NT的密码究竟放在哪

根据以前的发现,windowsNT密码虽然不象Windows95那样以简单加密形式包含在一个文件里面,而是一些杂乱的暗码,分别藏在7个不同的地方。这篇最新发表的文章告诉我们WindowsNT密码隐藏的第八个地方。Date: Mon, 22 Feb 1999 11:26:41 +0100
' _$ h8 v% N- _. h' a( n! f  }# m
From: Patrick CHAMBET <pchambet@club-internet.fr>

$ D: }6 q4 O* Y; [3 d, m) ZTo: sans@clark.net
' M, H# s! b4 t  BSubject: Alert: IIS 4.0 metabase can reveal plaintext passwords
% {; z% R) Y' p: U/ ]Hi all,
( i: S$ q' r% r2 U1 HWe knew that Windows NT passwords are stored in 7 different places across
the system. Here is a 8th place: the IIS 4.0 metabase.
IIS 4.0 uses its own configuration database, named "metabase", which can
9 o2 h  F6 g7 E8 Kbe compared to the Windows Registry: the metabase is organised in Hives,
2 n6 ?, I1 N$ b& o- B6 zKeys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
The IIS 4.0 metabase contains these passwords:
! A6 e6 l2 I2 a. a6 H: R- IUSR_ComputerName account password (only if you have typed it in the
MMC)
- IWAM_ComputerName account password (ALWAYS !)
. N' Q+ p  j2 O' h0 u6 N. f- UNC username and password used to connect to another server if one of
your virtual directories is located there.
- The user name and password used to connect to the ODBC DSN called
"HTTPLOG" (if you chose to store your Logs into a database).
% t* b8 v- ]5 w$ Y. O! o. wNote that the usernames are in unicode, clear text, that the passwords are
srambled in the metabase.ini file, and that only Administrators and SYSTEM
9 ?1 h0 w3 u0 A; R, }# z2 {have permissions on this file.
* d; \7 f, c7 q( J  s3 X& RBUT a few lines of script in a WSH script or in an ASP page allow to print
these passwords in CLEAR TEXT.
The user name and password used to connect to the Logs DSN could allow a
malicious user to delete traces of his activities on the server.
: A& Q! u2 n( |$ u& ZObviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
7 X+ |- j9 j7 L) y5 sproblem I am reporting yet. Here is an example of what can be gathered:
"
* ~0 \4 s0 t/ ?% j( Q2 @IIS 4.0 Metabase
- c( ?1 [; i" G?Patrick Chambet 1998 - pchambet@club-internet.fr
--- UNC User ---
UNC User name: 'Lou'
- I9 `4 B$ w! D8 y8 WUNC User password: 'Microsoft'
UNC Authentication Pass Through: 'False'
/ a2 D& P* J* q3 O$ W! ?--- Anonymous User ---
Anonymous User name: 'IUSR_SERVER'
0 c  ^9 V0 d- _) z6 e; |( cAnonymous User password: 'x1fj5h_iopNNsp'
Password synchronization: 'False'
--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
ODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
; [- B3 S& ?/ i9 U0 Q* fODBC User password: 'xxxxxx'
--- Web Applications User ---
% d. N4 l, g* M) e. CWAM User name: 'IWAM_SERVER'
WAM User password: 'Aj8_g2sAhjlk2'
Default Logon Domain: ''
3 q# I: N- b4 V  ~* O5 m" j/ j"
For example, you can imagine the following scenario:
A user Bob is allowed to logon only on a server hosting IIS 4.0, say
server (a). He need not to be an Administrator. He can be for example
an IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
the login name and password of the account used to access to a virtual
directory located on another server, say (b).
Now, Bob can use these login name and passord to logon on server (b).
+ [- s0 `9 }- b* x0 F* ]And so forth...
Microsoft was informed of this vulnerability.
_______________________________________________________________________
' w0 I: U, b" L+ WPatrick CHAMBET - pchambet@club-internet.fr
% Z! e" r# t0 l4 D9 t& X! ^$ C2 ZMCP NT 4.0
Internet, Security and Microsoft solutions
e-business Services
2 L- l8 ^( p9 I, X0 E2 HIBM Global Services
+ K) @; `6 D& o& c; Q- B6 S