☆ 对"V"的Hacking

http://scz.617.cn/windows/200401091624.txt

HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account\Users\000001F4 F REG_BINARY V REG_BINARY

这次我不犯傻了，在Petter Nordahl-Hagen的基础上([20])Hacking "V"结构，从头造轮子不划算。用同样的程序以16进制方式转储数据如下:

0x000003EB

byteArray [ 548 bytes ] -> 00000000 00 00 00 00 D4 00 00 00-02 00 01 00 D4 00 00 00 ................ 00000010 08 00 00 00 00 00 00 00-DC 00 00 00 12 00 00 00 ................ 00000020 00 00 00 00 F0 00 00 00-16 00 00 00 00 00 00 00 ................ 00000030 08 01 00 00 00 00 00 00-00 00 00 00 08 01 00 00 ................ 00000040 00 00 00 00 00 00 00 00-08 01 00 00 00 00 00 00 ................ 00000050 00 00 00 00 08 01 00 00-00 00 00 00 00 00 00 00 ................ 00000060 08 01 00 00 00 00 00 00-00 00 00 00 08 01 00 00 ................ 00000070 00 00 00 00 00 00 00 00-08 01 00 00 00 00 00 00 ................ 00000080 00 00 00 00 08 01 00 00-15 00 00 00 A8 00 00 00 ................ 00000090 20 01 00 00 08 00 00 00-01 00 00 00 28 01 00 00 ...........(... 000000A0 14 00 00 00 00 00 00 00-3C 01 00 00 14 00 00 00 ........<....... 000000B0 00 00 00 00 50 01 00 00-04 00 00 00 00 00 00 00 ....P........... 000000C0 54 01 00 00 04 00 00 00-00 00 00 00 01 00 14 80 T............... 000000D0 B4 00 00 00 C4 00 00 00-14 00 00 00 44 00 00 00 ............D... 000000E0 02 00 30 00 02 00 00 00-02 C0 14 00 44 00 05 01 ..0.........D... 000000F0 01 01 00 00 00 00 00 01-00 00 00 00 02 C0 14 00 ................ 00000100 FF 07 0F 00 01 01 00 00-00 00 00 05 07 00 00 00 ................ 00000110 02 00 70 00 04 00 00 00-00 00 14 00 5B 03 02 00 ..p.........[... 00000120 01 01 00 00 00 00 00 01-00 00 00 00 00 00 18 00 ................ 00000130 FF 07 0F 00 01 02 00 00-00 00 00 05 20 00 00 00 ............ ... 00000140 20 02 00 00 00 00 18 00-FF 07 0F 00 01 02 00 00 ............... 00000150 00 00 00 05 20 00 00 00-24 02 00 00 00 00 24 00 .... ...$.....$. 00000160 44 00 02 00 01 05 00 00-00 00 00 05 15 00 00 00 D............... 00000170 92 E0 3C 77 35 8A 02 1A-43 17 0A 32 EB 03 00 00 ..<w5...C..2.... 00000180 01 02 00 00 00 00 00 05-20 00 00 00 20 02 00 00 ........ ... ... 00000190 01 02 00 00 00 00 00 05-20 00 00 00 20 02 00 00 ........ ... ... 000001A0 74 00 65 00 73 00 74 00-74 00 65 00 73 00 74 00 t.e.s.t.t.e.s.t. 000001B0 20 00 75 00 73 00 65 00-72 00 01 00 6F 00 6E 00 .u.s.e.r...o.n. 000001C0 6C 00 79 00 20 00 61 00-20 00 74 00 65 00 73 00 l.y. .a. .t.e.s. 000001D0 74 00 38 F0 FF FF FF FF-FF FF FF FF FF FF FF FF t.8............. 000001E0 FF FF FF FF FF FF FF FF-FF 93 38 F0 01 02 00 00 ..........8..... 000001F0 07 00 00 00 01 00 01 00-XX XX XX XX XX XX XX XX ................ 00000200 XX XX XX XX XX XX XX XX-01 00 01 00 XX XX XX XX ................ 00000210 XX XX XX XX XX XX XX XX-XX XX XX XX 01 00 01 00 ................ 00000220 01 00 01 00 ....

