# 凭证窃取
English: Credential Theft
- Entry Count: 20
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## Mimikatz凭证抓取
- ID: mimikatz-creds
- Difficulty: intermediate
- Subcategory: Mimikatz
- Tags: mimikatz, credentials, windows, lsass
- Original Extracted Source: original extracted intranet-security-wiki source/mimikatz-creds.md
Description:
使用Mimikatz抓取Windows系统凭证
Prerequisites:
- 需要管理员权限
- 需要绕过杀毒软件
- Windows系统
Execution Outline:
1. 抓取所有凭证
2. 导出LSASS
3. Pass-the-Hash
4. DCSync攻击
Analysis:
成功执行后可获取明文密码、NTLM哈希、Kerberos票据等凭证信息。
OPSEC:
- Mimikatz会被大多数杀软检测
- 使用混淆或内存加载绕过检测
- 优先考虑使用其他更隐蔽的工具
- 操作LSASS会触发EDR告警
## Kerberoasting攻击
- ID: kerberoasting
- Difficulty: intermediate
- Subcategory: Kerberos
- Tags: kerberoasting, kerberos, active-directory, spn
- Original Extracted Source: original extracted intranet-security-wiki source/kerberoasting.md
Description:
Kerberoasting攻击获取服务账户哈希
Prerequisites:
- 域环境
- 任意域用户凭证
- 域内存在SPN账户
Execution Outline:
1. 发现SPN
2. 请求服务票据
3. 导出票据
4. Rubeus请求
Analysis:
Kerberoasting可以获取服务账户的Kerberos票据，离线破解后得到明文密码。
OPSEC:
- Kerberoasting不需要高权限
- 只需要任意域用户凭证
- 建议使用RC4加密避免检测
## AS-REP Roasting
- ID: asreproasting
- Difficulty: intermediate
- Subcategory: Kerberos
- Tags: asreproasting, kerberos, active-directory
- Original Extracted Source: original extracted intranet-security-wiki source/asreproasting.md
Description:
AS-REP Roasting攻击获取用户哈希
Prerequisites:
- 域环境
- 域中存在禁用Pre-auth的用户
Execution Outline:
1. Rubeus攻击
2. Impacket攻击
3. 查找禁用Pre-auth用户
4. 破解哈希
Analysis:
AS-REP Roasting可以获取禁用Pre-auth用户的哈希，离线破解后得到明文密码。
OPSEC:
- 不需要任何凭证
- 只需要用户名
- 禁用Pre-auth是错误配置
## LaZagne凭证抓取
- ID: lazagne-creds
- Difficulty: beginner
- Subcategory: 工具
- Tags: lazagne, credentials, browsers, applications
- Original Extracted Source: original extracted intranet-security-wiki source/lazagne-creds.md
Description:
使用LaZagne抓取各种应用程序凭证
Prerequisites:
- 目标机器访问权限
- LaZagne工具
Execution Outline:
1. 抓取所有凭证
2. 浏览器凭证
3. WiFi凭证
4. 邮件客户端
Analysis:
LaZagne可以从浏览器、邮件客户端、数据库客户端等多种应用程序中提取保存的凭证。
OPSEC:
- LaZagne会被杀软检测
- 考虑使用混淆或内存加载
- 可以只运行特定模块
## SAM数据库导出
- ID: sam-dump
- Difficulty: intermediate
- Subcategory: SAM
- Tags: sam, hash, windows, local
- Original Extracted Source: original extracted intranet-security-wiki source/sam-dump.md
Description:
导出Windows SAM数据库获取本地账户哈希
Prerequisites:
- 管理员权限
- Windows系统
Execution Outline:
1. reg导出
2. Impacket解析
3. Mimikatz导出
4. Volume Shadow Copy
Analysis:
SAM数据库包含本地账户的NTLM哈希，可以用于破解或Pass-the-Hash。
OPSEC:
- 需要管理员权限
- 操作注册表可能触发告警
- 卷影副本方法更隐蔽
## NTDS.dit导出
- ID: ntds-dump
- Difficulty: advanced
- Subcategory: NTDS
- Tags: ntds, active-directory, hash, domain
- Original Extracted Source: original extracted intranet-security-wiki source/ntds-dump.md
