帐号解剖安全帐号管理器(sam)结构(Anatomical safety Account Manager (SAM) structure)

帐号安全  时间:2021-03-14  阅读:()

解剖安全帐号管理器(sam)结构Anatomical safety Account

Manager (SAM) structure

Article source: www.opengram.com

Article submission: refdom

HomePage: www.opengram.com

I, abstract

I I, about SAM

III, the SAM database structure in the registry

The structure and main content of IV and SAM databaseV, conclusions about SAM database analysis

I. s umm ary

The analysis of the security account manager structure was donemore than a month ago and only fragmentary records were notposted. The main issue is not released

The reason is that the security account manager (SAM) is thecore of WIN system account management, and it' s very systematic,and I also have a lot of room for just pushing

Break and guess, while SAM hack may cause the lsass.exe to loadaccount manager error when started, even security mode can not

be repaired (start up)

It must load SAM) to cause the whole system to start crashing(I usually need to rely on the second system to delete the SAMfile to start it) . As for now released

That is mainly because the Adam and the "Administrator" Dingclone described rootkit way of concealment and harmfulness, thestructure of SAM

Familiarity can help security personnel to do security testing(and, of course, to make use of undesirable candidates) .The contents of SAM are only introduced here, and the Securityrelated ones are not public for the time being.

Two, about SAM

Don' t get it wrong, SAM, it' s not a file, Sam is so simple. SAM(Security Accounts Manager security account manager) isresponsible for

Control and maintenance of SAM database. The SAM database islocated under the registry HKLM\SAM\SAM, protected by ACL, andcan be opened using regedt32.exe

Book table editor and set the appropriate permissions to viewthe contents of SAM. The SAM database is stored on the disk inthe%systemroot%system32\conf ig\ directory

Recorded in the SAM file, in this directory also includes a

security file, the contents of the security database, there aremany relations between the two.

The SAM database contains information about all groups,accounts, including passwords, HASH, accounts, SID, and so on.These are described in detail later. Points to me

Case analysis of Chinese Win2K Adv Server.

Three 、 the structure of the SAM database in the registryExpand registry HKLM\SAM\SAM\:

H KLM---SAM

|---SAM

|---Domains

| |---Account

| | |---Aliases

| | | |---Members

| | | |---Nam e s

| | |---Group s

| | | |---00000201

| | | |---Nam e s

| | | |---None

| | |---Users

| | |---000001F4

| | |---000001F5

| | |---000003E8

| | |---000003E9

| | |---Names

| | |---Adaministrator| | |---Gu e s t

| | |---IU SR_REFDOM| | |---IWASM_REFDOM| |---Builtin

| |---Aliases

| | |---00000220

| | |---00000221

| | |---00000222

| | |---00000223

| | |---Me mbe r s

| | | |---S-1-5-21-1214440339-706699826-1708537768| | | |---000001 F4

| | | |---000001F5

| | | |---000003E8

| | | |---000003E9

| | |--- Name s

| | |---Administrators

| | |---Users

| | |---Gu e s t s

| | |---Power Users

| |---Groups

| | |---Names

| |

| |---Users

| |---Name s

|

|---RXA CT

This is the SAM tree in the registry on my machine.

Comparing the contents of the SAM file, you can see that theSAM tree in the registry is in fact the same as in the SAM file.However, the SAM file is listed first

RXACT then, in the Domains content (and so on) , the order ofexpression in the file is in reverse order with the tree orderin the registry. If used to seeing

File contents, from file 0000H to 0006Ch,

Indicates the location of the SAM database:

\systemroot\system32\conf ig\sam, but

The end is blank, until 01000h (hbin) , from here on, is thecontent of the entire database. The contents of the SAM databasefile are not included,

But it will be interspersed with the introduction, interestedin their own to study.

Four, SAM database structure and main content:

In the entire database, the main contents of the account existin the following locations:

Under \Domains\ is the SAM content in the domain (or local) ,with two branches, Account, and Builtin".

\Domains\Account is the user account content.

\Domains\Account\Users is the information of each account. Thesub key is the SID relative symbol of each account. Such as000001F4,

Each account has two sub items, F and V. Where \Names\ is theuser account name, each account name has only one default subkey,and the type in the item is not

Is the generic registry data type, but refers to the last item(relative identifier) of the SID that signs the account, suchas the Administrator under it,

The type is 0x1F4, so the 000001F4 from the front correspondsto the content of the account name administrator. This showsthe logic of MS account search.

