> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory.md).

# Active Directory

用于进攻性安全实验室和内部渗透测试的 Active Directory 实用笔记：发现、域映射、Kerberos、凭据、ACL、BloodHound 路径以及横向移动。

## Active Directory 工作流

1. 构建域上下文：域名、域控制器、用户、组、计算机、OU、GPO 和信任关系。
2. 枚举可访问的共享、会话、本地管理员权限、LDAP 对象和 BloodHound 关系。
3. 检查 Kerberos 攻击路径，例如用户枚举、AS-REP Roasting、Kerberoasting 和密码喷洒。
4. 审查 ACL、危险权限、所有权、DACL/SACL/ACE 条目以及 DCSync 权限。
5. 通过 LSASS、SAM、MSCache、令牌、哈希和票据提取或验证凭据。
6. 使用 WinRM、SMB、Kerberos 票据、令牌滥用或哈希复用，将发现转化为横向移动路径。

## Active Directory 技术

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-book-open" style="color:$primary;">:book-open:</i></h3></td><td><h4>基础</h4></td><td>Active Directory 基础安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/841158344e694e445e5d5688ff76ec507840e981">/pages/841158344e694e445e5d5688ff76ec507840e981</a></td></tr><tr><td><h3><i class="fa-flask" style="color:$primary;">:flask:</i></h3></td><td><h4>实验室设置</h4></td><td>Active Directory 实验室安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。</td><td><a href="/pages/2882d9e6ce516129aa087b7a8c76b0591e80553d">/pages/2882d9e6ce516129aa087b7a8c76b0591e80553d</a></td></tr><tr><td><h3><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></h3></td><td><h4>枚举</h4></td><td>用于用户、组、计算机、GPO、共享、ACL、域控制器、BloodHound、PowerView、LDAP 和 Impacket 的 Active Directory 枚举工作流。</td><td><a href="/pages/26628977e5a4b1354bc4073fe4a685171acdc543">/pages/26628977e5a4b1354bc4073fe4a685171acdc543</a></td></tr><tr><td><h3><i class="fa-shield-halved" style="color:$primary;">:shield-halved:</i></h3></td><td><h4>ACL 和权限</h4></td><td>Active Directory ACL 滥用笔记，涵盖安全描述符、DACL、SACL、ACE、危险权限、BloodHound 路径、DCSync 和密码喷洒。</td><td><a href="/pages/ad0b68838d0cc3d3e20414eed08757c590d001ea">/pages/ad0b68838d0cc3d3e20414eed08757c590d001ea</a></td></tr><tr><td><h3><i class="fa-ticket" style="color:$primary;">:ticket:</i></h3></td><td><h4>Kerberos</h4></td><td>用于 Active Directory 的 Kerberos 攻击笔记，涵盖 AS-REP Roasting、Kerberoasting、密码喷洒、Rubeus、Impacket、SPN、票据和 Wireshark 分析。</td><td><a href="/pages/a653f72aa8ce1c3fdba4333ac212f58ab2d2056d">/pages/a653f72aa8ce1c3fdba4333ac212f58ab2d2056d</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>凭据和令牌</h4></td><td>Windows 和 Active Directory 凭据笔记，涵盖 LSASS、SAM、MSCache、访问令牌、模拟令牌、LogonSessions、注册表配置单元和 Mimikatz。</td><td><a href="/pages/de52ac9870407d70a8b694450a5ca530aa44d688">/pages/de52ac9870407d70a8b694450a5ca530aa44d688</a></td></tr><tr><td><h3><i class="fa-right-left" style="color:$primary;">:right-left:</i></h3></td><td><h4>横向移动</h4></td><td>Active Directory 横向移动笔记，涵盖 Pass-the-Hash、Pass-the-Ticket、Overpass-the-Hash、令牌冒充、NTLM roasting、LLMNR 投毒和 Kerberos 票据。</td><td><a href="/pages/a29ece45801a88c2cf1a32ca63941ff3d65b4ae8">/pages/a29ece45801a88c2cf1a32ca63941ff3d65b4ae8</a></td></tr></tbody></table>

\## 推荐工具

* [BloodHound](/zh/active-directory/enumeration/bloodhound-analysis.md) 以及 SharpHound，用于关系映射和攻击路径分析。
* [PowerView](/zh/active-directory/enumeration/powerview.md) 用于基于 PowerShell 的域枚举。
* [Impacket 和 rpcclient](/zh/active-directory/enumeration/impacket-and-rpcclient.md) 用于基于 Linux 的域枚举和滥用。
* [Rubeus](/zh/active-directory/kerberos/rubeus-installation.md) 用于在 Windows 上进行 Kerberos 票据操作。
* [ldapsearch](/zh/active-directory/enumeration/ldapsearch.md)、Pywerview 和 JXplorer，用于发现 LDAP 对象。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/active-directory.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.