https://blog.qife122.com/tags/kerberos%E6%94%BB%E5%87%BB/ Recent content in Kerberos攻击 on 办公AI智能小助手 Hugo zh-cn qife Mon, 06 Oct 2025 15:41:56 +0800 https://blog.qife122.com/p/windows%E5%9F%9F%E6%B8%97%E9%80%8F%E5%AE%9E%E6%88%98%E4%BB%8Esmb%E5%87%AD%E8%AF%81%E6%B3%84%E9%9C%B2%E5%88%B0dcsync%E6%8F%90%E6%9D%83/ Mon, 06 Oct 2025 15:41:56 +0800 https://blog.qife122.com/p/windows%E5%9F%9F%E6%B8%97%E9%80%8F%E5%AE%9E%E6%88%98%E4%BB%8Esmb%E5%87%AD%E8%AF%81%E6%B3%84%E9%9C%B2%E5%88%B0dcsync%E6%8F%90%E6%9D%83/ <h1 id="htb-delegate-渗透测试报告">HTB: Delegate 渗透测试报告</h1> <h2 id="侦察阶段">侦察阶段</h2> <h3 id="初始扫描">初始扫描</h3> <p>使用nmap扫描发现24个开放TCP端口，识别为Windows域控制器：</p> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">nmap -p- -vvv --min-rate <span class="m">10000</span> 10.129.56.255 </span></span></code></pre></td></tr></table> </div> </div><p>关键端口包括：</p> <ul> <li>53/tcp - DNS服务</li> <li>88/tcp - Kerberos认证</li> <li>445/tcp - SMB文件共享</li> <li>5985/tcp - WinRM远程管理</li> </ul> <p>域名为<code>delegate.vl</code>，主机名为<code>DC1</code>。</p>