Penetration-password cracking (password cracking methods in password cracking)

Preface:
 
Recently, I have been busy with projects. I have said that I am tired of serving Party A. In a word, If Party A is satisfied with the smooth payment of the contract, it is the final goal. Just now, a project is coming to an end, the user suddenly raised a demand, saying that they had 30 Systems and Their Applications forgot their passwords (a system was previously used for hosting, and then a person in charge had changed, so ...), I was wondering if I could find a solution. When I heard this, I wanted to say no, but I still needed to nod my head when I thought about project acceptance. The company stipulated that there would be no bonus if I didn't accept the final payment, so I rummaged through the box and found him some old tools, as well as some of the gadgets and small scripts he had previously written. So this is a summative article,Penetration password cracking. The name is a little scary, but it is soy sauce.
 
I. system password cracking:
1) Windows system password cracking
Speaking of the system password, it is estimated that people who are relatively safe to play know that during the period from to, a dashboard will be able to scan a lot of bots, but this is obviously not enough for awesome XX people, as a result, we gradually began to have various XX forums and XX groups to automatically capture chicken tools. Then, with the rise of 360, the free anti-bot service emerged to gradually stop the momentum, there are many tools for Windows account and password cracking, and the mainstream ones are:
Network toolkit
NTScan
 
The password cracking process for Windows systems is as follows:
 
1. confirm that the Peer has enabled IPC by scanning the port $
2. Use a tool to raise the password until it is correct.
3. After obtaining the correct password, enable the process through the remote task plan (the most primitive and most common practice). Obviously, this method is generally used as a novice, I remember that the WMIC Management Specification was used to analyze and automatically capture chickens. It turned out to be a WMIC script that automatically planted an HTTP Trojan. So far, the so-called Automated 135 chicken capture tool is also the principle and code;
 
In recent years, a so-called Remote Desktop Protocol (RDP) Remote cracking method has also been used to catch bots. The principle is to simulate batch login to the RDP Protocol (Remote Desktop Protocol ), anyone with Windows Management experience knows that Microsoft's default management method is RDP Remote Desktop Management. Obviously, if you can simulate a large number of submissions, you can crack the password, the tool represents the public version and admin163.net produced by Russian hackers. In fact, there is another way to rewrite the RDP connection protocol without using the Microsoft RDP end, which is more efficient. I have used such tools.
 
Local cracking:
By capturing the hash and then cracking the dictionary, This method is suitable for methods that have obtained system permissions and can capture password files, so it is called local cracking. Maybe when I was a child, when I helped my uncle kill pigs, my pig's feet were stained with blood, these years have led to poor luck and a success rate of less than 1/1000.
 
Summary: so far, some so-called Full-port chicken capture tool kits in underground organizations also contain Windows system password cracking. Windows 2000/xp/2003/vista/win7 are all common, if you have any questions, you can scan your local network segment to scan machines with weak passwords. If you are lucky, you can upload and execute Trojans. Of course, for Web security, we often encounter a situation where we need to crack the password simply by raising the Right to capture the local password file and then cracking the password. There is also the daily Intranet, which is very important and proven.
 
2) Linux/Unix system password cracking:
 
Currently, the mainstream management protocols for Linux/Unix are SSH/Telnet, and common management tools such as Putty, SecureCRT, and SSHClient are difficult to get started with Linux/Unix, therefore, there are few people playing Linux/Unix games and few popular tools and tutorials. So Linux/Unix can scan bots in batches like Windows, of course. First, let's talk about the Telnet protocol. We all know that Telnet is a plaintext protocol, that is, you can capture packets to get the login password. By default, generally network devices such as switches, routers, and firewalls are remotely managed through the Telnet protocol, it is also very easy to crack the Telnet Protocol Password. There are many tools such as X-Scan, and the SSH protocol is similar. You can use the tool to directly log on after cracking the password. In addition, you can directly execute commands after logging on, instead of planting Trojans and backdoors like windows. If you have any friends who want to learn about route exchange and lack money, we suggest you use X-Scan to fill in your local public network segment. If you break through telnet/ssh, you will find a lot of H3COM and ZTE waiting for you. It is certainly no problem to complete the test of a CCNA;
Conclusion: a prerequisite for Linux/Unix password cracking is to use a static password to verify the logon to the system. If the RSA key is used for verification, this type of remote password cracking is meaningless. This is a big difference from Windows. In addition, the Linux/Unix password can be cracked by means of curve saving, that is, knowing that the other party uses a certain type of management tools such as VNC and other X-Windows client software. Many of these tools have their own authentication methods. If a Vulnerability (such as a weak VNC password) exists or a strong authentication method is not used, it is more likely to be cracked remotely. This usually happens in enterprises of a certain scale, and servers reach a certain order of magnitude. To facilitate management, a certain type of commercial management client is usually used.
Of course, the purpose is a password, or you can take the lead. For example, the flood of backdoor implanted incidents such as Putty and SecureCRT of the Chinese version client this year fully demonstrates that the wisdom of the majority of "hackers" is unlimited.
Representative tools: There are many single protocols. Here we recommend the following artifacts: Hydra and NCrack. For details, see http://sectools.org /.
 
