凭据注入

当我们找到一个凭证后我们应该如何利用呢？

Runas 可以帮你解决这个问题。

当我们有一个 AD 的凭证时，我们可以在目标上运行 Runas ，将凭证注入内存中：

  1. runas.exe /netonly /user:<domain>\<username> cmd.exe
  • /netonly :
  • /user : 提供域和用户的信息
  • cmd.exe : 注入凭证后运行的程序

验证

当我们提供了密码进行登录后，我们如何验证我们的凭据是否正常工作，最可靠的方法时列出 SYSVOL ，任何 AD 账户都可以读取 SYSVOL 目录的内容。

  1. C:\Tools>dir \\za.tryhackme.com\SYSVOL\
  2.  Volume in drive \\za.tryhackme.com\SYSVOL is Windows
  3.  Volume Serial Number is 1634-22A9
  5.  Directory of \\za.tryhackme.com\SYSVOL
  7. 02/24/2022  09:57 PM    <DIR>          .
  8. 02/24/2022  09:57 PM    <DIR>          ..
  9. 02/24/2022  09:57 PM    <JUNCTION>     za.tryhackme.com [C:\Windows\SYSVOL\domain]
  10.                0 File(s)              0 bytes
  11.                3 Dir(s)  51,835,408,384 bytes free

通过 MMC 进行枚举

:::info GUI 方法，比较繁琐，并且适用性不高

:::

TryHackMe | Enumerating Active Directory

利用 CMD

CMD 中有一个内置命令 net可以帮助我们枚举 AD 内容。

:::info Net 命令官方文档

:::

用户

  1. C:\>net user /domain
  2. The request will be processed at a domain controller for domain za.tryhackme.com
  4. User accounts for \\THMDC
  6. -------------------------------------------------------------------------------
  7. aaron.conway             aaron.hancock            aaron.harris
  8. aaron.johnson            aaron.lewis              aaron.moore
  9. aaron.patel              aaron.smith              abbie.joyce
  10. abbie.robertson          abbie.taylor             abbie.walker
  11. abdul.akhtar             abdul.bates              abdul.holt
  12. abdul.jones              abdul.wall               abdul.west
  13. abdul.wilson             abigail.cox              abigail.cox1
  14. abigail.smith            abigail.ward             abigail.wheeler
  15. [....]
  16. The command completed successfully.
  1. C:\>net user zoe.marshall /domain
  2. The request will be processed at a domain controller for domain za.tryhackme.com
  4. User name                    zoe.marshall
  5. Full Name                    Zoe Marshall
  6. Comment
  7. User's comment
  8. Country/region code          000 (System Default)
  9. Account active               Yes
  10. Account expires              Never
  12. Password last set            2/24/2022 10:06:06 PM
  13. Password expires             Never
  14. Password changeable          2/24/2022 10:06:06 PM
  15. Password required            Yes
  16. User may change password     Yes
  18. Workstations allowed         All
  19. Logon script
  20. User profile
  21. Home directory
  22. Last logon                   Never
  24. Logon hours allowed          All
  26. Local Group Memberships
  27. Global Group memberships     *Domain Users         *Internet Access
  28. The command completed successfully.

组

  1. C:\>net group /domain
  2. The request will be processed at a domain controller for domain za.tryhackme.com
  4. Group Accounts for \\THMDC
  6. -------------------------------------------------------------------------------
  7. *Cloneable Domain Controllers
  8. *DnsUpdateProxy
  9. *Domain Admins
  10. *Domain Computers
  11. *Domain Controllers
  12. *Domain Guests
  13. *Domain Users
  14. [...]
  15. *Schema Admins
  16. *Server Admins
  17. *Tier 0 Admins
  18. *Tier 1 Admins
  19. *Tier 2 Admins
  20. The command completed successfully.
  1. C:\>net group "Tier 1 Admins" /domain
  2. The request will be processed at a domain controller for domain za.tryhackme.com
  4. Group name     Tier 1 Admins
  5. Comment
  7. Members
  9. -------------------------------------------------------------------------------
  10. t1_arthur.tyler          t1_gary.moss             t1_henry.miller
  11. t1_jill.wallis           t1_joel.stephenson       t1_marian.yates
  12. t1_rosie.bryant
  13. The command completed successfully.

