Recent content in 博客 on Lamber
<blockquote> <p><em>我们的文化并不鼓励我们过多地思考“学习”这件事。相反，我们将其视为一件自然而然发生在我们身上的事情。但学习本身必然包含一套需要我们自己培养的技能；我们起初只掌握其中一部分，然后慢慢地培养出其余部分。为什么没有更多的人持续地去学习更多、更好的学习技能呢？因为这种努力不会马上得到回报，它需要很长时间才能看到收益。</em> </p> <p>——马文·明斯基</p></blockquote> <p>（全文译自 <a href="https://help.supermemo.org/wiki/Incremental_learning">Incremental learning</a> 2025年6月24日12:48版。）</p>
<h2 id="原理">原理</h2> <p>RID Cycling是一种允许攻击者通过暴力破解或猜测RID和SID来枚举域对象的攻击方法，其原理基于RID是顺序排列的这一事实。</p> <h2 id="相关工具">相关工具</h2> <p>netexec</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">netexec smb <IP> -u <span class="s1">'user'</span> -p <span class="s1">'pass'</span> --rid-brute </span></span></code></pre></div><p>impacket</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">impacket-lookupsid <span class="s1">'domain'</span>/<span class="s1">'username'</span>:<span class="s1">'password'</span>@<span class="s1">'<targetName or address>'</span> </span></span></code></pre></div><p><a href="https://github.com/trustedsec/ridenum">ridenum</a></p> <pre tabindex="0"><code>./ridenum.py 192.168.1.50 500 50000 /root/dict.txt /root/user.txt </code></pre><h2 id="参考链接">参考链接</h2> <ol> <li><a href="https://www.thehacker.recipes/ad/recon/ms-rpc#rid-cycling">The Hacker Recipes - RID Cycling</a></li> </ol>
<h2 id="01-安装">01. 安装</h2> <blockquote> <p>An extremely fast Python package and project manager, written in Rust.</p></blockquote> <h3 id="0101-安装uv">01.01 安装uv</h3> <p>安装方法参考其<a href="https://github.com/astral-sh/uv">官方仓库</a></p> <h3 id="0102-通过uv安装特定版本的python">01.02 通过uv安装特定版本的python</h3> <p> <code>uv</code> 可以使用 <code>--python</code> 标志来指定 Python 版本，例如 <code>--python 3.11</code> 。如果系统上没有安装这个版本的python，它会下载并安装。</p> <h2 id="02-用法">02. 用法</h2> <h3 id="0201-使用uv安装python软件包">02.01 使用uv安装python软件包</h3> <p>所有能够使用 <code>pipx install</code> 安装的python工具，都可以使用 <code>uv tool install</code> 安装</p> <p>并且支持以下3种安装方式：</p> <ol> <li>从PyPI安装：<code>uv tool install impacket</code></li> <li>从git安装：<code>uv tool install git+https://github.com/Pennyw0rth/NetExec</code> <ol> <li>如果需要安装特定分支，只需要：<code>uv tool install git+https://github.com/dirkjanm/BloodHound.py.git@bloodhound-ce</code></li> </ol> </li> <li>从本地安装（也就是支持 <code>setup.py</code> 或 <code>setup.cfg</code> 或 <code>pyproject.toml</code> 安装方式的包）：<code>uv tool install .</code></li> </ol> <p>注：如果项目所描述的依赖不全，可以使用 <code>uv tool install --with <package></code> 手动附加额外的依赖</p>
<h2 id="cisco">Cisco</h2> <p><a href="https://www.firewall.cx/cisco/cisco-routers/cisco-type7-password-crack.html">Cisco Type 7 Password Decrypt / Decoder / Crack Tool</a></p> <p>案例参考：<a href="https://lamber-maybe.com/hackthebox/machines/heist/">HackTheBox Machines Heist</a></p>
<p>直接使用 <code>apt install</code> 安装的 rust 会存在版本老旧的问题，一些新的工具可能不兼容老版本rust。</p> <p>按照以下步骤，可以安装最新版的rust，并使用最新版的cargo安装新工具：</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 1. 系统更新并安装必要工具</span> </span></span><span class="line"><span class="cl">sudo apt update </span></span><span class="line"><span class="cl">sudo apt install -y build-essential curl </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 2. 安装 rustup（会安装 rustc 和 cargo）</span> </span></span><span class="line"><span class="cl">curl --proto <span class="s1">'=https'</span> --tlsv1.2 -sSf https://sh.rustup.rs <span class="p">|</span> sh -s -- -y </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 3. 让当前 shell 生效（或重开一个终端）</span> </span></span><span class="line"><span class="cl"><span class="nb">source</span> <span class="s2">"</span><span class="nv">$HOME</span><span class="s2">/.cargo/env"</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 4. 使用 cargo 安装 rustscan（加 --locked 更保险）</span> </span></span><span class="line"><span class="cl">cargo install --locked rustscan </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 5. 确认安装成功</span> </span></span><span class="line"><span class="cl">rustscan --version </span></span></code></pre></div>