 
 
Ii. Database Password:
 
There are many mainstream databases. Currently, the most popular password-based crawling methods in China are 1433, the reason for this is that Microsoft MSSQL Server database's default Remote Management port is 1433 (which can be changed). By default, MSSQL Server's highest-privilege user sa is bound to a shell, in other words, if you have the permissions of the Sa account of the MSSQL Server database, you have the system execution permission. Therefore, Google can capture chickens By 1433. | 1433 it can capture chickens in batches. Refer to the tool tutorial. The procedure used is representative enough to briefly describe the general process:
 
1. Identify the host with 1433 enabled through port batch scan. Generally, this scan is completed by the S scanner, that is, the S scanner of Wineggdrop, I would like to thank him for providing the fastest SYN scanning tool in the history of the Internet.
2. Use Management Tools to connect to hosts with weak passwords. MSSQL execution tools written by Xiao Rong are usually used;
3. If no permission is found, import a bunch of recovery extension commands until they can be restored;
4. Determine the tool that can be executed and upload the Trojan horse;
 
PS: this is the fastest way to remotely capture chickens except for Trojans. Some people may ask if the Access database does not work. Can I crack a weak password to catch bots? It doesn't make sense, because Access is a very small local database and is suitable for small applications. Microsoft does not provide remote management for it, so it does not remotely crack the password, for web security, the administrator password in the Access database is obtained through injection, path leakage, and other methods. Then, the administrator can log on to the background to obtain the Webshell and escalate the permission. Of course, the MSSQL database password can also be obtained, for example, after obtaining the Webshell, you can view the configuration file, usually the database information is easy to exist in conn. asp, webconfig. xml and other default configuration files and user-developed configuration files. Some commercial tools in China will automatically traverse such files during white box testing and then perform the key to identifying and matching.
 
After MSSQL is completed, we will not mention the MySQL database that is similar to him. This database is usually running in Linux/Unix systems. MYSQL is well known for its powerful functions, free and efficient. Obviously, as a powerful database must support remote management, it is natural to crack the password, generally, many tools can be used to crack MYSQL remotely, such as domestic X-Scan and HScan. Of course, the phpMyadmin management platform can also be cracked to save the country through the curve. The difference is that the HTTP channel is used for brute-force cracking. The preceding is a typical remote cracking method, while the local cracking method is relatively simple. Users can be obtained through webshell or Elevation of Privilege. MYD file (both Linux and Windows files are stored in the same directory) and then find the Hash local brute-force cracking or use the website online brute-force cracking command such as http://www.onlinehashcrack.com/multi hash-cracking.php. Www.2cto.com

Of course, MYSQL can also use the method of viewing the website configuration file to obtain the password, such as various CMS and admin163.net micro-Forums, the first installation requires writing the database connection information to a configuration file xx. inc. php. Of course, no matter what kind of database will have the possibility of a vulnerability outbreak, resulting in verification being broken, such as the MySQL identity authentication vulnerability that broke out some time ago. As a result, the authentication can be bypassed directly.
 
Okay, the night is deep. Go to bed. This is a complete summary of systems, databases, middleware, and applications. However, due to the recent frequent business trips of a project and the inconvenience of accessing the Internet, the project can only be put on hold for the time being, to check whether the post is of great value to everyone. If you are a cainiao and have any mistakes, please point out that I should correct them in time so as not to mislead the majority of children's shoes. In addition, if there is a better way, please share it with more people when replying.
PS: Because time-related tools are not used and uploaded. You can integrate it into the next Toolkit if necessary.