对"V"的Hacking首先参考1997年Jeremy Allison编写的pwdump.c([5])，结合[20]。试着手工解码"V"，以0x000003EB为例:

00 00 00 00 未知Offset，0x00000000/0，相对0x000000CC的偏移，最终位置是0x000000CC D4 00 00 00 未知Length，0x000000D4/212 02 00 01 00 未知，不像是简单的对齐填充字段 D4 00 00 00 Username Offset，0x000000D4/212，相对0x000000CC 的偏移，最终位置是0x000001A0。换个角度来理解，前面0xCC字节是固定的头结构，后面是数据区。 08 00 00 00 Username Length，Unicode串的字节数，靠长度标识结尾，不依赖NUL字符，0x00000008/8，"test" 00 00 00 00 未知 DC 00 00 00 User full name Offset，0x000000DC/220，最终位置是0x000001A8 12 00 00 00 User full name Length，Unicode串的字节数，靠长度标识结尾，0x00000012/18，"test user" 00 00 00 00 未知 F0 00 00 00 User comment Offset，0x000000F0/240，最终位置是0x000001BC 16 00 00 00 User comment Length，Unicode串的字节数，靠长度标识结尾，0x00000016/22，"only a test" 00 00 00 00 未知 08 01 00 00 未知Offset，0x00000108，最终位置是0x000001D4 00 00 00 00 未知Length，0字节 00 00 00 00 未知 08 01 00 00 未知Offset，0x00000108，最终位置是0x000001D4 00 00 00 00 未知Length，0字节 00 00 00 00 未知 08 01 00 00 未知Offset，0x00000108，最终位置是0x000001D4 00 00 00 00 未知Length，0字节 00 00 00 00 未知 08 01 00 00 未知Offset，0x00000108，最终位置是0x000001D4 00 00 00 00 未知Length，0字节 00 00 00 00 未知 08 01 00 00 未知Offset，0x00000108，最终位置是0x000001D4 00 00 00 00 未知Length，0字节 00 00 00 00 未知 08 01 00 00 未知Offset，0x00000108，最终位置是0x000001D4 00 00 00 00 未知Length，0字节 00 00 00 00 未知 08 01 00 00 未知Offset，0x00000108，最终位置是0x000001D4 00 00 00 00 未知Length，0字节 00 00 00 00 未知 08 01 00 00 未知Offset，0x00000108，最终位置是0x000001D4 15 00 00 00 未知Length，0x00000015/21，本例中是21个0xFF A8 00 00 00 未知，为何此次不为0了 20 01 00 00 0x00000120/288，最终位置是0x000001EC 08 00 00 00 0x00000008/8 01 00 00 00 未知 28 01 00 00 加密存放的LM Hash，0x00000128/296，最终位置是 0x000001F4 14 00 00 00 0x00000014/20 00 00 00 00 未知 3C 01 00 00 加密存放的NTLM Hash，0x0000013C/316，最终位置是0x00000208 14 00 00 00 0x00000014/20 00 00 00 00 未知 50 01 00 00 0x00000150/336，最终位置是0x0000021C 04 00 00 00 0x00000004/4 00 00 00 00 未知 54 01 00 00 0x00000154/340，最终位置是0x00000220 04 00 00 00 0x00000004/4 00 00 00 00 未知

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 前面总共0xCC字节的固定头结构，后面是变长数据区，靠头结构定位各字段。头结构简单点讲，就是17组Offset/Length，每组占12字节。 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

01 00 14 80 B4 00 00 00 212字节未知数据，其实我对这块数据很好奇，可惜 C4 00 00 00 14 00 00 00 完全看不出明堂来。不同帐号，该块数据长度不同。 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 00 44 00 05 01 01 01 00 00 00 00 00 01 00 00 00 00 02 C0 14 00 FF 07 0F 00 01 01 00 00 00 00 00 05 07 00 00 00 02 00 70 00 04 00 00 00 00 00 14 00 5B 03 02 00 01 01 00 00 00 00 00 01 00 00 00 00 00 00 18 00 FF 07 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 18 00 FF 07 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 24 02 00 00 00 00 24 00 44 00 02 00 01 05 00 00 00 00 00 05 15 00 00 00 92 E0 3C 77 35 8A 02 1A 43 17 0A 32 EB 03 00 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 74 00 65 00 73 00 74 00 Unicode串"test"，靠长度标识结尾，不依赖NUL字符 Username 74 00 65 00 73 00 74 00 Unicode串"test user" User full name 20 00 75 00 73 00 65 00 72 00 01 00 这两个字节是填充字节，为了确保后面的数据对齐在四字节边界上 6F 00 6E 00 6C 00 79 00 Unicode串"only a test" User comment 20 00 61 00 20 00 74 00 65 00 73 00 74 00 38 F0 这两个字节是填充字节，为了确保后面的数据对齐在四字节边界上 FF FF FF FF FF FF FF FF 21字节 FF FF FF FF FF FF FF FF FF FF FF FF FF 93 38 F0 这三个字节是填充字节，为了确保后面的数据对齐在四字节边界上 01 02 00 00 07 00 00 00 8字节，不知是何数据 01 00 01 00 20字节，前面这4字节不清楚是何含义 XX XX XX XX XX XX XX XX 加密存放的LM Hash XX XX XX XX XX XX XX XX 01 00 01 00 20字节，前面这4字节不清楚是何含义 XX XX XX XX XX XX XX XX 加密存放的NTLM Hash XX XX XX XX XX XX XX XX 01 00 01 00 4字节 01 00 01 00 4字节