Description:
导出Active Directory数据库获取所有域用户哈希
Prerequisites:
- 域管理员权限
- 域控制器访问权限
Execution Outline:
1. ntdsutil快照
2. Volume Shadow Copy
3. Impacket解析
4. Impacket远程转储
Analysis:
NTDS.dit包含域内所有用户的哈希，可以用于破解或Pass-the-Hash。
OPSEC:
- 需要域管理员权限
- DCSync方法更隐蔽
- 操作可能触发大量告警
## GPP密码提取
- ID: gpp-password
- Difficulty: beginner
- Subcategory: GPP
- Tags: gpp, group-policy, password, xml
- Original Extracted Source: original extracted intranet-security-wiki source/gpp-password.md
Description:
提取组策略首选项中的密码
Prerequisites:
- 域环境
- 任意域用户凭证
Execution Outline:
1. 查找GPP文件
2. PowerShell查找
3. PowerView提取
4. gpp-decrypt
Analysis:
GPP密码使用公开的密钥加密，可以被解密获取明文密码。
OPSEC:
- GPP密码是常见的信息泄露点
- 只需要普通域用户权限
- MS14-025修复后新密码不会被存储
## Mimikatz高级技巧
- ID: mimikatz-advanced
- Difficulty: expert
- Subcategory: Mimikatz
- Tags: mimikatz, credentials, advanced
- Original Extracted Source: original extracted intranet-security-wiki source/mimikatz-advanced.md
Description:
Mimikatz高级凭证提取和利用技术
Prerequisites:
- 管理员权限
- Mimikatz工具
Execution Outline:
1. DCSync攻击
2. 黄金票据生成
3. 白银票据生成
4. Skeleton Key植入
## 浏览器凭证提取
- ID: browser-creds
- Difficulty: intermediate
- Subcategory: 浏览器
- Tags: browser, credentials, chrome, firefox
- Original Extracted Source: original extracted intranet-security-wiki source/browser-creds.md
Description:
从浏览器中提取保存的密码和Cookie
Prerequisites:
- 用户权限
- 浏览器已保存密码
Execution Outline:
1. Chrome密码提取
2. Chrome Cookie提取
3. 使用SharpWeb
4. 使用HackBrowserData
## DPAPI凭证提取
- ID: dpapi-creds
- Difficulty: advanced
- Subcategory: DPAPI
- Tags: dpapi, credentials, windows
- Original Extracted Source: original extracted intranet-security-wiki source/dpapi-creds.md
Description:
从DPAPI保护存储中提取凭证
Prerequisites:
- 用户权限
- DPAPI master key
Execution Outline:
1. 枚举DPAPI凭据
2. 使用Mimikatz解密
3. 获取Master Key
## RDP凭证提取
- ID: rdp-creds
- Difficulty: intermediate
- Subcategory: RDP
- Tags: rdp, credentials, windows
- Original Extracted Source: original extracted intranet-security-wiki source/rdp-creds.md
Description:
提取保存的RDP连接密码
Prerequisites:
- 用户权限
- 已保存RDP密码
Execution Outline:
1. 查找RDP文件
2. 提取RDP密码
3. 使用Mimikatz
## WiFi凭证提取
- ID: wifi-creds
- Difficulty: beginner
- Subcategory: WiFi
- Tags: wifi, credentials, windows
- Original Extracted Source: original extracted intranet-security-wiki source/wifi-creds.md
Description:
提取保存的WiFi密码
Prerequisites:
- 管理员权限
- 已连接WiFi
Execution Outline:
1. 列出WiFi配置文件
2. 提取WiFi密码
## Windows Vault凭证
- ID: vault-creds
- Difficulty: intermediate
- Subcategory: Vault
- Tags: vault, credentials, windows
- Original Extracted Source: original extracted intranet-security-wiki source/vault-creds.md
Description:
从Windows凭据管理器提取凭证
Prerequisites:
- 用户权限
- 已保存凭据
Execution Outline:
1. 列出Vault凭据
