAMBET <pchambet@club-internet.fr>

1 |& o' G5 ^0 k' p$ |9 L* Z6 z$ uTo: sans@clark.net
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
+ \7 |/ ]5 A3 f  a0 N+ GWe knew that Windows NT passwords are stored in 7 different places across
8 C- Z  }. G' R; R% [" uthe system. Here is a 8th place: the IIS 4.0 metabase.
' n0 v8 @, o. ~4 `7 aIIS 4.0 uses its own configuration database, named "metabase", which can
be compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
/ |& A! V1 v; F+ A; ]5 vThe IIS 4.0 metabase contains these passwords:
2 p5 J0 K  Z; o" I- IUSR_ComputerName account password (only if you have typed it in the
- \, }2 W% _3 n* N5 q+ e( gMMC)
  v, U* i1 v7 Q% K3 A- IWAM_ComputerName account password (ALWAYS !)
- }1 T5 E5 Y7 @1 B, I4 o/ ~- UNC username and password used to connect to another server if one of
% r) l- m4 z# i- d5 n" Qyour virtual directories is located there.
8 R( M, D, m4 q- The user name and password used to connect to the ODBC DSN called
% a( q& R4 e: N" e$ y  o: g+ H"HTTPLOG" (if you chose to store your Logs into a database).
& z0 H% y+ c5 xNote that the usernames are in unicode, clear text, that the passwords are
2 a" f2 P: g( G! H# wsrambled in the metabase.ini file, and that only Administrators and SYSTEM
have permissions on this file.
# \1 M$ R" C* ?* h9 I) N& SBUT a few lines of script in a WSH script or in an ASP page allow to print
* l% P. _6 P. othese passwords in CLEAR TEXT.
The user name and password used to connect to the Logs DSN could allow a
5 f$ S3 Y: F3 }/ fmalicious user to delete traces of his activities on the server.
- S0 I1 N& E- k0 ^1 f; X( \Obviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
problem I am reporting yet. Here is an example of what can be gathered:
"
IIS 4.0 Metabase
# v5 m, b3 K6 i8 D! |& I?Patrick Chambet 1998 - pchambet@club-internet.fr
1 I0 c' @# V& n--- UNC User ---
UNC User name: 'Lou'
UNC User password: 'Microsoft'
UNC Authentication Pass Through: 'False'
--- Anonymous User ---
Anonymous User name: 'IUSR_SERVER'
: ?+ m7 W# v2 ]. gAnonymous User password: 'x1fj5h_iopNNsp'
% ?: V7 W8 B' A- g5 K7 l) v, C& x6 wPassword synchronization: 'False'
--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
ODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
: j5 {+ q: ?" y6 v) `ODBC User password: 'xxxxxx'
--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
$ i) a* C4 \$ u( R( R  t$ A5 _WAM User password: 'Aj8_g2sAhjlk2'
9 K1 a) C' j0 I: dDefault Logon Domain: ''
"
1 S& S! Z2 P3 I8 u- K4 q' UFor example, you can imagine the following scenario:
5 W; C; i0 U  @' F! }A user Bob is allowed to logon only on a server hosting IIS 4.0, say
! f) S) _& E4 Hserver (a). He need not to be an Administrator. He can be for example
an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
8 @2 I+ T4 Z/ @; J: @/ t4 Rdirectory located on another server, say (b).
) J! A. U5 s' Z# [" j4 Y% vNow, Bob can use these login name and passord to logon on server (b).
And so forth...
Microsoft was informed of this vulnerability.
_______________________________________________________________________
) A7 f+ s# O; {# bPatrick CHAMBET - pchambet@club-internet.fr
) m# s6 p$ t& f; m. HMCP NT 4.0
Internet, Security and Microsoft solutions
e-business Services
IBM Global Services
9 f6 n5 s2 G, E) W5 O  M4 a