NT的密码究竟放在哪

根据以前的发现,windowsNT密码虽然不象Windows95那样以简单加密形式包含在一个文件里面,而是一些杂乱的暗码,分别藏在7个不同的地方。这篇最新发表的文章告诉我们WindowsNT密码隐藏的第八个地方。Date: Mon, 22 Feb 1999 11:26:41 +0100
% L3 H: p. g- l2 B; r6 @8 A3 [2 M
2 x, C+ B: p* _% dFrom: Patrick CHAMBET <pchambet@club-internet.fr>

To: sans@clark.net
1 ]  {# o- _% S- X" `Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
We knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
be compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
$ q" u& D4 M6 @' eC:\WINNT\system32\inetsrv\MetaBase.bin
2 W2 S2 R6 w5 |" I* dThe IIS 4.0 metabase contains these passwords:
$ Z9 P" Y6 @9 m7 T% W* p9 N- IUSR_ComputerName account password (only if you have typed it in the
MMC)
0 x: Z) L# c1 S- E8 E- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
your virtual directories is located there.
- The user name and password used to connect to the ODBC DSN called
- {- V( b; `6 x! R"HTTPLOG" (if you chose to store your Logs into a database).
$ T6 Q) Y8 W& sNote that the usernames are in unicode, clear text, that the passwords are
srambled in the metabase.ini file, and that only Administrators and SYSTEM
have permissions on this file.
. f# o: [7 U/ I' p8 z$ yBUT a few lines of script in a WSH script or in an ASP page allow to print
these passwords in CLEAR TEXT.
0 |- R& W& D7 K3 q* N* g4 {The user name and password used to connect to the Logs DSN could allow a
' B' F/ r3 F' s  g$ Hmalicious user to delete traces of his activities on the server.
7 G' F, t% Y; uObviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
problem I am reporting yet. Here is an example of what can be gathered:
"
IIS 4.0 Metabase
8 \5 B) \, k3 z5 y6 V?Patrick Chambet 1998 - pchambet@club-internet.fr
--- UNC User ---
UNC User name: 'Lou'
UNC User password: 'Microsoft'
+ m) m3 _' x" J; k8 ]- VUNC Authentication Pass Through: 'False'
  |( X/ ^1 k6 p# h: |3 T7 e7 o--- Anonymous User ---
, O  D) u& S) d, x$ ^" G& b8 O: F" qAnonymous User name: 'IUSR_SERVER'
Anonymous User password: 'x1fj5h_iopNNsp'
Password synchronization: 'False'
--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
7 s% z, F6 p! w) dODBC table name: 'InternetLog'
! T- @8 h9 q: T  h6 QODBC User name: 'InternetAdmin'
ODBC User password: 'xxxxxx'
, O4 D* }% I* t+ T8 m--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
& f" C+ h, U) k5 Y! uDefault Logon Domain: ''
"
For example, you can imagine the following scenario:
& Q% m9 M8 P: P3 X% L/ Z% d2 Y# FA user Bob is allowed to logon only on a server hosting IIS 4.0, say
! D; n1 z  U) f7 x- \  M- mserver (a). He need not to be an Administrator. He can be for example
' c# N& ~9 n# ~0 g$ x3 f+ Uan IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
" l* {6 `: K, Q  p; ]- S, i0 Tthe login name and password of the account used to access to a virtual
directory located on another server, say (b).
6 }8 a& Y0 {: u' I& t/ q; r; v: uNow, Bob can use these login name and passord to logon on server (b).
And so forth...
Microsoft was informed of this vulnerability.
_______________________________________________________________________
6 B" T/ c3 Q: j0 s9 [Patrick CHAMBET - pchambet@club-internet.fr
1 o4 Z0 R! A' I3 y" [MCP NT 4.0
7 i& }9 ^! p0 C. x5 u8 F& VInternet, Security and Microsoft solutions
e-business Services
9 Q3 _6 v9 m# V% M/ G4 O- \" h6 IIBM Global Services