11、域滲透測試中使用到的命令+工具

命令

ipconfig /all                         ------ 查詢本機IP段，所在域等 
net user                              ------ 本機使用者列表 
net localhroup administrators         ------ 本機管理員[通常含有域使用者] 
net user /domain                      ------ 查詢域使用者 
net group /domain                     ------ 查詢域裡面的工作組
net group "domain admins" /domain     ------ 查詢域管理員使用者組 
net localgroup administrators /domain ------ 登入本機的域管理員
net localgroup administrators workgroup\user001 /add   ------域使用者新增到本機
net group "domain controllers" /domain                         ------ 檢視域控制器(如果有多臺) 
net time /domain                      ------ 判斷主域，主域伺服器都做時間伺服器 
net config workstation                ------ 當前登入域 
net session                           ------ 檢視當前會話 
net use \\ip\ipc$ pawword /user:username      ------ 建立IPC會話[空連線-***] 
net share                              ------  檢視SMB指向的路徑[即共享]
net view                               ------ 查詢同一域內機器列表 
net view \\ip                          ------ 查詢某IP共享
net view /domain                       ------ 查詢域列表
net view /domain:domainname            ------ 檢視workgroup域中計算機列表 
net start                              ------ 檢視當前執行的服務 
net accounts                           ------  檢視本地密碼策略 
net accounts /domain                   ------  檢視域密碼策略 
nbtstat –A ip                          ------netbios 查詢 
netstat –an/ano/anb                    ------ 網路連線查詢 
route print                            ------ 路由表

dsquery computer          ----- finds computers in the directory.
dsquery contact           ----- finds contacts in thedirectory.
dsquery subnet            ----- finds subnets in thedirectory.
dsquery group             ----- finds groups in thedirectory.
dsquery ou                ----- finds organizationalunits in the directory.
dsquery site              ----- finds sites in thedirectory.
dsquery server            ----- finds domain controllers inthe directory.
dsquery user              ----- finds users in thedirectory.
dsquery quota             ----- finds quota specificationsin the directory.
dsquery partition         ----- finds partitions in thedirectory.
dsquery *                 ----- finds any object inthe directory by using a generic LDAP query.
dsquery server –domain Yahoo.com | dsget server–dnsname –site ---搜尋域內域控制器的DNS主機名和站點名
dsquery computer domainroot –name *-xp –limit 10----- 搜尋域內以-xp結尾的機器10臺
dsquery user domainroot –name admin* -limit ---- 搜尋域內以admin開頭的使用者10個
……
……
[注:dsquery來源於Windows Server 2003 Administration Tools Pack]

wmic bios                                                 ----- 檢視bios資訊
wmic qfe                                                  ----- 檢視補丁資訊
wmic qfe get hotfixid                                     ----- 檢視補丁-Patch號
wmic startup                                              ----- 檢視啟動項
wmic service                                              ----- 檢視服務
wmic os                                                   ----- 檢視OS資訊
wmic process get caption,executablepath,commandline
wmic process call create “process_name” (executes a program)
wmic process where name=”process_name” call terminate (terminates program)
wmic logicaldisk where drivetype=3 get name, freespace, systemname, filesystem, size,
volumeserialnumber (hard drive information)
wmic useraccount (usernames, sid, and various security related goodies)
wmic useraccount get /ALL
wmic share get /ALL (you can use ? for gets help ! )
wmic startup list full (this can be a huge list!!!)
wmic /node:"hostname" bios get serialnumber (this can be great for finding warranty info about target)

工具

1.mimikatz.exe
https://github.com/gentilkiwi/mimikatz/
 
2.Pwdump7.exe
 
3.QuarksPwDump.exe
 
4.psexec.exe
https://technet.microsoft.com/ko-kr/sysinternals/bb897553.aspx
 
5.kerberoast
https://github.com/nidem/kerberoast
 
6.WMIEXEC.vbs
https://www.t00ls.net/thread-21167-1-1.html