{"provider_url":"https://hatena.blog","width":"100%","title":"\u5b89\u6d35\u676f 2019/BUUCTF-Attack","height":"190","published":"2020-01-07 00:19:07","author_url":"https://blog.hatena.ne.jp/Rooty/","image_url":"https://s2.ax1x.com/2020/01/06/ly6yod.png","provider_name":"Hatena Blog","categories":["BUUCTF","misc","\u5de5\u5177"],"url":"https://shawroot.hatenablog.com/entry/2020/01/07/%E5%AE%89%E6%B4%B5%E6%9D%AF_2019/BUUCTF-Attack","description":"\u9898\u76ee\u4e0b\u8f7d \u5bf9\u6d41\u91cf\u5305\u8fdb\u884c\u6587\u4ef6\u63d0\u53d6\uff08output\uff09\u547d\u4ee4\uff0c\u5f97\u5230\u4e00\u4e2a\u52a0\u5bc6\u7684\u538b\u7f29\u5305\u6587\u4ef6\u3002 \u7528Wireshark\u6253\u5f00\uff0c\u6587\u4ef6\u2192\u5bfc\u51fa\u5bf9\u8c61\u2192HTTP\uff0c\u53d1\u73b0lsass.dmp\u3002 \u901a\u8fc7\u8fd9\u9053\u9898\u6211\u4e5fGET\u5230\u4e86\u65b0\u77e5\u8bc6\u70b9ww\u5f00\u5fc3\u3002 lsass\u662fwindows\u7cfb\u7edf\u7684\u4e00\u4e2a\u8fdb\u7a0b\uff0c\u7528\u4e8e\u672c\u5730\u5b89\u5168\u548c\u767b\u9646\u7b56\u7565\u3002 \u9898\u5916\u8bdd\uff1a \u5982\u4f55\u83b7\u53d6lsass.dmp\uff1f \u53ef\u4ee5\u7528procdump\uff08\u4e0b\u8f7d\u5730\u5740\uff09\u3002procdump\u662f\u5fae\u8f6f\u5b98\u65b9\u63d0\u4f9b\u7684\u4e00\u4e2a\u5c0f\u5de5\u5177\u3002 \u5c06\u5de5\u5177\u62f7\u8d1d\u5230\u76ee\u6807\u673a\u5668\u4e0a\u6267\u884c\u5982\u4e0b\u547d\u4ee4\uff08\u9700\u8981\u7ba1\u7406\u5458\u6743\u9650\uff09 procdump.exe -accepteula -ma lsass.exe lsass.dmp \u65e2\u7136\u8fd9\u9053\u9898\u7684lsass.dmp\u5df2\u7ecfdump\u51fa\u6765\u4e86\uff0c\u5c31\u53ef\u4ee5\u2026","blog_title":"\u300c\u914d\u67aa\u6731\u4e3d\u53f6\u3002\u300d","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fshawroot.hatenablog.com%2Fentry%2F2020%2F01%2F07%2F%25E5%25AE%2589%25E6%25B4%25B5%25E6%259D%25AF_2019%2FBUUCTF-Attack\" title=\"\u5b89\u6d35\u676f 2019/BUUCTF-Attack - \u300c\u914d\u67aa\u6731\u4e3d\u53f6\u3002\u300d\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","blog_url":"https://shawroot.hatenablog.com/","version":"1.0","author_name":"Rooty","type":"rich"}