Active Directory 漏洞利用速查表

此速查表包含 Windows Active Directory 的常见枚举和攻击方法。

ℹ️ 此仓库由 Nikos Katsiopis 和 Nikos Vourdas 创建。

此速查表灵感来源于 PayloadAllTheThings 仓库。

摘要

• Active Directory 漏洞利用速查表
  • 摘要
  • 工具
  • 域枚举
    • 使用 PowerView
    • 使用 AD Module
    • 使用 BloodHound
      • 远程 BloodHound
      • 现场 BloodHound
    • 使用 Adalanche
      • 远程 Adalanche
    • 导出枚举对象
    • 有用的枚举工具
  • 本地权限提升
    • 有用的本地权限提升工具
  • 横向移动
    • PowerShell 远程管理
    • 使用 PS 凭据远程执行代码
    • 导入 PowerShell 模块并远程执行其函数
    • 执行远程有状态命令
    • Mimikatz
    • 远程桌面协议
    • URL 文件攻击
    • 有用的工具
  • 域权限提升
    • Kerberoast
    • ASREPRoast
    • 密码喷洒攻击
    • 强制设置 SPN
    • 滥用卷影副本
    • 使用 Mimikatz 列出并解密存储的凭据
    • 无约束委派
    • 约束委派
    • 基于资源的约束委派
    • DNSAdmins 滥用
    • 滥用 Active Directory 集成 DNS
    • 滥用备份操作员组
    • 滥用 Exchange
    • 武器化打印机漏洞
    • 滥用 ACL
    • 使用 mitm6 滥用 IPv6
    • SID 历史记录滥用
    • 利用 SharePoint
    • Zerologon
    • PrintNightmare
    • Active Directory 证书服务
    • 无 PAC
  • 域持久性
    • 黄金票据攻击
    • DCsync 攻击
    • 白银票据攻击
    • 万能钥匙攻击
    • DSRM 滥用
    • 自定义 SSP
  • 跨林攻击
    • 信任票据
    • 滥用 MSSQL 服务器
    • 打破林信任

工具

• Powersploit
• PowerUpSQL
• Powermad
• Impacket
• Mimikatz
• Rubeus -> 编译版本
• BloodHound
• AD Module
• ASREPRoast
• Adalanche

域枚举

使用 PowerView

Powerview v.3.0
Powerview 维基

• 获取当前域： Get-Domain

• 枚举其他域： Get-Domain -Domain <域名>

• 获取域 SID： Get-DomainSID

• 获取域策略： ```powershell Get-DomainPolicy

  #Will show us the policy configurations of the Domain about system access or kerberos Get-DomainPolicy | Select-Object -ExpandProperty SystemAccess Get-DomainPolicy | Select-Object -ExpandProperty KerberosPolicy

• 获取域控制器： ```powershell Get-DomainController Get-DomainController -Domain

• 枚举域用户： ```powershell #Save all Domain Users to a file Get-DomainUser | Out-File -FilePath .\DomainUsers.txt

  #Will return specific properties of a specific user Get-DomainUser -Identity [username] -Properties DisplayName, MemberOf | Format-List

  #Enumerate user logged on a machine Get-NetLoggedon -ComputerName

  #Enumerate Session Information for a machine Get-NetSession -ComputerName

  #Enumerate domain machines of the current/specified domain where specific users are logged into Find-DomainUserLocation -Domain | Select-Object UserName, SessionFromName

• 枚举域计算机： ```powershell Get-DomainComputer -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName

  #Enumerate Live machines Get-DomainComputer -Ping -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName

• 枚举组和组成员： ```powershell #Save all Domain Groups to a file: Get-DomainGroup | Out-File -FilePath .\DomainGroup.txt

  #Return members of Specific Group (eg. Domain Admins & Enterprise Admins) Get-DomainGroup -Identity '' | Select-Object -ExpandProperty Member Get-DomainGroupMember -Identity '' | Select-Object MemberDistinguishedName

  #Enumerate the local groups on the local (or remote) machine. Requires local admin rights on the remote machine Get-NetLocalGroup | Select-Object GroupName

  #Enumerates members of a specific local group on the local (or remote) machine. Also requires local admin rights on the remote machine Get-NetLocalGroupMember -GroupName Administrators | Select-Object MemberName, IsGroup, IsDomain

  #Return all GPOs in a domain that modify local group memberships through Restricted Groups or Group Policy Preferences Get-DomainGPOLocalGroup | Select-Object GPODisplayName, GroupName

• 枚举共享： ```powershell #Enumerate Domain Shares Find-DomainShare

  #Enumerate Domain Shares the current user has access Find-DomainShare -CheckShareAccess

  #Enumerate "Interesting" Files on accessible shares Find-InterestingDomainShareFile -Include passwords

• 枚举组策略： ```powershell Get-DomainGPO -Properties DisplayName | Sort-Object -Property DisplayName

  #Enumerate all GPOs to a specific computer Get-DomainGPO -ComputerIdentity -Properties DisplayName | Sort-Object -Property DisplayName

  #Get users that are part of a Machine's local Admin group Get-DomainGPOComputerLocalGroupMapping -ComputerName

• 枚举 OU: ```powershell Get-DomainOU -Properties Name | Sort-Object -Property Name

• **枚举 ACLs: ```powershell

  Returns the ACLs associated with the specified account

  Get-DomainObjectAcl -Identity -ResolveGUIDs

  #Search for interesting ACEs Find-InterestingDomainAcl -ResolveGUIDs

  #Check the ACLs associated with a specified path (e.g smb share) Get-PathAcl -Path "\Path\Of\A\Share"

• 枚举域信任： ```powershell Get-DomainTrust Get-DomainTrust -Domain

  #Enumerate all trusts for the current domain and then enumerates all trusts for each domain it finds Get-DomainTrustMapping

• 枚举森林信任： ```powershell Get-ForestDomain Get-ForestDomain -Forest

  #Map the Trust of the Forest Get-ForestTrust Get-ForestTrust -Forest

• 用户追踪: ```powershell #Finds all machines on the current domain where the current user has local admin access Find-LocalAdminAccess -Verbose

  #Find local admins on all machines of the domain Find-DomainLocalGroupMember -Verbose

  #Find computers were a Domain Admin OR a specified user has a session Find-DomainUserLocation | Select-Object UserName, SessionFromName