Silver Ticket
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Bug bounty tip: jiandikishe kwa Intigriti, jukwaa la bug bounty la kiwango cha juu lililotengenezwa na hackers, kwa hackers! Jiunge nasi kwenye https://go.intigriti.com/hacktricks leo, na uanze kupata zawadi hadi $100,000!
Shambulio la Silver Ticket linahusisha unyakuzi wa tiketi za huduma katika mazingira ya Active Directory (AD). Njia hii inategemea kupata hash ya NTLM ya akaunti ya huduma, kama akaunti ya kompyuta, ili kutunga tiketi ya Ticket Granting Service (TGS). Kwa tiketi hii iliyotungwa, mshambuliaji anaweza kufikia huduma maalum kwenye mtandao, akijifanya kuwa mtumiaji yeyote, kwa kawaida akilenga haki za usimamizi. Inasisitizwa kwamba kutumia funguo za AES kwa kutunga tiketi ni salama zaidi na ngumu kugundulika.
Kwa ajili ya kutunga tiketi, zana tofauti zinatumika kulingana na mfumo wa uendeshaji:
The CIFS service is highlighted as a common target for accessing the victim's file system, but other services like HOST and RPCSS can also be exploited for tasks and WMI queries.
| Service Type | Service Silver Tickets |
|---|---|
WMI | HOST RPCSS |
PowerShell Remoting | HOST HTTP Kulingana na OS pia: WSMAN RPCSS |
WinRM | HOST HTTP Katika matukio mengine unaweza tu kuuliza: WINRM |
Scheduled Tasks | HOST |
Windows File Share, also psexec | CIFS |
LDAP operations, included DCSync | LDAP |
Windows Remote Server Administration Tools | RPCSS LDAP CIFS |
Golden Tickets | krbtgt |
Using Rubeus you may ask for all these tickets using the parameter:
/altservice:host,RPCSS,http,wsman,cifs,ldap,krbtgt,winrm
4624: Account Logon
4634: Account Logoff
4672: Admin Logon
In the following examples lets imagine that the ticket is retrieved impersonating the administrator account.
With this ticket you will be able to access the C$ and ADMIN$ folder via SMB (if they are exposed) and copy files to a part of the remote filesystem just doing something like:
You will also be able to obtain a shell inside the host or execute arbitrary commands using psexec:
PsExec/Winexec/ScExecWith this permission you can generate scheduled tasks in remote computers and execute arbitrary commands:
Kwa tiketi hizi unaweza kutekeleza WMI katika mfumo wa mwathirika:
Pata maelezo zaidi kuhusu wmiexec katika ukurasa ufuatao:
WmiExecKwa ufikiaji wa winrm juu ya kompyuta unaweza kuipata na hata kupata PowerShell:
Check the following page to learn njia zaidi za kuungana na mwenyeji wa mbali kwa kutumia winrm:
WinRMNote that winrm lazima iwe hai na inasikiliza kwenye kompyuta ya mbali ili kuweza kuipata.
With this privilege you can dump the DC database using DCSync:
Jifunze zaidi kuhusu DCSync katika ukurasa ufuatao:
Usanidi wa bug bounty: jiandikishe kwa Intigriti, jukwaa la bug bounty la kiwango cha juu lililotengenezwa na hackers, kwa hackers! Jiunge nasi katika https://go.intigriti.com/hacktricks leo, na anza kupata zawadi hadi $100,000!
Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
