NT的密碼究竟放在哪

根據(jù)以前的發(fā)現(xiàn),windowsNT密碼雖然不象Windows95那樣以簡單加密形式包含在一個文件里面,而是一些雜亂的暗碼,分別藏在7個不同的地方。這篇最新發(fā)表的文章告訴我們WindowsNT密碼隱藏的第八個地方。Date: Mon, 22 Feb 1999 11:26:41 +0100

- {  a- q- p9 q( ^) I9 X/ p9 u8 tFrom: Patrick CHAMBET <pchambet@club-internet.fr>

2 c, E) ~, f% ~$ s) r* f  \To: sans@clark.net
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
" k( D7 Z6 B1 k& e& }9 D! G8 hWe knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
be compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
* J/ W( H/ |$ a$ s  LC:\WINNT\system32\inetsrv\MetaBase.bin
# N( k0 I6 |# c5 D; B: h3 r0 F1 L' ]The IIS 4.0 metabase contains these passwords:
6 c; x% Z8 G3 \3 G( G- IUSR_ComputerName account password (only if you have typed it in the
MMC)
+ x; K( S6 M' H1 Q1 |- c' R* x- IWAM_ComputerName account password (ALWAYS !)
* r- s- e) A& F; o: z7 n  ?$ U- UNC username and password used to connect to another server if one of
your virtual directories is located there.
4 z" ?+ n6 \2 y. W$ W+ P- The user name and password used to connect to the ODBC DSN called
"HTTPLOG" (if you chose to store your Logs into a database).
3 r/ p  e3 k- D- u6 ANote that the usernames are in unicode, clear text, that the passwords are
srambled in the metabase.ini file, and that only Administrators and SYSTEM
have permissions on this file.
* l: r$ L: C. W% y( d) A: TBUT a few lines of script in a WSH script or in an ASP page allow to print
& i) b. I8 S+ w: xthese passwords in CLEAR TEXT.
6 ^* }7 @0 L# F' YThe user name and password used to connect to the Logs DSN could allow a
# E. B1 K, Y8 C2 e) p& A8 zmalicious user to delete traces of his activities on the server.
Obviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
) a% @- y& D. |0 r, uproblem I am reporting yet. Here is an example of what can be gathered:
"
  e3 a: x8 f( a, L# u& `; uIIS 4.0 Metabase
* {/ z7 @. f$ J0 z4 n; E  }3 q/ x?Patrick Chambet 1998 - pchambet@club-internet.fr
--- UNC User ---
) ]/ i( e- w) x/ {& EUNC User name: 'Lou'
: c* }! K+ n8 y7 [# RUNC User password: 'Microsoft'
0 P6 P! s" f& U# j/ hUNC Authentication Pass Through: 'False'
; n9 _6 C* x' l: m# Q--- Anonymous User ---
Anonymous User name: 'IUSR_SERVER'
5 d* v% t% e$ x8 t0 Z9 AAnonymous User password: 'x1fj5h_iopNNsp'
, A# j" C1 E6 h) H, D4 c4 oPassword synchronization: 'False'
--- IIS Logs DSN User ---
0 }% _1 J6 B1 n/ wODBC DSN name: 'HTTPLOG'
ODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
2 W* L3 D# \9 ]5 ]; VODBC User password: 'xxxxxx'
--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
4 o' J9 E. x* \; E# kWAM User password: 'Aj8_g2sAhjlk2'
0 ?3 S, a  g0 j% b0 i1 l# UDefault Logon Domain: ''
"
For example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
server (a). He need not to be an Administrator. He can be for example
. ~( x( }7 R  f, X. _& a+ x  man IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
+ V9 w* r9 z2 C) A9 `& Rdirectory located on another server, say (b).
/ ?6 j1 `; ~% X$ H! ?. R  VNow, Bob can use these login name and passord to logon on server (b).
And so forth...
Microsoft was informed of this vulnerability.
4 s& s$ ^9 T1 w_______________________________________________________________________
Patrick CHAMBET - pchambet@club-internet.fr
% e; H! i8 P! x0 P8 iMCP NT 4.0
Internet, Security and Microsoft solutions
e-business Services
IBM Global Services