Try   HackMD

Занятие 6. Базовые атаки и компрометация доменной Windows-инфраструктуры

Практическая работа №6.1 Базовые атаки на Windows-инфраструктуру

Часть 1. Базовые атаки на инфраструктуру Windows. 1.1 Бэкап NTDS

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

1.2 Перенос NTDS

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

1.3 Анализ NTDS

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Этап 2. Path-the-hash. 2.1 Crackmapexec

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

2.2 XFreeRDP

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Этап 3. Атаки на базовые протоколы Windows. Доменный ПК пытается обратиться к несуществующему сетевому ресурсу

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Анализатор видит LLNMR, NBNS запросы

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Responder запускается

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Пользователь снова проходит по несуществующему пути

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Responder перехватывает аутентификационный токен

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

mitm6. Установка: pip install mitm6. Выполнение атаки: mitm6.py -d pt.local.Настройки сетевого адаптера pc1. Было

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

После атаки с Kali Linux. Настройки сетевого адаптера pc1. Стало

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Создание своего сервера SMB. Не отключая mitm6, создадим SMB сервер

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

А на Win10 через проводник попробуем зайти на наш домен

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Увидим данные аутентификации в выводе программы

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Практическая работа №6.2 Компрометация доменной Windows-инфраструктуры

Для начала нужно активировать политику аудита машинных учетных записей и применить к контроллерам домена

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Часть 2. Эксплуатация уязвимостей контроллера домена. 2.1 Проведем поиск по уязвимости zerologon и найдём множество репозиториев на github, в том числе и с эксплойтами

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

2.2 Скачаем один из них

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

2.3 Перейдем в скачанную папку и прочитаем README

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

2.4 Нам предлагают использовать консткукцию для вызова эксплойта. Используем команду

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

2.7 Перейдём в impacket/examples и выполним оттуда команду

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

2.8 С помощью полученных хешей учетных данных можно выполнять команды от любого пользователя

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Часть 3. Поиск следов эксплуатации уязвимостей.3.1 Проверим журнал System, увидим ошибку Netlogon

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

3.1 Проверим Security, увидим событие 4742

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

3.1 Внимательно проанализируем событие

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

3.1 Найдём событие 5823 в журнале System с помощью фильтра. Событие есть, но оно произошло намного раньше

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Если поискать события 4742 за день, когда произошло 5823, то мы их найдём. Это легитимные события, связанные с введением в домен dc2

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Можно искать события с помощью PowerShell

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

3.1 Если происходит дамп NTDS, то можно увидеть данные выгрузки в журнале Direcrory Service

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Last changed by 
 
Maxim33
0
351

Read more

Занятие 3. Основные атаки и паттерны

Итоговая статистика Lab: SQL injection vulnerability allowing login bypass Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data Lab: SQL injection UNION attack, retrieving data from other tables Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

Sep 16, 2022
Занятие 2. Архитектура WEB

Самостоятельно выполните запросы к корневому DNS серверу и посмотрите какие есть корневые DNS сервера. Отправьте DNS запрос и выясните какие сервера отвечают за зону ru. Выясните сколько почтовых серверов у ptsecurity.com, отправив запрос соответствующего типа. Выясните какое имя сервера связано с IP адресом 77.88.8.7. ptr - обратная DNS-запись, которая связывает IP-адрес сервера с его каноническим именем, в данном случае yandex.ru

Sep 14, 2022
Занятие 1. Введение в Web технологии

Установить и настроить  linux ubuntu 20.04 Установить Docker CE Установить веб-приложение https://hub.docker.com/r/bkimminich/juice-shop 5) Изучить запросы браузера к приложению  и форме регистрации пользователе Ответ сервера при регистрации нового пользователя

Sep 14, 2022
Практическая работа №5

Установить Debian 11 Создать snapshot Включить пользователя в группу sudo Выделить место на VMware под новый HDD Создать 2 новыx HDD

Sep 10, 2022
Read more from Maxim33
Published on HackMD