NT的密碼究竟放在哪

根據(jù)以前的發(fā)現(xiàn),windowsNT密碼雖然不象Windows95那樣以簡單加密形式包含在一個(gè)文件里面,而是一些雜亂的暗碼,分別藏在7個(gè)不同的地方。這篇最新發(fā)表的文章告訴我們WindowsNT密碼隱藏的第八個(gè)地方。Date: Mon, 22 Feb 1999 11:26:41 +0100

- N8 D, ^3 M5 NFrom: Patrick CHAMBET <pchambet@club-internet.fr>

To: sans@clark.net
1 U/ L4 {3 m# R9 |Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
7 J0 u4 v4 [+ R3 }& Z# Q3 AHi all,
We knew that Windows NT passwords are stored in 7 different places across
+ J2 Z2 m( x. x( ethe system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
be compared to the Windows Registry: the metabase is organised in Hives,
7 b1 z& ]# [0 i/ y( XKeys and Values. It is stored in the following file:
; r+ n0 K9 v1 m3 ^! k- X0 {2 C- cC:\WINNT\system32\inetsrv\MetaBase.bin
5 g' T" w6 N" q+ G" qThe IIS 4.0 metabase contains these passwords:
- IUSR_ComputerName account password (only if you have typed it in the
MMC)
# m% O1 I* }( p9 w- IWAM_ComputerName account password (ALWAYS !)
, z5 q& ^% ~5 Y- UNC username and password used to connect to another server if one of
your virtual directories is located there.
9 z: j3 p. z! ]- x, B- The user name and password used to connect to the ODBC DSN called
  l7 Y8 ]0 x- b"HTTPLOG" (if you chose to store your Logs into a database).
, A3 {* D4 W# H2 p* U8 [Note that the usernames are in unicode, clear text, that the passwords are
% `4 I# r" F, {' \1 }2 d! `! E: s5 Osrambled in the metabase.ini file, and that only Administrators and SYSTEM
' P, m* g* [# ahave permissions on this file.
BUT a few lines of script in a WSH script or in an ASP page allow to print
these passwords in CLEAR TEXT.
The user name and password used to connect to the Logs DSN could allow a
malicious user to delete traces of his activities on the server.
Obviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
0 z9 K: P2 n4 v/ Z0 [5 w; j# w6 C5 tproblem I am reporting yet. Here is an example of what can be gathered:
! B3 x2 N1 \7 {0 [' _2 T9 Z"
IIS 4.0 Metabase
! A( }0 z& Z( J0 e?Patrick Chambet 1998 - pchambet@club-internet.fr
' k4 y: \& w: R6 V, |* I/ H--- UNC User ---
UNC User name: 'Lou'
UNC User password: 'Microsoft'
0 h2 |/ m8 k* \3 \! a6 a5 `UNC Authentication Pass Through: 'False'
--- Anonymous User ---
Anonymous User name: 'IUSR_SERVER'
Anonymous User password: 'x1fj5h_iopNNsp'
- L+ U. B' u) l% W5 l" ]Password synchronization: 'False'
--- IIS Logs DSN User ---
- c0 S- f# B) e! f. }ODBC DSN name: 'HTTPLOG'
ODBC table name: 'InternetLog'
) v' Y% j6 W0 M& A9 D6 ~5 zODBC User name: 'InternetAdmin'
ODBC User password: 'xxxxxx'
--- Web Applications User ---
+ x; L8 m) q$ s: zWAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
Default Logon Domain: ''
2 d- h2 ?- E: x" e"
For example, you can imagine the following scenario:
. f( H; s, L0 P) [& S0 MA user Bob is allowed to logon only on a server hosting IIS 4.0, say
! \  _; P6 u" M% p' v- sserver (a). He need not to be an Administrator. He can be for example
an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
* H3 ?- d: r# J$ Y9 X# `the login name and password of the account used to access to a virtual
directory located on another server, say (b).
! I1 [3 P3 t* O8 X, hNow, Bob can use these login name and passord to logon on server (b).
- {( L; S2 ~* t1 CAnd so forth...
Microsoft was informed of this vulnerability.
. O; n9 H5 Z/ I" g_______________________________________________________________________
Patrick CHAMBET - pchambet@club-internet.fr
6 ^* y0 r5 x; l3 v8 yMCP NT 4.0
Internet, Security and Microsoft solutions
e-business Services
IBM Global Services
. b/ i# s3 ^; Y0 E