AccountHuntingforInvokeTokenManipulation伪造token前的账号猎取

source: https://www.trustedsec.com/january-2015/account-hunting-invoke-tokenmanipulation/

I’ve been searching quite a while now for the best way to search for domain admin tokens, once admin rights are attained on a large number of systems during a pentest. Normally, I run “psexec_loggedin_users” within Metasploit, spool the output to a file, then egrep it for users in the “Domain Admins” group. This often works, but can easily miss systems that have a domain admin kerberos security token still loaded in memory. There are a couple of “Token_Hunter” post modules, but you need to have a shell on the systems to run them, which can take a long time to establish, load incognito, and list tokens. As much as I love shellz, I certainly don’t care to have a couple thousand of them connecting back to my machine. So, I think I’ve finally pieced together a viable method from a couple of articles posted around the Internet.

在渗透测试中，得到一些admin权限后，寡人都会寻找搜索域管理员令牌的最好办法。通常情况下，我在metasploit里运行“psexec_loggedin_users，j结果输出到一个文件，然后egrep出“域管理员”组的用户。这往往是有效的，但要是有个域管理员Kerberos安全令牌仍然在内存中加载，俺们就要错过他了。这有一组“token_hunter”后的模块，你需要有个shell来运行它们，这需要很长时间才能建立，隐藏负载，整理token。如同我爱shellz，我当然不会介意几千人回连到我的机器。所以，我想我终于从网上的文章中拼凑出个可行的方法。

The first article is from Chris Campbell posted on PentestGeek. It shows us how to download and execute a PowerSploit module using PowerShell, all in memory. A couple of posts have described utilizing this method with Invoke-Mimikatz.ps1, so why not Invoke-TokenManipulation.ps1? For reference: Carnal0wnage, HarmJoy

第一篇文章是克里斯坎贝尔贴在pentestgeek上的。印象中，它告诉我们如何用PowerShell下载并执行一个powersploit模块。一些帖子有用invoke-mimikatz.ps1来实现，但为什么不用invoke-tokenmanipulation.ps1呢？参考资料：carnal0wnage harmjoy，

To setup the environment, I first downloaded PowerSploit to my apache directory:

要安装环境，首先我下了powersploit到Apache目录：

Then configured Samba with an open share to capture the output files:

然后配置Samba开放共享来捕获输出文件：

Then create the folder and grant full permissions. I created a folder named “tokens” under “loot”.

Then, I stole the “PowerShell encoding” section from David Kennedy’s “unicorn” script to encode the following string:

然后创建文件夹授予完全权限。我在‘loot‘下创建了一个文件夹命名为“token”。

然后，我偷偷拿走戴维甘乃迪的“unicorn”脚本里的“PowerShell encoding”来编码下面的字符串：

This will download “Invoke-TokenManipulation.ps1” from my web host, execute it within memory to enumerate tokens, and pipe the output to my SMB share into a file named as the computer.

Now, I just use the “psexec_command” module within Metasploit to execute my encoded string on all systems and rain down tokens into my share.

这将从我的网站主机下载”Invoke-TokenManipulation.ps1”，在内存执行，枚举token，输出到我的SMB共享的文件夹，文件以那台计算机命名。

现在，我在metasploit里用“psexec_command”模块于所有系统中来执行我编码的字符串，然后token雨点般进入我的共享文件夹。

Then, just egrep the files to enumerate any domain admins.

然后，egrep文件列举任何域管理员。

All that’s left is to pop a shell on that system, impersonate their token, and escalate privileges on the domain.

The “encoding” script was easily modified for Mimikatz as well (it writes to “loot$/passwords/”). To grep the file for a specific user’s password:

剩下的就是在系统pop个shell，模仿他们的令牌，提权域。

“encoding”的脚本很容易把mimikatz加进去以及（写进“loot$/passwords/”）。grep文件出特定用户的密码：

脚本都在下面了. Happy Hunting!

TokenHunter.py

PasswordHunter.py

（我翻译完了， 个人理解，这是个批量获得用户token和密码的东东）

Account Hunting for Invoke-TokenManipulation 伪造token前的账号猎取