NT的密碼究竟放在哪

根據(jù)以前的發(fā)現(xiàn),windowsNT密碼雖然不象Windows95那樣以簡(jiǎn)單加密形式包含在一個(gè)文件里面,而是一些雜亂的暗碼,分別藏在7個(gè)不同的地方。這篇最新發(fā)表的文章告訴我們WindowsNT密碼隱藏的第八個(gè)地方。Date: Mon, 22 Feb 1999 11:26:41 +0100

From: Patrick CHAMBET <pchambet@club-internet.fr>

* s0 c/ B, }) q, ^* |* G5 r, mTo: sans@clark.net
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
6 B# ~- H3 A# t( Q- s! {: b6 LWe knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
0 Z3 b( f% D# ~1 WIIS 4.0 uses its own configuration database, named "metabase", which can
be compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
9 r  ]/ ]; L* x( v( BThe IIS 4.0 metabase contains these passwords:
% D6 }( t. d0 z* L7 W# t+ a9 z- IUSR_ComputerName account password (only if you have typed it in the
: q7 Z5 j5 `  h: y: iMMC)
2 R+ ?% ]: Q- r! X- IWAM_ComputerName account password (ALWAYS !)
& n' X4 F: o5 R* A- UNC username and password used to connect to another server if one of
your virtual directories is located there.
- The user name and password used to connect to the ODBC DSN called
/ K  t, U, j  y( n0 V: Q"HTTPLOG" (if you chose to store your Logs into a database).
: W; a( D! c# ?5 E6 GNote that the usernames are in unicode, clear text, that the passwords are
srambled in the metabase.ini file, and that only Administrators and SYSTEM
& j3 E: m; c( khave permissions on this file.
BUT a few lines of script in a WSH script or in an ASP page allow to print
these passwords in CLEAR TEXT.
The user name and password used to connect to the Logs DSN could allow a
malicious user to delete traces of his activities on the server.
; }8 s. D! u, F; x: wObviously this represents a significant risk for Web servers that allow
; D0 E4 U* n- Y# h/ Ulogons and/or remote access, although I did not see any exploit of the
problem I am reporting yet. Here is an example of what can be gathered:
"
IIS 4.0 Metabase
?Patrick Chambet 1998 - pchambet@club-internet.fr
--- UNC User ---
1 b" U6 Z4 O2 c0 u% }" K) A8 I7 eUNC User name: 'Lou'
UNC User password: 'Microsoft'
# d' G" G2 j; U, BUNC Authentication Pass Through: 'False'
9 H8 c/ t% E' s# G0 |) }: h--- Anonymous User ---
; _/ p4 V6 T0 l' b2 T$ TAnonymous User name: 'IUSR_SERVER'
0 J1 b( L; ?2 u6 k* MAnonymous User password: 'x1fj5h_iopNNsp'
) f6 [0 a7 ^. X; [! R# B) rPassword synchronization: 'False'
' ~8 b8 F( z0 N6 A7 `& f7 C+ ?4 N--- IIS Logs DSN User ---
/ V7 l  ~1 |; f/ r. [' u$ W4 kODBC DSN name: 'HTTPLOG'
. R6 G/ a, H& e/ J6 N, b9 W6 _ODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
ODBC User password: 'xxxxxx'
--- Web Applications User ---
0 q2 \( U  k2 i! e% w$ ^; p& LWAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
9 ~8 s2 v& `* F% P- F$ J8 }Default Logon Domain: ''
"
) Q  ^# M) @0 X2 NFor example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
server (a). He need not to be an Administrator. He can be for example
' X& u7 P' V, J: P+ f# p! jan IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
' S) H& t, h9 r% O5 o' Qdirectory located on another server, say (b).
Now, Bob can use these login name and passord to logon on server (b).
And so forth...
5 _& k. z0 a' f1 E* i6 XMicrosoft was informed of this vulnerability.
( g$ w  {$ ]% l2 v_______________________________________________________________________
Patrick CHAMBET - pchambet@club-internet.fr
8 @; a7 g5 I, ^$ G4 d6 P' CMCP NT 4.0
* A- M5 m& y; j+ i& B5 _. hInternet, Security and Microsoft solutions
" L+ T+ c3 Z  b: pe-business Services
IBM Global Services