{"id":1007,"date":"2024-03-15T20:27:20","date_gmt":"2024-03-15T12:27:20","guid":{"rendered":"http:\/\/www.ccwifi.cc\/blogs\/?p=1007"},"modified":"2024-03-15T20:27:20","modified_gmt":"2024-03-15T12:27:20","slug":"windows%e5%86%85%e7%bd%91%e5%8d%8f%e8%ae%ae%e5%ad%a6%e4%b9%a0ntlm%e7%af%87%e4%b9%8bnet-ntlm%e5%88%a9%e7%94%a8","status":"publish","type":"post","link":"https:\/\/www.ccwifi.cc\/blogs\/2024\/03\/15\/windows%e5%86%85%e7%bd%91%e5%8d%8f%e8%ae%ae%e5%ad%a6%e4%b9%a0ntlm%e7%af%87%e4%b9%8bnet-ntlm%e5%88%a9%e7%94%a8\/","title":{"rendered":"Windows\u5185\u7f51\u534f\u8bae\u5b66\u4e60NTLM\u7bc7\u4e4bNet-NTLM\u5229\u7528"},"content":{"rendered":"<div>\n<p>\u5728\u7ebfwifi\u8dd1\u5305 \u91d1\u521a\u5305\u8dd1\u5305 cap\u8dd1\u5305 hccapx ewsa\u5728\u7ebf \u5c31\u6765 <strong><a href=\"https:\/\/ccwifi.cc\" target=\"_blank\" rel=\"noopener\">\u63e1\u624b\u5305\u8dd1\u5305<\/a><\/strong><\/p>\n<p>\u5404\u4f4d\u597d \u53c8\u89c1\u9762\u4e86 \u6211\u662f\u66f9\u64cd \u4eca\u5929\u7ed9\u5927\u5bb6\u5e26\u6765\u4e00\u7bc7\u65b0\u7684\u6559\u7a0b<\/p>\n<p>\u5e0c\u671b\u5404\u4f4d\u7ec6\u5fc3\u5b66\u4e60 \u4f4e\u8c03\u7528\u7f51<\/p>\n<\/div>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_0.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_1.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_3.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u539f\u6765\u7684NegoFlags\u503c\u4e3ax05x02x89xa2\uff0c\u73b0\u5728\u6539\u4e3ax05x02x81xa2\uff0c\u4ee5\u83b7\u53d6Net-NTLM v1\u3002\u7136\u540e\u4f7f\u7528ntlmv1-multi\u4e2d\u7684ntlmv1.py\u8fdb\u884c\u8f6c\u6362\u3002\u5f97\u5230\u7684Net-NTLM v1\u662fwin10::WIN10-1:F1586DA184365E9431C22EF206F5A2C918659E1B1FD7F64D:F1586DA184365E9431C22EF206F5A2C918659E1B1FD7F64D:1122334455667788\u3002<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_4.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_5.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_7.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u8f6c\u6362\u540e\u7684\u683c\u5f0f\u4e3aNTHASH:F1586DA184365E9431C22EF206F5A2C918659E1B1FD7F64D\uff0c\u7136\u540e\u4f7f\u7528crack.sh\u8fdb\u884c\u7834\u89e3\u3002\u4e0b\u9762\u7b80\u8981\u63a2\u7a76\u4e00\u4e0b\u539f\u7406\uff0c\u5982\u679c\u4e0d\u611f\u5174\u8da3\u53ef\u4ee5\u76f4\u63a5\u8df3\u8fc7\uff0c\u770b\u4e0b\u4e00\u5c0f\u8282\u3002\u5728NTLM\u57fa\u7840\u4ecb\u7ecd\u4e2d\u7b80\u5355\u4ecb\u7ecd\u4e86Net-NTLM v1\u7684\u52a0\u5bc6\u65b9\u5f0f\u3002\u5c0616\u5b57\u8282\u7684NTLM