2. 导出Vault凭据
3. 使用Mimikatz
## KeePass凭证提取
- ID: keepass-dump
- Difficulty: advanced
- Subcategory: KeePass
- Tags: keepass, credentials, password-manager
- Original Extracted Source: original extracted intranet-security-wiki source/keepass-dump.md
Description:
从KeePass数据库提取密码
Prerequisites:
- KeePass数据库文件
- 主密码或内存转储
Execution Outline:
1. 查找KeePass数据库
2. 内存提取主密码
3. 使用KeeThief
## LSA Secrets提取
- ID: lsa-secrets
- Difficulty: advanced
- Subcategory: LSA
- Tags: lsa, secrets, windows
- Original Extracted Source: original extracted intranet-security-wiki source/lsa-secrets.md
Description:
从LSA Secrets提取敏感数据
Prerequisites:
- SYSTEM权限
Execution Outline:
1. 使用Mimikatz
2. 使用reg save
3. 使用Impacket
## 缓存凭证提取
- ID: cached-creds
- Difficulty: advanced
- Subcategory: 缓存
- Tags: cached, credentials, domain
- Original Extracted Source: original extracted intranet-security-wiki source/cached-creds.md
Description:
提取域缓存凭证
Prerequisites:
- SYSTEM权限
- 域环境
Execution Outline:
1. 使用Mimikatz
2. 使用reg save
3. 离线破解
## DCSync攻击
- ID: dcsync-attack
- Difficulty: expert
- Subcategory: 域渗透
- Tags: dcsync, domain-controller, mimikatz
- Original Extracted Source: original extracted intranet-security-wiki source/dcsync-attack.md
Description:
模拟域控制器同步获取凭证
Prerequisites:
- 域管理员权限或特定权限
Execution Outline:
1. 使用Mimikatz
2. 使用impacket
3. 导出所有哈希
4. 权限要求
## 黄金票据攻击
- ID: golden-ticket
- Difficulty: expert
- Subcategory: 域持久化
- Tags: golden-ticket, krbtgt, kerberos
- Original Extracted Source: original extracted intranet-security-wiki source/golden-ticket.md
Description:
使用krbtgt哈希生成黄金票据
Prerequisites:
- krbtgt账户哈希
- 域SID
Execution Outline:
1. 获取krbtgt哈希
2. 获取域SID
3. 生成黄金票据
4. 验证票据
## 白银票据攻击
- ID: silver-ticket
- Difficulty: advanced
- Subcategory: 域持久化
- Tags: silver-ticket, kerberos, service
- Original Extracted Source: original extracted intranet-security-wiki source/silver-ticket.md
Description:
使用服务账户哈希生成白银票据
Prerequisites:
- 服务账户哈希
- 域SID
Execution Outline:
1. 获取服务哈希
2. 生成白银票据
3. 常见服务类型
## 无人值守安装凭证提取
- ID: unattended-creds
- Difficulty: beginner
- Subcategory: 文件凭证
- Tags: credentials, unattend, sysprep, privilege-escalation, windows
- Original Extracted Source: original extracted intranet-security-wiki source/unattended-creds.md
Description:
从Windows无人值守安装文件(Unattend.xml/Sysprep)中提取明文或Base64编码的管理员凭证
Prerequisites:
- 本地文件系统读取权限
- 目标使用过无人值守部署
Execution Outline:
1. 搜索无人值守安装文件
2. 全盘搜索Unattend文件
3. 提取明文密码
4. 解码Base64密码
Analysis:
无人值守安装文件是Windows大规模部署的产物。这些XML文件中的<UserAccounts>/<AutoLogon>节点可能包含本地管理员或域管理员的明文/编码凭证。该漏洞在企业环境中极为常见，因为IT部门经常忽略部署后清理这些文件。
OPSEC:
- 读取文件操作通常不会触发警报，但大量文件搜索(dir /s)可能被EDR检测。建议直接检查已知路径而非全盘搜索。
External References:
- https://attack.mitre.org/techniques/T1552/001/

