NT的密碼究竟放在哪

根據(jù)以前的發(fā)現(xiàn),windowsNT密碼雖然不象Windows95那樣以簡單加密形式包含在一個文件里面,而是一些雜亂的暗碼,分別藏在7個不同的地方。這篇最新發(fā)表的文章告訴我們WindowsNT密碼隱藏的第八個地方。Date: Mon, 22 Feb 1999 11:26:41 +0100
$ w: S  A! b; B7 `# w8 a6 M
From: Patrick CHAMBET <pchambet@club-internet.fr>

$ p& j4 W: ^- @' r" G( RTo: sans@clark.net
Subject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
6 J$ }1 m1 d$ w% e( S& NWe knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
be compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
The IIS 4.0 metabase contains these passwords:
& a+ M- }6 o+ A, D- IUSR_ComputerName account password (only if you have typed it in the
) E+ A5 V$ ~3 n3 K( hMMC)
- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
( q3 a5 e" o) L. [: Fyour virtual directories is located there.
* ~5 I; s$ C# a1 x( y- The user name and password used to connect to the ODBC DSN called
"HTTPLOG" (if you chose to store your Logs into a database).
Note that the usernames are in unicode, clear text, that the passwords are
8 `4 J( p) [0 Nsrambled in the metabase.ini file, and that only Administrators and SYSTEM
. C. ~- u4 \7 @! P; U& @have permissions on this file.
8 O, _% {" R$ \( K3 H5 _8 aBUT a few lines of script in a WSH script or in an ASP page allow to print
these passwords in CLEAR TEXT.
3 W5 A- {& Y. a  m1 t6 sThe user name and password used to connect to the Logs DSN could allow a
9 y  U( r9 ?: O! ]+ emalicious user to delete traces of his activities on the server.
& v) }  m2 ], x( t) h5 b, fObviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
4 V: a+ U0 Z* p. R5 \0 \problem I am reporting yet. Here is an example of what can be gathered:
  X! G8 q4 N& s* S" J( ~* O"
# ^- b- M; O% G) z7 U' OIIS 4.0 Metabase
?Patrick Chambet 1998 - pchambet@club-internet.fr
--- UNC User ---
UNC User name: 'Lou'
UNC User password: 'Microsoft'
UNC Authentication Pass Through: 'False'
8 P2 s% x/ d4 u% T* L" ]) W1 p; m/ B--- Anonymous User ---
) V2 F% ^, X* v( W, |" g8 I: b) JAnonymous User name: 'IUSR_SERVER'
Anonymous User password: 'x1fj5h_iopNNsp'
Password synchronization: 'False'
( A7 g4 p  Z9 I8 @! Q5 r--- IIS Logs DSN User ---
+ K# z0 ^7 |3 ]ODBC DSN name: 'HTTPLOG'
' `* _3 a0 a2 E$ |& n" eODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
ODBC User password: 'xxxxxx'
--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
Default Logon Domain: ''
2 @" M# m  g, B, p( b( F/ E" \"
& a, g3 p3 d& u6 V+ HFor example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
1 g9 d4 V- a* U& d0 e" M! _1 b  t- b5 F9 Sserver (a). He need not to be an Administrator. He can be for example
an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
+ ]9 f2 u9 _1 H9 T" C" Q: rdirectory located on another server, say (b).
& ~* Y7 V: b( _% H( Z6 {Now, Bob can use these login name and passord to logon on server (b).
/ k/ I0 q; D# z2 A) T4 ]And so forth...
Microsoft was informed of this vulnerability.
_______________________________________________________________________
Patrick CHAMBET - pchambet@club-internet.fr
- ~  j" j. U3 l9 jMCP NT 4.0
Internet, Security and Microsoft solutions
e-business Services
' m7 d8 a6 @, @& f+ `# k- F$ WIBM Global Services