hash\u7a7a\u586b\u5145\u4e3a21\u4e2a\u5b57\u8282\uff0c\u7136\u540e\u5206\u6210\u4e09\u7ec4\uff0c\u6bcf\u7ec47\u5b57\u8282\uff0c\u4f5c\u4e3a3DES\u52a0\u5bc6\u7b97\u6cd5\u7684\u4e09\u7ec4\u5bc6\u94a5\uff0c\u52a0\u5bc6\u670d\u52a1\u5668\u53d1\u9001\u7684Challenge\u3002\u5c06\u8fd9\u4e09\u4e2a\u5bc6\u6587\u503c\u8fde\u63a5\u8d77\u6765\u5f97\u5230response\u3002\u4f46\u5728\u5b9e\u8df5\u4e2d\u53d1\u73b0\uff0c\u52a0\u5bc6\u65b9\u5f0f\u7684\u8868\u8ff0\u6709\u4e9b\u95ee\u9898\uff0c\u6216\u8005\u8bf4\u4e0d\u5b8c\u6574\u3002\u4e0a\u8ff0\u53ea\u662fNet-NTLM v1\u7684\u4e00\u79cd\u52a0\u5bc6\u65b9\u5f0f\uff0cNet-NTLM v1\u8fd8\u6709\u53e6\u4e00\u79cd\u52a0\u5bc6\u65b9\u5f0f\u3002\u4e0b\u9762\u6211\u4eec\u6765\u63a2\u8ba8\u8fd9\u4e24\u79cd\u52a0\u5bc6\u65b9\u5f0f\u4ee5\u53ca\u5229\u7528\u3002<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_9.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u4f7f\u7528ntlmv1-multi\u4e2d\u7684ntlmv1.py\u8fdb\u884c\u8f6c\u6362\uff0c\u7136\u540e\u590d\u5236NTHASH:E0F8C5B5E45247B4175698B99DBB5557CCD9241EA5A55CFB\u5230crack.sh\u8fdb\u884c\u7834\u89e3\uff0c\u586b\u5199\u90ae\u7bb1\uff0c\u7b49\u5f85\u5927\u7ea6\u4e00\u5206\u949f\u5c31\u80fd\u6536\u5230ntlm hash\u3002<\/p>\n<p>(2) \u52a0\u5bc6\u65b9\u5f0f2\u4e0e\u7b2c\u4e00\u79cd\u52a0\u5bc6\u65b9\u5f0f\u57fa\u672c\u76f8\u540c\u3002\u6700\u672c\u8d28\u7684\u533a\u522b\u5728\u4e8e\uff0c\u7b2c\u4e00\u79cd\u52a0\u5bc6\u65b9\u5f0f\u7684\u52a0\u5bc6\u5185\u5bb9\u662fServer Challenge\uff0c\u800c\u7b2c\u4e8c\u79cd\u52a0\u5bc6\u65b9\u5f0f\u662f\u62fc\u63a58\u5b57\u8282Server Challenge\u548c8\u5b57\u8282Client Challenge\u540e\uff0c\u6c42\u5176MD5\uff0c\u7136\u540e\u53d6MD5\u503c\u7684\u524d8\u5b57\u8282\u4f5c\u4e3a\u52a0\u5bc6\u5185\u5bb9\u3002<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_10.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_11.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u4f7f\u7528ntlmv1-multi\u4e2d\u7684ntlmv1-ssp.py\u8fdb\u884c\u8f6c\u6362\uff0c\u7136\u540e\u4f7f\u7528crack.sh\u8fdb\u884c\u7834\u89e3\u3002\u8fd9\u79cd\u65b9\u5f0f\u9700\u8981\u4ed8\u8d39\uff0c\u800c\u4e14\u4e0d\u4e00\u5b9a\u80fd\u591f\u6210\u529f\u7834\u89e3\u3002<\/p>\n<p>\u603b\u800c\u8a00\u4e4b\uff0c\u8fd9\u79cd\u52a0\u5bc6\u65b9\u5f0f\u4e0d\u5bb9\u6613\u7834\u89e3\uff0c\u5b9e\u9645\u4e0a\u6211\u4eec\u4e5f\u53ef\u4ee5\u8ba9\u5ba2\u6237\u7aef\u4e0d\u4f7f\u7528\u8fd9\u79cd\u52a0\u5bc6\u65b9\u5f0f\uff0c\u800c\u662f\u4f7f\u7528\u7b2c\u4e00\u79cd\u52a0\u5bc6\u65b9\u5f0f\u3002\u63a5\u4e0b\u6765\u6211\u4eec\u6765\u5206\u6790\u4e00\u4e0b\u3002<\/p>\n<p>\u5728Responder\u4e2d\u52a0\u4e0a&#8211;lm\u53c2\u6570\u53ef\u4ee5\u83b7\u53d6\u5230\u91c7\u7528\u7b2c\u4e00\u79cd\u52a0\u5bc6\u65b9\u5f0f\u7684Net-NTLM Hash\uff0c\u4f46\u53ea\u5bf9smb\u534f\u8bae\u6709\u6548\u3002\u5728\u6211\u7684\u6d4b\u8bd5\u4e2d\uff0c\u5373\u4f7f\u52a0\u4e0a&#8211;lm\u53c2\u6570\uff0c\u6536\u5230\u7684\u8bf7\u6c42\u662fHTTP\u534f\u8bae\u7684\u60c5\u51b5\u4e0b\uff0c\u5f97\u5230\u7684Net-NTLM