密码策略

  1. C:\>net accounts /domain
  2. The request will be processed at a domain controller for domain za.tryhackme.com
  4. Force user logoff how long after time expires?:       Never
  5. Minimum password age (days):                          0
  6. Maximum password age (days):                          Unlimited
  7. Minimum password length:                              0
  8. Length of password history maintained:                None
  9. Lockout threshold:                                    Never
  10. Lockout duration (minutes):                           30
  11. Lockout observation window (minutes):                 30
  12. Computer role:                                        PRIMARY
  13. The command completed successfully.

利用 Powershell

:::info AD-RSAT 官方文档

:::

用户

  1. PS C:\> Get-ADUser -Identity gordon.stevens -Server za.tryhackme.com -Properties *
  3. AccountExpirationDate                :
  4. accountExpires                       : 9223372036854775807
  5. AccountLockoutTime                   :
  6. [...]
  7. Deleted                              :
  8. Department                           : Consulting
  9. Description                          :
  10. DisplayName                          : Gordon Stevens
  11. DistinguishedName                    : CN=gordon.stevens,OU=Consulting,OU=People,DC=za,DC=tryhackme,DC=com
  12. [...]
  • Identity ： 正在枚举的账户名称
  • Server ： 指定 DC
  • Properties ： 显示那些属性

组

  1. PS C:\> Get-ADGroup -Identity Administrators -Server za.tryhackme.com
  4. DistinguishedName : CN=Administrators,CN=Builtin,DC=za,DC=tryhackme,DC=com
  5. GroupCategory     : Security
  6. GroupScope        : DomainLocal
  7. Name              : Administrators
  8. ObjectClass       : group
  9. ObjectGUID        : f4d1cbcd-4a6f-4531-8550-0394c3273c4f
  10. SamAccountName    : Administrators
  11. SID               : S-1-5-32-544
  1. PS C:\> Get-ADGroupMember -Identity Administrators -Server za.tryhackme.com
  4. distinguishedName : CN=Domain Admins,CN=Users,DC=za,DC=tryhackme,DC=com
  6. name              : Domain Admins
  7. objectClass       : group
  8. objectGUID        : 8a6186e5-e20f-4f13-b1b0-067f3326f67c
  9. SamAccountName    : Domain Admins
  10. SID               : S-1-5-21-3330634377-1326264276-632209373-512
  12. [...]
  14. distinguishedName : CN=Administrator,CN=Users,DC=za,DC=tryhackme,DC=com name              : Administrator
  15. objectClass       : user
  16. objectGUID        : b10fe384-bcce-450b-85c8-218e3c79b30fSamAccountName    : Administrator
  17. SID               : S-1-5-21-3330634377-1326264276-632209373-500

域

查看特定域的信息

  1. PS C:\> Get-ADDomain -Server za.tryhackme.com
  3. AllowedDNSSuffixes                 : {}
  4. ChildDomains                       : {}
  5. ComputersContainer                 : CN=Computers,DC=za,DC=tryhackme,DC=com
  6. DeletedObjectsContainer            : CN=Deleted Objects,DC=za,DC=tryhackme,DC=com
  7. DistinguishedName                  : DC=za,DC=tryhackme,DC=com
  8. DNSRoot                            : za.tryhackme.com
  9. DomainControllersContainer         : OU=Domain Controllers,DC=za,DC=tryhackme,DC=com
  10. [...]
  11. UsersContainer                     : CN=Users,DC=za,DC=tryhackme,DC=com

Bloodhound

我们可以利用 BloodHound 进行 AD 枚举，基本上涉及到 AD 攻击就会使用到该工具

LDAP 枚举

389, 636, 3268, 3269 - Pentesting LDAP - HackTricks

Powerview

PowerView.ps1

PowerView 备忘单：PowerView 备忘单

  1. # 使用 powershell -ep bypass 绕过 PowerSHELL 执行策略
  2. controller\administrator@DOMAIN-CONTROLL C:\Users\Administrator>powershell -ep bypass
  3. Windows PowerShell
  4. Copyright (C) Microsoft Corporation. All rights reserved.
  6. PS C:\Users\Administrator>

WMI 枚举

Offensive WMI - Active Directory Enumeration (Part 5)

参考

TryHackMe | Enumerating Active Directory