Donate to us via Paypal!
Your life is ending one minute at a time. If you were to die tomorrow, what would you do today?
Monday, March 01, 2021
Navigation
Home
 Find:
 Information:
Learn
Communicate
Submit
Shop
Challenges
 Exploit:
 Programming:
 Think:
 Track:
 Patch:
 Other:
 Need Help?
Other
Members Online
Total Online: 112
Guests Online: 111
Members Online: 1

Registered Members: 133759
Newest Member: louis00101
Latest Articles

View Thread

HellBound Hackers | Computer General | Hacking in general

Page 1 of 2 1 2 >
Author

Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 17-09-07 02:17
I'm very close to rooting a machine but falling at the last hurdle..I used sql injection to get site admin access, then inserted an lfi vulnerability into a page, so now I can access any file on the machine..

I've found a SAM in C:\WINDOWS\repair\sam, so I display that to screen and try and save it as a sam file on my pc but lc5 says its invalid, looks like an encoding problem. I've tried different encodings in FF and tried IE, which I thought would work because it looked valid, but same problem.

Any way I can get this SAM without it screwing up?
Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 17-09-07 02:33
are you sure you REALLY got it? Cuz windows systems don't let a user access the SAM file while the system in ON (active) :matey:

I can steer you towards cracking it once you give me facts.



Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 17-09-07 02:47
actually you can retrieve a sam from the repair directory, as for making it work, i really cant help you out that much... srry Sad
Author

RE: Problems retreiving a SAM file

korg
Member



Posts: 2803
Location: ENDING YOUR ONLINE EXPERIENCE!
Joined: 01.01.06
Rank:
God
Posted on 17-09-07 03:15
The repair/sam file is just as it states it is a back-up and is overwritten each time the machine is started, NOT reliable, You need to access C:\WINDOWS\system32\config\sam, That's your starting point Good luck. You cannot just access it while the machine is running but there is a way:happy:


i57.photobucket.com/albums/g215/korg1269/shodan13.jpg

I deal in pain, All life I drain, I dominate, I seal your fate.
O R
Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 17-09-07 03:20
Surely the repair sam can be useful though? I tested it on my local box and LC5 read it ok, the users weren't that up to date but it had my main account.

So do you see the problem? I can get the repair sam (through the browser) but LC5 won't read it, are there any other possible reasons? Maybe there is another way I can get access to the file like using PHP to ftp it?

If you want to share that technique or give a hint please do Smile I did read about pwdump, but there is no way I can get a file on the box that I can think of at least

P.S - the repair sam is the only sam on the machine, i did a find on it.

Edited by on 17-09-07 03:22
Author

RE: Problems retreiving a SAM file

korg
Member



Posts: 2803
Location: ENDING YOUR ONLINE EXPERIENCE!
Joined: 01.01.06
Rank:
God
Posted on 17-09-07 06:04
The SAM file is in the system32\config, LOL it's there you can't open it when it's running. Do some research on your own for cracking and finding SAM files. Maybe GOOGLE


i57.photobucket.com/albums/g215/korg1269/shodan13.jpg

I deal in pain, All life I drain, I dominate, I seal your fate.
O R
Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 17-09-07 18:13
I do not have physical access to the machine, so I can not reboot it - or if I do reboot it with system() in php I won't actually be able to do anything with it. I have already tried a few exploits, especially RDC ones because they have that running but the machine is patched up to the hilt. So my only real chance is that there is something useful in the repair sam. Getting it through the browser won't work so I'm gonna try ftp'ing it in ASCII or fwriting it to a location in the www and saving the file its self

I was just looking for ideas though so if I'm going about it in the wrong way or missing something I would appreciate a hint, other than GOOGLE..lol.

Edited by on 18-09-07 06:11
Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 17-09-07 20:40
asilvermtzion wrote:
I have already done a lot of research thanks, no need to be a patronising twat.

I do not have physical access to the machine, so I can not reboot it - or if I do reboot it with system() in php I won't actually be able to do anything with it. I have already tried a few exploits, especially RDC ones because they have that running but the machine is patched up to the hilt. So my only real chance is that there is something useful in the repair sam. Getting it through the browser won't work so I'm gonna try ftp'ing it in ASCII or fwriting it to a location in the www and saving the file its self


Obviously, you have done a lot of research, as shown by your comments. As for the "patronizing twat" portion, I wouldn't act that way towards people trying to give you advice. Try to glean any information from any advice, even if it seems demeaning.

You say that you're able to view the \repair\SAM... have you tried copying and pasting the text into Notepad, then saving it as "sam" on your system? Finding out what account the web server is running under, using that account to try and access the C$ or IPC$?

At this point, it might help you more to dwell on the current situation rather than researching to death. Maybe a different thought process would get the job done. You could try reading others' methods in that type (or a similar) situation to get some ideas.



Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 18-09-07 03:52
Thanks Zephyr, I entirely agree with your sentiment - it's slightly annoying however when people say GOOGLE in an ironic fashion, it's like I am posting here as a last resort, I'm not some 'tard who wants people to hack a site for them. I should show more constraint nevertheless.

I did try saving it into notepad, I tried everything I could think of but for some reason any modification to a SAM, in whatever program you might choose under any encoding immediately invalidates it. Hence I started to theorise about methods which could transfer the SAM without directly accessing the data - FTP was my first attempt, it transferred seemingly ok but wouldn't be read by LC5 or SAMDUMP. I then tried simply doing a system copy command to a web accessible directory (I verified locally that a straight copy did not corrupt the file first) - then downloaded the file directly from the browser, it worked and I now finally have a SAM even though it's a repair file, I'm brute forcing it right now to see if it has anything useful. Even if it fails, I think I've done reasonably well to get this close to rooting a server from a mere SQL injection having only started "hacking" 2 days ago, I do really want to learn other methods though, more direct methods to achieving serious penetration.