<ol> <li>当拥有一个账户时，右键将该账户 <code>Mark User as Owned</code> ，然后 <code>Analysis</code> -> <code>Shortest Path from Owned Principals</code> 可以快速发掘可利用路径</li> </ol> <h3 id="自定义查询语句">自定义查询语句</h3> <p>检索 WinRM 权限</p> <pre tabindex="0"><code class="language-cypher" data-lang="cypher">MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer) RETURN p2 </code></pre><p>检索 SQLAdmin 账户</p> <pre tabindex="0"><code class="language-cypher" data-lang="cypher">MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:SQLAdmin*1..]->(c:Computer) RETURN p2 </code></pre>
演示如何在Hugo博客中使用asciinema player播放终端录制文件
<h2 id="方案一-clash">方案一: Clash</h2> <blockquote> <p>优点: 简单，成本较低（可以选择买一个好梯子强行提速）</p> <p>缺点: 稳定性一般，延迟较高（日常120ms左右），多机器协作麻烦</p></blockquote> <!-- more --> <h3 id="1-本机作为攻击机openvpn开在本机上">1. 本机作为攻击机（openvpn开在本机上）</h3> <p>直接在 openvpn 文件中添加</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">socks-proxy 127.0.0.1 7890 </span></span></code></pre></div><p>注: 7890代表 Clash 的端口</p> <h3 id="2-kali虚拟机作为攻击机openvpn开在kali上">2. kali虚拟机作为攻击机（openvpn开在kali上）</h3> <p>在本机上打开 Clash，并打开Clash设置中的 <code>Allow LAN</code></p> <p>然后找到本机和kali虚拟机同网段的ip地址，如</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">本机ip: 192.168.40.1 </span></span><span class="line"><span class="cl">kali ip: 192.168.40.128 </span></span></code></pre></div><p>然后在 openvpn 文件中添加</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">socks-proxy 192.168.40.1 7890 </span></span></code></pre></div><h3 id="3-注意事项">3. 注意事项</h3> <p>HackThebox在提供openvpn配置文件时，可以选择 UDP 协议或者 TCP 协议。对于大多数梯子来说，对于UDP协议的支持都比较一般，所以更推荐 TCP 协议（虽然相对来说会慢一点点）</p> <p>如果使用的是TCP协议的配置文件，则将上文中提到的 <code>socks-proxy</code> 修改为 <code>http-proxy</code> 即可：</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">http-proxy 192.168.40.1 7890 </span></span></code></pre></div><h2 id="方案二-zerotire组网">方案二: Zerotire组网</h2> <blockquote> <p>优点: 足够稳定（3个月期间从未出现断连情况），延迟低（日常70ms左右，几乎只剩下物理距离导致的延迟），多机器协作方便</p> <p>缺点: 成本比clash高一点，需要vps，操作上比Clash方案麻烦一点（但是弄好之后一劳永逸）</p></blockquote> <ol> <li>首先整一个英国伦敦的vps（离HackTheBox机房近）</li> <li>在vps上运行openvpn（这时会看到多出来一张网卡 <code>tun0</code> 记住这个网卡名字）</li> <li>在vps上安装 Zerotire 并设置为 <a href="https://docs.zerotier.com/exitnode">exitnode</a></li> </ol> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 安装</span> </span></span><span class="line"><span class="cl">$ curl -s https://install.zerotier.com <span class="p">|</span> sudo bash </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 在Zerotire网页端创建一个网络，然后记下这个网络的nwid，将vps加入这个网络</span> </span></span><span class="line"><span class="cl">$ sudo zerotier-cli join <nwid> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 启用ipv4转发，在 /etc/sysctl.conf 添加一行 net.ipv4.ip_forward = 1</span> </span></span><span class="line"><span class="cl">$ sudo nano /etc/sysctl.conf </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 重新加载sysctl.conf</span> </span></span><span class="line"><span class="cl">$ sudo sysctl -p </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 验证是否启用成功</span> </span></span><span class="line"><span class="cl">$ sudo sysctl net.ipv4.ip_forward </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 查看网卡信息，记下Zerotire网卡的名称，假设这里是叫 zthnhhqofq</span> </span></span><span class="line"><span class="cl">$ <span class="nb">export</span> <span class="nv">ZT_IF</span><span class="o">=</span>zthnhhqofq </span></span><span class="line"><span class="cl">$ <span class="nb">export</span> <span class="nv">WAN_IF</span><span class="o">=</span>tun0 </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 配置iptables</span> </span></span><span class="line"><span class="cl">$ sudo iptables -t nat -A POSTROUTING -o <span class="nv">$WAN_IF</span> -j MASQUERADE </span></span><span class="line"><span class="cl">$ sudo iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT </span></span><span class="line"><span class="cl">$ sudo iptables -A FORWARD -i <span class="nv">$ZT_IF</span> -o <span class="nv">$WAN_IF</span> -j ACCEPT </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 保存iptables设置</span> </span></span><span class="line"><span class="cl">$ sudo apt-get install iptables-persistent </span></span><span class="line"><span class="cl">$ sudo netfilter-persistent save </span></span></code></pre></div><p>然后到 Zerotire 控制面板处 <code>Add Routes</code></p>
Recent content on forecho's Blog
Provides a better reading experience (full articles) over the official ones.