NT的密码究竟放在哪

根据以前的发现,windowsNT密码虽然不象Windows95那样以简单加密形式包含在一个文件里面,而是一些杂乱的暗码,分别藏在7个不同的地方。这篇最新发表的文章告诉我们WindowsNT密码隐藏的第八个地方。Date: Mon, 22 Feb 1999 11:26:41 +0100
% l) D/ \' {0 X* P' P
( X% [7 F$ V" f3 z; O/ C' yFrom: Patrick CHAMBET <pchambet@club-internet.fr>

To: sans@clark.net
4 r) `* d* T! p/ {; ?( HSubject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
% q7 k2 Y: ~% q# PWe knew that Windows NT passwords are stored in 7 different places across
) [( s9 m& J' t# W* F( Kthe system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
be compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
1 K7 T9 t7 ~. d9 W8 LThe IIS 4.0 metabase contains these passwords:
- IUSR_ComputerName account password (only if you have typed it in the
MMC)
- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
your virtual directories is located there.
- The user name and password used to connect to the ODBC DSN called
"HTTPLOG" (if you chose to store your Logs into a database).
Note that the usernames are in unicode, clear text, that the passwords are
# U2 g9 R! b! A. _$ c9 z$ Usrambled in the metabase.ini file, and that only Administrators and SYSTEM
5 _6 [# A5 R% L& P1 _- E$ Rhave permissions on this file.
BUT a few lines of script in a WSH script or in an ASP page allow to print
these passwords in CLEAR TEXT.
The user name and password used to connect to the Logs DSN could allow a
malicious user to delete traces of his activities on the server.
. \: o' o9 f+ q9 O' |Obviously this represents a significant risk for Web servers that allow
) {- ]3 D( g2 ~3 W: _' Flogons and/or remote access, although I did not see any exploit of the
9 L- v. n" q  N, I* H) m- m8 eproblem I am reporting yet. Here is an example of what can be gathered:
2 B. v4 r4 Z3 e- h( I/ h"
IIS 4.0 Metabase
, Q% r2 r: Y5 d: q; U4 h?Patrick Chambet 1998 - pchambet@club-internet.fr
--- UNC User ---
UNC User name: 'Lou'
' \# i1 _! S: y7 |- KUNC User password: 'Microsoft'
5 ^$ ~$ i- F& m+ p0 h; Z6 P2 `UNC Authentication Pass Through: 'False'
3 L0 ]% w0 H6 _5 @8 h--- Anonymous User ---
8 D& r4 c% b6 X; P- i+ S( \Anonymous User name: 'IUSR_SERVER'
Anonymous User password: 'x1fj5h_iopNNsp'
Password synchronization: 'False'
--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
6 F8 D/ u* z# A- }4 L+ eODBC table name: 'InternetLog'
; d: h+ }7 {: ?" p" k1 OODBC User name: 'InternetAdmin'
ODBC User password: 'xxxxxx'
--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
Default Logon Domain: ''
, C- ^$ w' W/ l4 L2 h/ T/ {2 r"
For example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
$ g/ X# Z7 o3 X/ Q8 O2 k0 K+ [server (a). He need not to be an Administrator. He can be for example
an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
: V) H9 y3 q$ k9 d5 vthe login name and password of the account used to access to a virtual
directory located on another server, say (b).
Now, Bob can use these login name and passord to logon on server (b).
And so forth...
( d/ N+ V% ]: K) e5 b+ I- \Microsoft was informed of this vulnerability.
_______________________________________________________________________
Patrick CHAMBET - pchambet@club-internet.fr
MCP NT 4.0
7 i( r% T0 V" P* z; m* yInternet, Security and Microsoft solutions
e-business Services
  e/ K1 v$ ~  ~3 N) aIBM Global Services
( [& `( Q: J- @! b3 {