Edited by on 18-09-07 04:04
Author

RE: Problems retreiving a SAM file

korg
Member



Posts: 2803
Location: ENDING YOUR ONLINE EXPERIENCE!
Joined: 01.01.06
Rank:
God
Posted on 18-09-07 04:08
I have already done a lot of research thanks, no need to be a patronising twat.

Shithead! You just joined the site and your asking for help already and you have the balls to say something like that!
Now theres a good way to make friends with senior members:angry:

Seeing as how you did so much research you won't be needing any help from me. Banned from help!


i57.photobucket.com/albums/g215/korg1269/shodan13.jpg

I deal in pain, All life I drain, I dominate, I seal your fate.
O R
Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 18-09-07 04:12
I'm not going to react to that, all I will say is if being patronised is a pre-requisite to receiving advice in your forum, I'm quite content to stay away from it.

Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 18-09-07 06:11
Lol Korg, you were right as well damn it! I spent ages getting the syskey and sam from repair, finally cracked it and the password was........CHANGEME.. hahaha..they havent restarted the server once! FUCK!!!! arghghh

I'm all out of ideas, I have no physical access to the machine so I can't use a bootdisk etc. to access the sys32/config files...

Edited by on 18-09-07 06:11
Author

RE: Problems retreiving a SAM file

richohealey
Member



Posts: 1022
Location: #!/usr/local/bin/python
Joined: 01.05.06
Rank:
Monster
Posted on 18-09-07 08:08
There are ways to dump the sysconfig one, think aobut it like this, the code stopping you was coded my M$... what are the odds that it works?!


bitchohealey at hotmail dot com skype:richohealey www.psych0tik.net
Author

RE: Problems retreiving a SAM file

spyware
Member



Posts: 4192
Location:
Joined: 14.04.07
Rank:
God
Warn Level: 90
Posted on 18-09-07 08:11
1 to 22 I guess.



img507.imageshack.us/img507/3580/spynewsig3il1.png
"The chowner of property." - Zeph
[small]
Widespread intellectual and moral docility may be convenient for leaders in the short term,
but it is suicidal for nations in the long term.
- Carl Sagan
[center]�Since the grid is inescapable, what were the earlier lasers about? Does the corridor have a sense of humor?� - Ebert[/ce
Author

RE: Problems retreiving a SAM file

richohealey
Member



Posts: 1022
Location: #!/usr/local/bin/python
Joined: 01.05.06
Rank:
Monster
Posted on 18-09-07 09:19
Thanks spy Smile


bitchohealey at hotmail dot com skype:richohealey www.psych0tik.net
Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 18-09-07 17:21
Good point actually, considering l0phtcrack can retrieve the sys32/config file locally, there must be a way...maybe registry or something? i tried pwdump2 locally but it caused a critical error in lsass.exe ....time for some more research i guess.

Edited by on 18-09-07 17:22
Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 18-09-07 18:36
Fritzo wrote:
korg wrote:
quote: I have already done a lot of research thanks, no need to be a patronising twat. /quote


Shithead! You just joined the site and your asking for help already and you have the balls to say something like that!
Now theres a good way to make friends with senior members:angry:

Seeing as how you did so much research you won't be needing any help from me. Banned from help!


Shut up and Go Die in a Hole...

btw, post count != intelligence (usually)

geez, it's like a freakin' civil war here Pfft


Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 18-09-07 22:57
So, if we could forget the little tiff I'd be grateful.

Because, this is troubling me still...does anyone know an easy way to find out what user is currently in use, I can't do ECHO %USERNAME% because php will interpret the echo and simply print the statement

In terms of dumping the hashes without rebooting, I have tried fgdump locally but I get this:

Service not found. Installing CacheDump Service (C:\DOCUME~1\xpusr\LOCALS~1\Temp\cachedump.exe -s)

CacheDump service successfully installed.

Service started.

ERROR ConnectNamedPipe function failed. (code 535)

Service currently active. Stopping service...

Service successfully removed.



The way I'm going to try doing it is, if IIS is running as Admin, using the lfi hole i created to upload fgdump and then running it remotely through php. The thing is, fgdump doesn't work locally so I'm not sure whether I should try it on the target, and pwdump which I also tried caused a fatal error in lsass, so i REALLY dont want to reproduce that on the target because then im stuffed, to put it plainly, I need to be absolutely sure, or as sure as possible, that the dump is not going to reboot the machine, because that would make clean up impossible.

Edited by on 18-09-07 23:01
Author

RE: Problems retreiving a SAM file

korg
Member



Posts: 2803
Location: ENDING YOUR ONLINE EXPERIENCE!
Joined: 01.01.06
Rank:
God
Posted on 19-09-07 01:49
[Offtopic] This is not aimed at anyone but Fritzo your an ass, You weren't even involved in this forum so keep your comments to yourself, you have no clue.

PS: I did die in a hole last night your MOMS!

I'm done nowGrin



i57.photobucket.com/albums/g215/korg1269/shodan13.jpg

I deal in pain, All life I drain, I dominate, I seal your fate.
O R
Author

RE: Problems retreiving a SAM file


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 19-09-07 15:44
korg wrote:
[Offtopic] This is not aimed at anyone but Fritzo your an ass, You weren't even involved in this forum so keep your comments to yourself, you have no clue.

PS: I did die in a hole last night your MOMS!

I'm done nowGrin


While we're offtopic...

[offtopic]
How about we just sum it all up and say that everyone flaming and responding to flames in this thread is being an ass? No comment on the other parts of your posts.
[/offtopic]

To the OP, good luck with resolving your problem. It looks as if you're getting to learn quite a bit through the experience.



Page 1 of 2 1 2 >