解剖安全帐号管理器(sam)结构Anatomical safety Account
Manager (SAM) structure
Article source: www.opengram.com
Article submission: refdom
HomePage: www.opengram.com
I, abstract
I I, about SAM
III, the SAM database structure in the registry
The structure and main content of IV and SAM databaseV, conclusions about SAM database analysis
I. s umm ary
The analysis of the security account manager structure was donemore than a month ago and only fragmentary records were notposted. The main issue is not released
The reason is that the security account manager (SAM) is thecore of WIN system account management, and it' s very systematic,and I also have a lot of room for just pushing
Break and guess, while SAM hack may cause the lsass.exe to loadaccount manager error when started, even security mode can not
be repaired (start up)
It must load SAM) to cause the whole system to start crashing(I usually need to rely on the second system to delete the SAMfile to start it) . As for now released
That is mainly because the Adam and the "Administrator" Dingclone described rootkit way of concealment and harmfulness, thestructure of SAM
Familiarity can help security personnel to do security testing(and, of course, to make use of undesirable candidates) .The contents of SAM are only introduced here, and the Securityrelated ones are not public for the time being.
Two, about SAM
Don' t get it wrong, SAM, it' s not a file, Sam is so simple. SAM(Security Accounts Manager security account manager) isresponsible for
Control and maintenance of SAM database. The SAM database islocated under the registry HKLM\SAM\SAM, protected by ACL, andcan be opened using regedt32.exe
Book table editor and set the appropriate permissions to viewthe contents of SAM. The SAM database is stored on the disk inthe%systemroot%system32\conf ig\ directory
Recorded in the SAM file, in this directory also includes a
security file, the contents of the security database, there aremany relations between the two.
The SAM database contains information about all groups,accounts, including passwords, HASH, accounts, SID, and so on.These are described in detail later. Points to me
Case analysis of Chinese Win2K Adv Server.
Three 、 the structure of the SAM database in the registryExpand registry HKLM\SAM\SAM\:
H KLM---SAM
|---SAM
|---Domains
| |---Account
| | |---Aliases
| | | |---Members
| | | |---Nam e s
| | |---Group s
| | | |---00000201
| | | |---Nam e s
| | | |---None
| | |---Users
| | |---000001F4
| | |---000001F5
| | |---000003E8
| | |---000003E9
| | |---Names
| | |---Adaministrator| | |---Gu e s t
| | |---IU SR_REFDOM| | |---IWASM_REFDOM| |---Builtin
| |---Aliases
| | |---00000220
| | |---00000221
| | |---00000222
| | |---00000223
| | |---Me mbe r s
| | | |---S-1-5-21-1214440339-706699826-1708537768| | | |---000001 F4
| | | |---000001F5
| | | |---000003E8
| | | |---000003E9
| | |--- Name s
| | |---Administrators
| | |---Users
| | |---Gu e s t s
| | |---Power Users
| |---Groups
| | |---Names
| |
| |---Users
| |---Name s
|
|---RXA CT
This is the SAM tree in the registry on my machine.
Comparing the contents of the SAM file, you can see that theSAM tree in the registry is in fact the same as in the SAM file.However, the SAM file is listed first
RXACT then, in the Domains content (and so on) , the order ofexpression in the file is in reverse order with the tree orderin the registry. If used to seeing
File contents, from file 0000H to 0006Ch,
Indicates the location of the SAM database:
\systemroot\system32\conf ig\sam, but
The end is blank, until 01000h (hbin) , from here on, is thecontent of the entire database. The contents of the SAM databasefile are not included,
But it will be interspersed with the introduction, interestedin their own to study.
Four, SAM database structure and main content:
In the entire database, the main contents of the account existin the following locations:
Under \Domains\ is the SAM content in the domain (or local) ,with two branches, Account, and Builtin".
\Domains\Account is the user account content.
\Domains\Account\Users is the information of each account. Thesub key is the SID relative symbol of each account. Such as000001F4,
Each account has two sub items, F and V. Where \Names\ is theuser account name, each account name has only one default subkey,and the type in the item is not
Is the generic registry data type, but refers to the last item(relative identifier) of the SID that signs the account, suchas the Administrator under it,
The type is 0x1F4, so the 000001F4 from the front correspondsto the content of the account name administrator. This showsthe logic of MS account search.
Inference 1: from the registry structure to see the account,if you query an account name refdom related information, then,Microsoft from the account name refdom
Find its type, 0x3EB, and then find the relative sign (or SID)for the account content of 000003EB. All API functions (suchas NetUserEnum ())
That' s how it works. Therefore, if you change the type 0x3EBin the refdom account to 0x1F4, the account will be directedto the account of class 000001F4
Households. And this account 000001F4 is the administratoraccount, so that the system in the login process, the refdomaccount completely converted to administrator
Account, account refdom all content used, information isadminisrtator content, including passwords, permissions,desktop, records, access time and so on
Etc. . This inference should be true, but it will mean that twouser names correspond to one user' s information and that thereshould be an error in system startup!
The inference is that, in the previous analysis of the structure,the relationship between the account name and the SIDassociation was revealed during and after the login process.\Domains\Account\Users\000001F4, this is the accountinformation for administrator (other similar) . There are twosub items, V and F.
In the project V, the basic information of the account is kept,the user name, the user' s full name (full name) , the group, thedescription, the password, the hash, the annotation, and
whether it can be more
Change password, account enable, password setup time, etc. . Inthe project F, some login records are saved, such as the lastlogin time, the wrong login number, and so on
One important place is the SID relative symbol for this account.Before the analysis of the structure, did not pay attention tothis place, this is the idea put forward by Adam. This is wherethe SID relative sign is registered
An account in the table for two times, one is in the key of000001F4, another is the key content of F sub items, from fourbytes 48 to 51:
F4 010000, which is actually a long type variable, that is,000001 F4. When a flag appears in two places, it will happenSynchronization problem. Obviously, Microsoft has made themistake. The two variable should have been unified to mark auser account, but Microsoft played two variables separatelyBut there is no synchronization.
The 000001F4 in the subkey is used to correspond to the username administrator, which facilitates querying the accountinformation through the user, such as LookupAccountSid () andso on
The account related API function is used to locate user
华纳云(HNCloud Limited)是一家专业的全球数据中心基础服务提供商,总部在香港,隶属于香港联合通讯国际有限公司,拥有香港政府颁发的商业登记证明,保证用户的安全性和合规性。 华纳云是APNIC 和 ARIN 会员单位。主要提供数据中心基础服务、互联网业务解决方案, 以及香港服务器租用、香港服务器托管、香港云服务器、美国云服务器,云计算、云安全技术研发等产品和服务。其中云服务器基于成熟的 ...
稳爱云(www.wenaiyun.com)是创建于2021年的国人IDC商家,主要目前要出售香港VPS、香港独立服务器、美国高防VPS、美国CERA VPS 等目前在售VPS线路有三网CN2、CN2 GIA,该公司旗下产品均采用KVM虚拟化架构。机房采用业内口碑最好香港沙田机房,稳定,好用,数据安全。线路采用三网(电信,联通,移动)回程电信cn2、cn2 gia优质网络,延迟低,速度快。自行封装的...
justhost.ru官方来消息说已经对网络进行了比较全面的优化,针对中国电信、联通、移动来说,4个机房总有一个适合中国用户,让站长进行一下测试,这不就有了这篇有关justhost的VPS的第四次测评。本帖主要关注的是网络,对于其他的参数一概不管! 官方网站:https://justhost.ru 最低配VPS:8.3元/月,KVM,512M内存,5G硬盘,200M带宽,不限流量 购买链接:...