注意到Ethereal、Jeremy Allison、Petter Nordahl-Hagen多解析出几个字段，比如 Home、Script、Profile，但在我的测试环境中始终没有看到这几个字段出现过实际数据，因此宁可将之视为Unknown_XXX。若是某天看到实际数据了，再回头修正也不迟。反正我是不相信Kickoff Time这种以讹传讹还被引了无数次的字段，难说"V"中情形不类似。

为了写程序方便，Hacking一个C风格的结构出来:

#pragma pack( push, 1 )

typedef struct _OFFSET_LENGTH { DWORD Offset; // +0x000 // 偏移是相对于头结构尾部、变长数据区首部的 DWORD Length; // +0x004 // 以字节为单位 DWORD Unknown_008; // +0x008 // 不像是简单的对齐填充字段 // +0x00c } OFFSET_LENGTH, *POFFSET_LENGTH, **PPOFFSET_LENGTH;

/*

自己Hacking得到的结构，不可靠。注意，起名SAM_RID_V_VALUE，对应
HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account\Users\000001F4
以区别如下位置的"F"、"V"
HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account
头结构简单点讲，就是17组Offset/Length，每组占12字节。 */ typedef struct _SAM_RID_V_VALUE { OFFSET_LENGTH Unknown_000; // +0x000 OFFSET_LENGTH Username; // +0x00c OFFSET_LENGTH Userfullname; // +0x018 OFFSET_LENGTH Usercomment; // +0x024 OFFSET_LENGTH Unknown_030; // +0x030 OFFSET_LENGTH Unknown_03C; // +0x03c OFFSET_LENGTH Unknown_048; // +0x048 OFFSET_LENGTH Unknown_054; // +0x054 OFFSET_LENGTH Unknown_060; // +0x060 OFFSET_LENGTH Unknown_06C; // +0x06c OFFSET_LENGTH Unknown_078; // +0x078 OFFSET_LENGTH Unknown_084; // +0x084 OFFSET_LENGTH Unknown_090; // +0x090 OFFSET_LENGTH EncryptedLMHash; // +0x09c OFFSET_LENGTH EncryptedNTLMHash; // +0x0a8 OFFSET_LENGTH Unknown_0B4; // +0x0b4 OFFSET_LENGTH Unknown_0C0; // +0x0c0 // +0x0cc } SAM_RID_V_VALUE, *PSAM_RID_V_VALUE, **PPSAM_RID_V_VALUE;

#pragma pack( pop )

看样子NetUserGetInfo()获取的信息分别源自"F"、"V"。折腾了一趟，原来不明白的还是不明白，别人没搞出来的，我照样没搞出来，不爽。暂且不管这里了，好歹跟着 Jeremy Allison的脚步完整捋了一遍"F"、"V"，下次有谁搓我，就没那么容易了。

SampRetrieveUserPasswords()中调用SampGetUnicodeStringAttribute()获取加密后的LM Hash、NTLM Hash，SampGetUnicodeStringAttribute()的第二形参是个索引，分别取值0x0D、0x0E，对照上述SAM_RID_V_VALUE结构，就会发现这两个索引的意义。

☆ 参考资源

嘿嘿，那些个写"原创"的伙计们，千万别被我看到你的原创，最主要的是你得保证你参考的东西不会被我用Google搜到，要不你就老实交待了参考资源。我没别的长处，除了能把别人十八代祖宗的历史信息从Google中翻出来，//Grin

[ 5] http://us1.samba.org/samba/ftp/pwdump/pwdump.c - Jeremy Allison[1997]

[20] Offline NT Password & Registry Editor - Petter Nordahl-Hagen http://home.eunet.no/~pnordahl/ntpasswd/

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

200401091624.txt.md

200401091624.txt.md

#pragma pack( pop )

Files

200401091624.txt.md

Latest commit

History

200401091624.txt.md

File metadata and controls

#pragma pack( pop )