NT的密码究竟放在哪

根据以前的发现,windowsNT密码虽然不象Windows95那样以简单加密形式包含在一个文件里面,而是一些杂乱的暗码,分别藏在7个不同的地方。这篇最新发表的文章告诉我们WindowsNT密码隐藏的第八个地方。Date: Mon, 22 Feb 1999 11:26:41 +0100

: W; f' h2 P; t# x2 c0 ]  iFrom: Patrick CHAMBET <pchambet@club-internet.fr>

1 Y& V9 m8 Z( l" F, LTo: sans@clark.net
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
% Y+ K7 f8 I0 l- lHi all,
We knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
  i+ r$ W+ y0 C/ HIIS 4.0 uses its own configuration database, named "metabase", which can
- j* h1 ?4 B3 r9 O7 nbe compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
& ^0 s# E. K3 i6 dC:\WINNT\system32\inetsrv\MetaBase.bin
The IIS 4.0 metabase contains these passwords:
4 I: }  ~1 H3 S/ _- IUSR_ComputerName account password (only if you have typed it in the
/ m+ i3 z% t: c* RMMC)
- IWAM_ComputerName account password (ALWAYS !)
8 M7 _+ V) v2 H7 {* \% e" a- UNC username and password used to connect to another server if one of
8 c9 ]. w6 x( ~4 k% lyour virtual directories is located there.
- The user name and password used to connect to the ODBC DSN called
"HTTPLOG" (if you chose to store your Logs into a database).
Note that the usernames are in unicode, clear text, that the passwords are
& K/ M8 m9 o8 c* H3 \# Y( o. Bsrambled in the metabase.ini file, and that only Administrators and SYSTEM
have permissions on this file.
" B8 L% x. o' ]& c5 vBUT a few lines of script in a WSH script or in an ASP page allow to print
these passwords in CLEAR TEXT.
9 e# I; Z7 y! I+ c. P. s" T: \$ F- iThe user name and password used to connect to the Logs DSN could allow a
malicious user to delete traces of his activities on the server.
Obviously this represents a significant risk for Web servers that allow
: \# a7 |$ c3 P8 p/ |logons and/or remote access, although I did not see any exploit of the
4 I  m; f% M9 z1 uproblem I am reporting yet. Here is an example of what can be gathered:
"
IIS 4.0 Metabase
3 p* R  r' q. E0 }+ e0 }/ T?Patrick Chambet 1998 - pchambet@club-internet.fr
+ r9 j2 L) H7 w--- UNC User ---
' q$ m& r3 }5 k  a% e6 C3 T  ]* P+ DUNC User name: 'Lou'
; }' Q, F4 B) m- O4 c' S: e% oUNC User password: 'Microsoft'
& |# i) {, v, m, R4 Y5 w1 OUNC Authentication Pass Through: 'False'
--- Anonymous User ---
Anonymous User name: 'IUSR_SERVER'
Anonymous User password: 'x1fj5h_iopNNsp'
0 c0 o* J5 R: w& K- Y" rPassword synchronization: 'False'
( I9 [, o8 a# x4 R% c# M: Y: H--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
/ d/ K) K1 ?5 k$ B. jODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
% h4 X: b! i, V& T; I. S. k: _6 Z# c  fODBC User password: 'xxxxxx'
- w+ i6 t; L6 k) j, N--- Web Applications User ---
. P, Q8 {7 B6 t$ u: FWAM User name: 'IWAM_SERVER'
. D: o: D+ w) U3 {( ?- {WAM User password: 'Aj8_g2sAhjlk2'
Default Logon Domain: ''
"
For example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
4 v* ]( R3 W  oserver (a). He need not to be an Administrator. He can be for example
% Q4 l( U+ T( p  q0 @an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
( e' l5 K2 J, `$ t; {  fthe login name and password of the account used to access to a virtual
' ?0 f; p; I# ^+ L- ^, R" m0 Adirectory located on another server, say (b).
: Y' ^+ ?2 P6 i7 Z1 h7 hNow, Bob can use these login name and passord to logon on server (b).
/ ]+ l+ ^. {1 O2 g! `And so forth...
Microsoft was informed of this vulnerability.
_______________________________________________________________________
/ g! N; K! ?7 H* oPatrick CHAMBET - pchambet@club-internet.fr
/ u& D  a/ r" A0 Y! fMCP NT 4.0
5 Q, j! I0 j: b& p9 q" |- bInternet, Security and Microsoft solutions
e-business Services
& E+ O9 r5 u4 CIBM Global Services
/ G% b6 G7 B, M) Q0 \