# 域渗透攻击
English: Active Directory Attacks
- Entry Count: 14
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## 域内权限提升路径
- ID: domain-privilege-escalation
- Difficulty: advanced
- Subcategory: 权限提升
- Tags: acl, privilege, active-directory, escalation
- Original Extracted Source: original extracted intranet-security-wiki source/domain-privilege-escalation.md
Description:
利用ACL错误配置进行域权限提升
Prerequisites:
- 域环境
- 普通域用户凭证
- BloodHound分析结果
Execution Outline:
1. BloodHound分析
2. 查找WriteDACL
3. 利用WriteDACL
4. 执行DCSync
Analysis:
域内ACL错误配置是常见的权限提升路径，可以通过BloodHound发现。
OPSEC:
- ACL修改会产生日志
- 优先使用隐蔽的权限
- BloodHound可以发现攻击路径
## 跨域信任攻击
- ID: domain-cross-trust
- Difficulty: advanced
- Subcategory: 跨域攻击
- Tags: trust, cross-domain, active-directory, forest
- Original Extracted Source: original extracted intranet-security-wiki source/domain-cross-trust.md
Description:
利用域信任关系进行跨域攻击
Prerequisites:
- 已获取源域权限
- 存在域信任关系
- 目标域信息
Execution Outline:
1. 枚举信任关系
2. 枚举森林信任
3. 跨域用户枚举
4. 跨域组枚举
Analysis:
跨域信任攻击可以利用信任关系从低安全域向高安全域移动。
OPSEC:
- 跨域攻击会产生日志
- SID History需要特殊权限
- 森林信任更安全
## Zerologon攻击
- ID: zerologon
- Difficulty: advanced
- Subcategory: Zerologon
- Tags: zerologon, cve-2020-1472, domain
- Original Extracted Source: original extracted intranet-security-wiki source/zerologon.md
Description:
CVE-2020-1472 Netlogon提权
Prerequisites:
- 可访问域控制器RPC
Execution Outline:
1. 检测漏洞
2. 利用漏洞
3. 导出哈希
4. 恢复密码
## PrintNightmare攻击
- ID: printnightmare
- Difficulty: advanced
- Subcategory: PrintNightmare
- Tags: printnightmare, cve-2021-34527, rce
- Original Extracted Source: original extracted intranet-security-wiki source/printnightmare.md
Description:
CVE-2021-34527 打印服务漏洞
Prerequisites:
- 可访问打印服务RPC
Execution Outline:
1. 检测漏洞
2. 利用漏洞
3. Impacket利用
## PetitPotam攻击
- ID: petitpotam
- Difficulty: advanced
- Subcategory: PetitPotam
- Tags: petitpotam, cve-2021-36942, relay
- Original Extracted Source: original extracted intranet-security-wiki source/petitpotam.md
Description:
CVE-2021-36942 强制认证攻击
Prerequisites:
- 可访问EFSRPC接口
Execution Outline:
1. 启动中继
2. 触发认证
3. 获取证书
## noPac/SAMAccountName攻击
- ID: samaccountname
- Difficulty: advanced
- Subcategory: noPac
- Tags: nopac, cve-2021-42278, privesc
- Original Extracted Source: original extracted intranet-security-wiki source/samaccountname.md
Description:
CVE-2021-42278/CVE-2021-42287 域提权
Prerequisites:
- 普通域用户权限
Execution Outline:
1. 检测漏洞
2. 利用漏洞
3. 攻击原理
## ADCS滥用攻击
- ID: adcs-abuse
- Difficulty: advanced
- Subcategory: ADCS
- Tags: adcs, certificate, domain
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-abuse.md
Description:
Active Directory证书服务滥用
Prerequisites:
- ADCS服务可访问
Execution Outline:
1. 枚举ADCS
2. 请求用户证书
3. Pass-the-Cert
4. Rubeus请求
## ADCS ESC1漏洞
- ID: adcs-esc1
- Difficulty: advanced
- Subcategory: ADCS
- Tags: adcs, esc1, certificate
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc1.md
Description:
证书模板ESC1滥用
Prerequisites:
- 存在ESC1配置的模板
Execution Outline:
1. 识别ESC1
2. 利用ESC1
3. 认证为域管
## 约束委派攻击
- ID: constrained-delegation
- Difficulty: advanced
- Subcategory: 委派攻击
- Tags: delegation, constrained, kerberos
- Original Extracted Source: original extracted intranet-security-wiki source/constrained-delegation.md
Description:
利用约束委派进行横向移动
Prerequisites:
- 存在约束委派配置的账户
Execution Outline:
1. 查找约束委派
2. 获取服务票据
3. 使用票据
## 基于资源的约束委派
- ID: resource-delegation
- Difficulty: expert
- Subcategory: 委派攻击
- Tags: rbcd, delegation, kerberos
- Original Extracted Source: original extracted intranet-security-wiki source/resource-delegation.md
Description:
利用RBCD进行权限提升
Prerequisites:
- 对目标对象有WriteDACL权限
Execution Outline:
1. 创建机器账户
2. 配置RBCD
3. 利用RBCD
## DCShadow攻击
- ID: dcshadow-attack
- Difficulty: expert
- Subcategory: DCShadow
- Tags: dcshadow, domain, injection
- Original Extracted Source: original extracted intranet-security-wiki source/dcshadow-attack.md
Description:
伪造域控制器注入数据
Prerequisites:
- 域管理员权限
- 可注册新DC
Execution Outline:
1. 注册伪造DC
2. 推送更改
3. 常见利用
## 组策略滥用
- ID: group-policy-abuse
- Difficulty: advanced
- Subcategory: 组策略
- Tags: gpo, group-policy, domain
- Original Extracted Source: original extracted intranet-security-wiki source/group-policy-abuse.md
Description:
滥用组策略进行横向移动
Prerequisites:
- GPO编辑权限
Execution Outline:
1. 查找可编辑GPO
2. 添加计划任务
3. 添加注册表项
## SAM The Admin攻击
- ID: sam-the-admin
- Difficulty: advanced
- Subcategory: SAM The Admin
- Tags: ad, cve-2021-42278, privilege
- Original Extracted Source: original extracted intranet-security-wiki source/sam-the-admin.md
Description:
CVE-2021-42278/CVE-2021-42287域提权
Prerequisites:
- 域用户权限
- 域控制器存在漏洞
Execution Outline:
1. 检测漏洞
2. 利用漏洞
3. 执行命令
## NoAuth攻击
- ID: noauth
- Difficulty: advanced
- Subcategory: NoAuth
- Tags: ad, cve-2022-33679, kerberos
- Original Extracted Source: original extracted intranet-security-wiki source/noauth.md
Description:
CVE-2022-33679 Kerberos认证绕过
Prerequisites:
- 域用户权限
- 目标账户有RC4密钥
Execution Outline:
1. 检测漏洞
2. 利用漏洞
3. 使用TGT