Inference 1: from the registry structure to see the account,if you query an account name refdom related information, then,Microsoft from the account name refdom

Find its type, 0x3EB, and then find the relative sign (or SID)for the account content of 000003EB. All API functions (suchas NetUserEnum ())

That' s how it works. Therefore, if you change the type 0x3EBin the refdom account to 0x1F4, the account will be directedto the account of class 000001F4

Households. And this account 000001F4 is the administratoraccount, so that the system in the login process, the refdomaccount completely converted to administrator

Account, account refdom all content used, information isadminisrtator content, including passwords, permissions,desktop, records, access time and so on

Etc. . This inference should be true, but it will mean that twouser names correspond to one user' s information and that thereshould be an error in system startup!

The inference is that, in the previous analysis of the structure,the relationship between the account name and the SIDassociation was revealed during and after the login process.\Domains\Account\Users\000001F4, this is the accountinformation for administrator (other similar) . There are twosub items, V and F.

In the project V, the basic information of the account is kept,the user name, the user' s full name (full name) , the group, thedescription, the password, the hash, the annotation, and

whether it can be more

Change password, account enable, password setup time, etc. . Inthe project F, some login records are saved, such as the lastlogin time, the wrong login number, and so on

One important place is the SID relative symbol for this account.Before the analysis of the structure, did not pay attention tothis place, this is the idea put forward by Adam. This is wherethe SID relative sign is registered

An account in the table for two times, one is in the key of000001F4, another is the key content of F sub items, from fourbytes 48 to 51:

F4 010000, which is actually a long type variable, that is,000001 F4. When a flag appears in two places, it will happenSynchronization problem. Obviously, Microsoft has made themistake. The two variable should have been unified to mark auser account, but Microsoft played two variables separatelyBut there is no synchronization.

The 000001F4 in the subkey is used to correspond to the username administrator, which facilitates querying the accountinformation through the user, such as LookupAccountSid () andso on

The account related API function is used to locate user

华纳云新人下单立减40元/香港云服务器月付60元起,香港双向CN2(GIA)

华纳云(HNCloud Limited)是一家专业的全球数据中心基础服务提供商,总部在香港,隶属于香港联合通讯国际有限公司,拥有香港政府颁发的商业登记证明,保证用户的安全性和合规性。 华纳云是APNIC 和 ARIN 会员单位。主要提供数据中心基础服务、互联网业务解决方案, 以及香港服务器租用、香港服务器托管、香港云服务器、美国云服务器,云计算、云安全技术研发等产品和服务。其中云服务器基于成熟的 ...

稳爱云(26元),香港云服务器 1核 1G 10M带宽

稳爱云(www.wenaiyun.com)是创建于2021年的国人IDC商家,主要目前要出售香港VPS、香港独立服务器、美国高防VPS、美国CERA VPS 等目前在售VPS线路有三网CN2、CN2 GIA,该公司旗下产品均采用KVM虚拟化架构。机房采用业内口碑最好香港沙田机房,稳定,好用,数据安全。线路采用三网(电信,联通,移动)回程电信cn2、cn2 gia优质网络,延迟低,速度快。自行封装的...

justhost:“第4次VPS测评”,8.3元/月,200M带宽,不限流量,KVM虚拟,4个俄罗斯机房应有适合你的

justhost.ru官方来消息说已经对网络进行了比较全面的优化,针对中国电信、联通、移动来说,4个机房总有一个适合中国用户,让站长进行一下测试,这不就有了这篇有关justhost的VPS的第四次测评。本帖主要关注的是网络,对于其他的参数一概不管! 官方网站:https://justhost.ru 最低配VPS:8.3元/月,KVM,512M内存,5G硬盘,200M带宽,不限流量 购买链接:...

帐号安全为你推荐
安徽汽车网中国汽车十大品牌杨紫别祝我生日快乐一个人过生日的伤感说说有什么中老铁路一带一路的火车是什么火车bbs.99nets.com怎么制作RO单机同ip域名两个网站同一个IP怎么绑定两个域名www.119mm.comwww.993mm+com精品集!www.gegeshe.com有什么好听的流行歌曲javmoo.com0904-javbo.net_avop210hhb主人公叫什么,好喜欢,有知道的吗www.5any.comwww.qbo5.com 这个网站要安装播放器www.xvideos.com请问www.****.com.hk 和www.****.com.cn一样吗?
已备案域名注册 香港服务器租用 腾讯云盘 fastdomain 紫田 rak机房 42u机柜尺寸 网站木马检测工具 个人免费主页 便宜空间 新加坡空间 域名转入 登陆qq空间 腾讯数据库 北京主机托管 winds winserver2008r2 alertpay pptpvpn shuangshiyi 更多