v1\u4ecd\u7136\u91c7\u7528\u7b2c\u4e8c\u79cd\u52a0\u5bc6\u65b9\u5f0f\uff0c\u5f88\u96be\u7834\u89e3\u3002\u6240\u4ee5\u6211\u7814\u7a76\u4e86\u4e00\u4e0b\u5728\u4ec0\u4e48\u60c5\u51b5\u4e0b\u91c7\u7528\u7b2c\u4e00\u79cd\u52a0\u5bc6\u65b9\u5f0f\uff0c\u4ec0\u4e48\u60c5\u51b5\u4e0b\u91c7\u7528\u7b2c\u4e8c\u79cd\u52a0\u5bc6\u65b9\u5f0f\u3002<\/p>\n<p>\u5728\u8fd9\u7bc7\u6587\u7ae0\u4e2d\u63d0\u5230\uff0c\u5f53NTLM\u7684flag\u4f4dNTLMSSP<em>NEGOTIATE<\/em>EXTENDED_SESSIONSECURITY\u7f6e\u4e3a1\u65f6\uff0c\u4f1a\u91c7\u7528\u7b2c\u4e8c\u79cd\u52a0\u5bc6\u65b9\u5f0f\uff0c\u5426\u5219\u4f1a\u91c7\u7528\u7b2c\u4e00\u79cd\u52a0\u5bc6\u65b9\u5f0f\u3002\u6211\u4eec\u53ef\u4ee5\u770b\u4e00\u4e0bimpacket\u4e2d\u8ba1\u7b97Net-NTLM v1\u7684\u76f8\u5173\u4ee3\u7801\u3002<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_12.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u53ef\u4ee5\u6e05\u695a\u5730\u770b\u5230\uff0c\u5f53NTLMSSP<em>NEGOTIATE<\/em>EXTENDED_SESSIONSECURITY\u4f4d\u4e3a1\u65f6\uff0c\u52a0\u5bc6\u7684\u5185\u5bb9\u4e0d\u662fServer Challenge\uff0c\u800c\u662f\u7ecf\u8fc7MD5\u54c8\u5e0c\u8fd0\u7b97\u7684Server Challenge\u548cClient Challenge\u7684\u524d8\u4f4d\u3002\u4e5f\u5c31\u662f\u8bf4\u8fd9\u662f\u7b2c\u4e8c\u79cd\u52a0\u5bc6\u65b9\u5f0f\u3002<\/p>\n<p>\u90a3NTLMSSP<em>NEGOTIATE<\/em>EXTENDED<em>SESSIONSECURITY flag\u4f4d\u6765\u81ea\u54ea\u91cc\u5462\uff1f\u6211\u4eec\u77e5\u9053NTLM\u5206\u4e3atype1\u3001type2\u3001type3\u3002\u8ba1\u7b97response\u5c31\u5728type3\u4e2d\uff0cNTLMSSP<\/em>NEGOTIATE<em>EXTENDED<\/em>SESSIONSECURITY flag\u4f4d\u6765\u81eatype2\u3002\u800ctype2\u4e2d\u7684\u5185\u5bb9\u901a\u5e38\u662f\u6211\u4eec\u8fd4\u56de\u7ed9\u5ba2\u6237\u7aef\u7684\u3002<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_13.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u4e5f\u5c31\u662f\u8bf4\uff0c\u5ba2\u6237\u7aef\u9009\u62e9\u4f7f\u7528\u52a0\u5bc6\u65b9\u5f0f1\u8fd8\u662f\u52a0\u5bc6\u65b9\u5f0f2\uff0c\u6211\u4eec\u662f\u53ef\u4ee5\u63a7\u5236\u7684\u3002\u53ea\u9700\u8981\u5c06NTLMSSP<em>NEGOTIATE<\/em>EXTENDED_SESSIONSECURITY\u4f4d\u8bbe\u7f6e\u4e3a0\uff0c\u5ba2\u6237\u7aef\u5c31\u4f1a\u9009\u62e9\u52a0\u5bc6\u65b9\u5f0f1\u3002\u5e76\u4e14\u5728Server Challenge\u4e3a1122334455667788\u7684\u60c5\u51b5\u4e0b\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528crack.sh\u5feb\u901f\u514d\u8d39\u6709\u6548\u5730\u7834\u89e3\uff0c\u83b7\u53d6\u7528\u6237\u7684NTLM Hash\u3002<\/p>\n<p>\u90a3\u4e48\u5982\u4f55\u5c06NTLMSSP<em>NEGOTIATE<\/em>EXTENDED<em>SESSIONSECURITY\u4f4d\u8bbe\u7f6e\u4e3a0\u5462\uff1f\u901a\u5e38\u6211\u4eec\u4f7f\u7528\u73b0\u6210\u7684\u5de5\u5177Responder\u6765\u83b7\u53d6Net-NTLM