Radmin is a model of very good server management
Regardless of being the long-distance tabletop control or the file transfer
The speed very quick is very convenient
This also formed many servers to install radmin like this
Now you said that which 4899 do tacitly approve the port password the server on you not to look?
Everybody knew after radmin the password is 32 md5 encryptions,
Deposits is registering the outside and inside
The concrete table key value is HKLM \ SYSTEM \ RAdmin \ v2.0 \ Server \ Parameters \
How then when captures a web server everybody can further propose the power?
If you said that the violence explains radmin password ha-ha that to be also good
But you must have the enough time with the energy
I want the very few people to spend on several star time several month even several years to explain that password
Which ha-ha did myself obtain a material recently in the friend
How is doesn't need to explain Radmin the password to be possible to enter the server
Which Niu Ren does this call the password deceit concretely is discovered that I do not know
Was only I uses this mentality to do has decided many servers ha
Wants to know how to realize? Downward looks
Prerequisite:
Webshell should better have the read registry jurisdiction
If cannot read radmin the registry wscript.shell module not to delete us to be possible at least to transfer cmd like this
Derives radmin the tabular value
the radmin registration tabular value is also undergoes the encryption MD5 the hash value is 32
For instance the radmin registration outside and inside password is deposits like this
port port
Parameter REG_BINARY 1f 19 8c dd ** ** ** ** ** ** had 16 group of each group of two to gather is 32
Tool:
radmin control end
OllyDBG counter-assembly
First uses OllyDBG to open the radmin control end first (client side)
Then carries out ctrl+f to search JMP EAX
Then presses F4 to press F8 again
Then again right key - search - all constants
Inputs (very well 10325476 records in turn is 76543210)
In springs in the window chooses under first line of F2 to break
Then F9 movement
By now you used the server which radmin connects you to invade
By now will spring is called you to input the password the prompt frame not to need the tube to input the password casually
After waiting for you input, OD also to activate
By now you must under the movement Ctrl+F9 upward several lines select the place which again first red that was under broke a moment ago
Pressed F2 to cancel the break point once more then to press F8 the mouse downward to walk by now again finds
ADD ES,18 here presses F4
By now you looked for place 0.1 casually in left bottom hex there
Then moves Ctrl+G in the fence which springs to input the [esp] attention to raise the parenthesis
Then pays attention to radmin which replaced the first line of duplication we to obtain a moment ago the password hash value
Latter has a look according to the F9 movement ha to do pulls surely
You are here: hacking technology
> hacker course
> Content
Category: Home
> hacker course