> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory.md). # Active Directory 用于域枚举、Kerberos 攻击、ACL 滥用、凭据提取、令牌滥用和横向移动的 Active Directory 渗透测试方法。 用于进攻性安全实验室和内网渗透测试的实用 Active Directory 笔记：发现、域映射、Kerberos、凭据、ACL、BloodHound 路径和横向移动。 ## Active Directory 工作流 1. 构建域上下文：域名、域控制器、用户、组、计算机、OU、GPO 和信任关系。 2. 枚举可访问的共享、会话、本地管理员权限、LDAP 对象和 BloodHound 关系。 3. 检查 Kerberos 攻击路径，例如用户枚举、AS-REP Roasting、Kerberoasting 和密码喷洒。 4. 审查 ACL、危险权限、所有权、DACL/SACL/ACE 条目以及 DCSync 权限。 5. 通过 LSASS、SAM、MSCache、令牌、哈希和票据提取或验证凭据。 6. 将发现转化为使用 WinRM、SMB、Kerberos 票据、令牌滥用或哈希复用的横向移动路径。 ## Active Directory 技术

:book-open:

基础知识

Active Directory 基础知识的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。Active Directory 基础

:flask:

实验室设置

Active Directory 实验室的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。Active Directory 实验室

:magnifying-glass:

枚举

用于用户、组、计算机、GPO、共享、ACL、域控制器、BloodHound、PowerView、LDAP 和 Impacket 的 Active Directory 枚举工作流。Active Directory 枚举

:shield-halved:

ACL 和权限

Active Directory ACL 滥用笔记，涵盖安全描述符、DACL、SACL、ACE、危险权限、BloodHound 路径、DCSync 和密码喷洒。ACL 和权限滥用

:ticket:

Kerberos

Active Directory 的 Kerberos 攻击笔记，涵盖 AS-REP Roasting、Kerberoasting、密码喷洒、Rubeus、Impacket、SPN、票据和 Wireshark 分析。Kerberos 攻击

:key:

凭据和令牌

Windows 和 Active Directory 凭据笔记，涵盖 LSASS、SAM、MSCache、访问令牌、模拟令牌、LogonSessions、注册表 Hive 和 Mimikatz。凭据与令牌

:right-left:

横向移动

Active Directory 横向移动笔记，涵盖 Pass-the-Hash、Pass-the-Ticket、Overpass-the-Hash、令牌模拟、NTLM Roasting、LLMNR 投毒和 Kerberos 票据。横向移动
\## 推荐工具 * [BloodHound](/zh/active-directory/enumeration/bloodhound-analysis.md) 以及用于关系映射和攻击路径分析的 SharpHound。 * [PowerView](/zh/active-directory/enumeration/powerview.md) 用于基于 PowerShell 的域枚举。 * [Impacket 和 rpcclient](/zh/active-directory/enumeration/impacket-and-rpcclient.md) 用于基于 Linux 的域枚举和滥用。 * [Rubeus](/zh/active-directory/kerberos/rubeus-installation.md) 用于从 Windows 进行 Kerberos 票据操作。 * [ldapsearch](/zh/active-directory/enumeration/ldapsearch.md)、Pywerview 和 JXplorer 用于 LDAP 对象发现。 --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/active-directory.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.