Hash\u3002\u4e4b\u524d\u63d0\u5230\u8fc7\uff0c\u52a0\u4e0a&#8211;lm\u53c2\u6570\u5c31\u53ef\u4ee5\u5c06NTLMSSP<\/em>NEGOTIATE<em>EXTENDED<\/em>SESSIONSECURITY\u4f4d\u8bbe\u7f6e\u4e3a0\u3002<\/p>\n<p>\u8fd9\u65f6\u8fd8\u6709\u4e00\u4e2a\u5c0f\u95ee\u9898\u6ca1\u6709\u89e3\u51b3\uff0c\u5c31\u662fResponder\u52a0\u4e0a&#8211;lm\u53c2\u6570\u4e3a\u4ec0\u4e48\u53ea\u5bf9smb\u534f\u8bae\u6709\u6548\uff0c\u5176\u4ed6\u534f\u8bae\u65e0\u6548\u3002\u6211\u53bb\u9605\u8bfb\u4e86Responder\u7684\u4ee3\u7801\u3002<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_14.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_15.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u52a0\u4e0a&#8211;lm\u53c2\u6570\u540e\uff0c\u8c03\u7528\u7684\u6a21\u5757\u662fSMB1LM\u3002\u53d1\u73b0\u5b83\u4f7f\u7528\u7684\u662f\u65e7\u7248\u672c\u7684SMB\u5b9e\u73b0\u3002\u8fd9\u4e2a\u7248\u672c\u7684\u5b9e\u73b0\u5728SMB\u534f\u5546\u7248\u672c\u65f6\u5c31\u8fd4\u56de\u4e86Challenge\uff0c\u5e76\u5c06NTLMSSP<em>NEGOTIATE<\/em>EXTENDED_SESSIONSECURITY\u4f4d\u8bbe\u7f6e\u4e3a0\u3002<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_16.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u4f46\u5b8c\u5168\u53ef\u4ee5\u4e0d\u4f7f\u7528\u65e7\u7248\u672c\u7684SMB\u5b9e\u73b0\u3002\u5173\u952e\u5728\u4e8e\u5c06NTLMSSP<em>NEGOTIATE<\/em>EXTENDED_SESSIONSECURITY\u4f4d\u8bbe\u7f6e\u4e3a0\uff0c\u5e76\u4e0d\u4e00\u5b9a\u9700\u8981\u4f7f\u7528\u65e7\u7248\u672c\u7684SMB\u3002\u53ea\u9700\u8981\u4fee\u6539NTLM SSP\u4e2d\u7684flag\u4f4d\u5373\u53ef\u3002\u5728\u5404\u4e2a\u534f\u8bae\u7684NTLM SSP\u4e2d\u4fee\u6539flag\u4f4d\uff0c\u6211\u4eec\u627e\u5230Responder\u4e2dtype2\u7684NTLM SSP\u7684flag\u4f4d\u8d4b\u503c\u7684\u5730\u65b9\u5373\u53ef\u3002Responder\u7684NTLM SSP\u5b9e\u73b0\u5e76\u4e0d\u901a\u7528\u3002\u4f8b\u5982\uff0cSMB\u90e8\u5206\u7684\u5b9e\u73b0\u5728packets.py\u7684SMBSession1Data\u7c7b\u4e2d\u3002<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_17.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_18.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_20.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u9ed8\u8ba4\u503c\u4e3a0xe2898215\uff08\u4e0e\u56fe\u4e2d\u4e0d\u540c\uff1f\u5927\u7aef\u5c0f\u7aef\uff09\u3002NTLMSSP<em>NEGOTIATE<\/em>EXTENDED_SESSIONSECURITY\u5bf9\u5e94\u7684\u662f\u7b2c13\u4f4d\uff0c\u5c06\u5176\u6539\u4e3a0\uff0c\u53730xe2818215\u3002\u4fee\u6539\u540e\u5373\u53ef\u3002<\/p>\n<p>\u5bf9\u4e8eHTTP\u534f\u8bae\uff0c\u5728packets.py\u7684NTLM_Challenge\u7c7b\u4e2d\u8fdb\u884c\u4fee\u6539\u3002<\/p>\n<pre class=\"pure-highlightjs\"><section class=\"code-snippet__fix code-snippet__js\"><ul class=\"code-snippet__line-index code-snippet__js\"><li><\/li><\/ul><pre class=\"code-snippet__js\" data-lang=\"cpp\"><code><span