NT的密碼究竟放在哪

根據(jù)以前的發(fā)現(xiàn),windowsNT密碼雖然不象Windows95那樣以簡單加密形式包含在一個(gè)文件里面,而是一些雜亂的暗碼,分別藏在7個(gè)不同的地方。這篇最新發(fā)表的文章告訴我們WindowsNT密碼隱藏的第八個(gè)地方。Date: Mon, 22 Feb 1999 11:26:41 +0100
, d1 |/ d& @. Q0 J
5 n- z. ~+ J$ g  k4 Y6 EFrom: Patrick CHAMBET <pchambet@club-internet.fr>

To: sans@clark.net
4 W1 N1 u4 U6 Q$ q6 JSubject: Alert: IIS 4.0 metabase can reveal plaintext passwords
Hi all,
We knew that Windows NT passwords are stored in 7 different places across
# m" j! L* s, D: {the system. Here is a 8th place: the IIS 4.0 metabase.
4 X# [9 H6 I2 \, S6 K$ K/ qIIS 4.0 uses its own configuration database, named "metabase", which can
be compared to the Windows Registry: the metabase is organised in Hives,
Keys and Values. It is stored in the following file:
C:\WINNT\system32\inetsrv\MetaBase.bin
The IIS 4.0 metabase contains these passwords:
% |# b8 p( q8 ]7 R" ?- IUSR_ComputerName account password (only if you have typed it in the
% G' p# O$ M' o# GMMC)
& u" v) B8 X5 d  n: _# d- IWAM_ComputerName account password (ALWAYS !)
- UNC username and password used to connect to another server if one of
5 z* H, ]% _& p, g! O6 `9 _your virtual directories is located there.
" @: W4 N1 ]  `" z. i6 I+ Y' u- The user name and password used to connect to the ODBC DSN called
"HTTPLOG" (if you chose to store your Logs into a database).
Note that the usernames are in unicode, clear text, that the passwords are
srambled in the metabase.ini file, and that only Administrators and SYSTEM
) H8 t, s; O) [have permissions on this file.
BUT a few lines of script in a WSH script or in an ASP page allow to print
) F( _! r4 s4 I: s* Sthese passwords in CLEAR TEXT.
The user name and password used to connect to the Logs DSN could allow a
7 v7 o. J& ~: D$ Jmalicious user to delete traces of his activities on the server.
, m* E; J  I0 ^/ e. NObviously this represents a significant risk for Web servers that allow
logons and/or remote access, although I did not see any exploit of the
problem I am reporting yet. Here is an example of what can be gathered:
8 Z# A7 u# b' H4 X& C"
IIS 4.0 Metabase
2 T" r* I$ r" q, `?Patrick Chambet 1998 - pchambet@club-internet.fr
2 y) v% T& [8 {# I--- UNC User ---
UNC User name: 'Lou'
UNC User password: 'Microsoft'
" W% c$ Y7 L; y( Z% q2 s, t4 ZUNC Authentication Pass Through: 'False'
0 t& ~2 L: i+ D2 I: Z2 O--- Anonymous User ---
# |8 ^; W% s' V# m0 `5 v* R  K) QAnonymous User name: 'IUSR_SERVER'
Anonymous User password: 'x1fj5h_iopNNsp'
Password synchronization: 'False'
--- IIS Logs DSN User ---
ODBC DSN name: 'HTTPLOG'
ODBC table name: 'InternetLog'
ODBC User name: 'InternetAdmin'
ODBC User password: 'xxxxxx'
--- Web Applications User ---
WAM User name: 'IWAM_SERVER'
( I# G2 J& O: s, L, P: _3 eWAM User password: 'Aj8_g2sAhjlk2'
7 |" k4 k3 z' M, m- p% D$ VDefault Logon Domain: ''
2 M, ]3 }1 ^' e% U"
, k1 e4 d3 G* CFor example, you can imagine the following scenario:
. |( c- T. z+ s6 v" TA user Bob is allowed to logon only on a server hosting IIS 4.0, say
2 ~$ n, ~. F' @1 r' C% n, h0 jserver (a). He need not to be an Administrator. He can be for example
/ l* Z8 ?8 S) s7 _$ Fan IIS 4.0 Web Site Operator. Then, he launches a WSH script that extracts
$ I3 G8 Y4 Q3 N' g5 T& J0 O& P  g7 tthe login name and password of the account used to access to a virtual
directory located on another server, say (b).
+ o, `6 m4 e5 h% Q" S7 cNow, Bob can use these login name and passord to logon on server (b).
And so forth...
5 u- u( O  p$ H' GMicrosoft was informed of this vulnerability.
4 V9 \7 \7 k" Z, G! p_______________________________________________________________________
Patrick CHAMBET - pchambet@club-internet.fr
MCP NT 4.0
Internet, Security and Microsoft solutions
e-business Services
# r4 ?! f) ?: F  ]3 B1 C1 SIBM Global Services
0 ]' [& e2 [6 z