> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/credentials.md).

# 凭据与令牌

以凭据为重点的 Active Directory 笔记，涵盖 Windows 身份验证、LSASS 内存、SAM 提取、缓存域凭据、令牌分析以及后渗透工作流。

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>Windows 身份验证</h4></td><td>Active Directory 安全笔记，涵盖 Windows 中的身份验证与授权，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/cb681fc67a93e4f093e30fb795f4165b87680f3a">/pages/cb681fc67a93e4f093e30fb795f4165b87680f3a</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>交互式身份验证</h4></td><td>Active Directory 安全笔记，涵盖交互式身份验证，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/c08d09a24249dc57e479bed0ca76b650e49e5eb1">/pages/c08d09a24249dc57e479bed0ca76b650e49e5eb1</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>非交互式身份验证</h4></td><td>Active Directory 安全笔记，涵盖非交互式身份验证，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/520c24024dadee128b6ba75020f2ff91944174c3">/pages/520c24024dadee128b6ba75020f2ff91944174c3</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>登录会话</h4></td><td>Active Directory 安全笔记，涵盖观察登录会话，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/f393be2c97305e8ce1f6b5473768a0465170c0a9">/pages/f393be2c97305e8ce1f6b5473768a0465170c0a9</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>访问令牌</h4></td><td>Active Directory 安全笔记，涵盖访问令牌，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/93d24b8e3d030657cbfc327de7bcb67f4b4e99df">/pages/93d24b8e3d030657cbfc327de7bcb67f4b4e99df</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>主令牌和模拟令牌</h4></td><td>Active Directory 安全笔记，涵盖主令牌和模拟令牌，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/56f815fa1acdd2418a386cc7c4a3969e2f2ed058">/pages/56f815fa1acdd2418a386cc7c4a3969e2f2ed058</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>Process Explorer 令牌</h4></td><td>Active Directory 安全笔记，涵盖使用 Process Explorer 观察令牌，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/9da3e0510dd267ee2bb54f95ef188599a0f93248">/pages/9da3e0510dd267ee2bb54f95ef188599a0f93248</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>LSASS 凭据</h4></td><td>Active Directory 安全笔记，涵盖对内存中凭据的访问：LSASS，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/8cc1277f333e9783771c9a61ee56b810fc422c64">/pages/8cc1277f333e9783771c9a61ee56b810fc422c64</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>LogonSessions</h4></td><td>Active Directory 安全笔记，涵盖使用 LogonSessions 观察会话，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/71163299790cb03b44444e2d38de668b102963b0">/pages/71163299790cb03b44444e2d38de668b102963b0</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>本地权限示例</h4></td><td>Active Directory 安全笔记，涵盖本地权限示例，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/13e711beaff6b57f0c71448ebf90e6b90efb03cd">/pages/13e711beaff6b57f0c71448ebf90e6b90efb03cd</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>LSASS 和 SAM 转储</h4></td><td>Active Directory 安全笔记，涵盖在 Windows 上提取 LSASS 和 SAM，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/207865b6b95997cfbb7fd0599d1923ed0a202c6e">/pages/207865b6b95997cfbb7fd0599d1923ed0a202c6e</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>SAM 数据库转储</h4></td><td>Active Directory 安全笔记，涵盖提取 SAM 数据库，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/7b8399be8db5a2598f89c604d8ba8271fe0e0b03">/pages/7b8399be8db5a2598f89c604d8ba8271fe0e0b03</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>来自注册表文件的 SAM</h4></td><td>Active Directory 安全笔记，涵盖使用注册表文件提取 SAM，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/9f3cf3150fc52ecbc50170fe401c2b39e4178991">/pages/9f3cf3150fc52ecbc50170fe401c2b39e4178991</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>通过任务管理器提取 LSASS</h4></td><td>Active Directory 安全笔记，涵盖通过任务管理器提取 LSASS，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/c64d8ac2551e97a6d444d1d85fe994dec63c4c66">/pages/c64d8ac2551e97a6d444d1d85fe994dec63c4c66</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>从 Linux 提取</h4></td><td>Active Directory 安全笔记，涵盖从 Linux 提取，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/dc098a56e4cbfb832fbaa870cbdad8b228703fcb">/pages/dc098a56e4cbfb832fbaa870cbdad8b228703fcb</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>缓存的域凭据</h4></td><td>Active Directory 安全笔记，涵盖缓存的域凭据：MSCache，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/a8644df76ae85202a57104f8f510c98e948c4051">/pages/a8644df76ae85202a57104f8f510c98e948c4051</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>使用 Mimikatz 的 MSCache</h4></td><td>Active Directory 安全笔记，涵盖使用 Mimikatz 提取凭据缓存，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/d9d06746dfac47bc86fda602a8715061820845c5">/pages/d9d06746dfac47bc86fda602a8715061820845c5</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>来自注册表配置单元的 MSCache</h4></td><td>Active Directory 安全笔记，涵盖从注册表配置单元中提取 MSCache，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/cc867988aa5e38a44752b694030c366542fe2697">/pages/cc867988aa5e38a44752b694030c366542fe2697</a></td></tr><tr><td><h3><i class="fa-key" style="color:$primary;">:key:</i></h3></td><td><h4>SAM、LSASS、LSA、MSCache</h4></td><td>Active Directory 安全笔记，涵盖 SAM、LSASS、LSA 和 MSCache 之间的区别，包括枚举、Kerberos、凭据、ACL 滥用、横向移动、利用工作流和验证步骤。</td><td><a href="/pages/5a65c4b69ff74bae4b67e31e25c8af00ab1c4137">/pages/5a65c4b69ff74bae4b67e31e25c8af00ab1c4137</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/active-directory/credentials.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.