class=\"code-snippet_outer\">hashcat -m <span class=\"code-snippet__number\">5600<\/span>  win10::TEST:<span class=\"code-snippet__number\">1122334455667788<\/span>:<span class=\"code-snippet__number\">622<\/span>DED0816CFF5A0652209F20A7CF17A:<span class=\"code-snippet__number\">0101000000000000<\/span>C0653150DE09D201532C07A7DEE654B8000000000200080053004D004200330001001E00570049004E002D00500052004800340039003200520051004100460056000400140053004D00420033002E006C006F00630061006C0003003400570049004E002D00500052004800340039003200520051004100460056002E0053004D00420033002E006C006F00630061006C000500140053004D00420033002E006C006F00630061006C0007000800C0653150DE09D2010600040002000000080030003000000000000000010000000020000067840C88904F15E659858A3CBA35EBEF61A38EC88C5E3D26B968F1C20C9ACAC10A001000000000000000000000000000000000000900220063006900660073002F003100370032002E00310036002E003100300030002E0031000000000000000000 \/tmp\/password.dic --force<\/span><\/code><\/pre>\n<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_22.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>0x02 Relay<\/p>\n<p>\u5728Net-NTLM Hash\u7684\u7834\u89e3\u91cc\u9762\uff0c\u5982\u679c\u662fv1\u7684\u8bdd\uff0c\u62ff\u5230Net-NTLM\u5c31\u76f8\u5f53\u4e8e\u62ffNTLM HASH.\u8fd9\u4e2a\u65f6\u5019\u5c31\u6ca1\u6709Relay\u7684\u5fc5\u8981\u6027\u4e86\uff0c\u4f46\u662f\u5728\u5b9e\u9645\u4e2d\u9047\u5230\u7684\u4f8b\u5b50\u5f80\u5f80\u4e0d\u4f1a\u662fv1\uff0c\u800c\u662fv2\u3002\u8fd9\u4e2a\u65f6\u5019\u5bc6\u7801\u5f3a\u5ea6\u9ad8\u4e00\u70b9\uff0c\u57fa\u672c\u5c31\u8dd1\u4e0d\u51fa\u6765\u4e86\uff0c\u8fd9\u79cd\u60c5\u51b5\u5e95\u4e0b\uff0c\u4e0d\u59a8\u8bd5\u4e00\u8bd5Relay\u3002<\/p>\n<p>1. Relay2SMB<\/p>\n<p>\u80fd\u76f4\u63a5relay\u5230smb\u670d\u52a1\u5668\uff0c\u662f\u6700\u76f4\u63a5\u6700\u6709\u6548\u7684\u65b9\u6cd5\u3002\u53ef\u4ee5\u76f4\u63a5\u63a7\u5236\u8be5\u670d\u52a1\u5668(\u5305\u62ec\u4f46\u4e0d\u9650\u4e8e\u5728\u8fdc\u7a0b\u670d\u52a1\u5668\u4e0a\u6267\u884c\u547d\u4ee4\uff0c\u4e0a\u4f20exe\u5230\u8fdc\u7a0b\u547d\u4ee4\u4e0a\u6267\u884c\uff0cdump \u670d\u52a1\u5668\u7684\u7528\u6237hash\u7b49\u7b49\u7b49\u7b49)\u3002<\/p>\n<p>\u4e3b\u8981\u6709\u4e24\u79cd\u573a\u666f<\/p>\n<p>\u5de5\u4f5c\u7ec4\u73af\u5883<\/p>\n<p>\u8fd9\u4e2a\u5b9e\u7528\u6027\u6bd4\u8f83\u5dee\u3002\u5728\u5de5\u4f5c\u7ec4\u73af\u5883\u91cc\u9762\uff0c\u5de5\u4f5c\u7ec4\u4e2d\u7684\u673a\u5668\u4e4b\u95f4\u76f8\u4e92\u6ca1\u6709\u4fe1\u4efb\u5173\u7cfb\uff0c\u6bcf\u53f0\u673a\u5668\u7684\u8d26\u53f7\u5bc6\u7801Hash\u53ea\u662f\u4fdd\u5b58\u5728\u81ea\u5df1\u7684SAM\u6587\u4ef6\u4e2d\uff0c\u8fd9\u4e2a\u65f6\u5019Relay\u5230\u522b\u7684\u673a\u5668\uff0c\u9664\u975e\u4e24\u53f0\u673a\u5668\u7684\u8d26\u53f7\u5bc6\u7801\u4e00\u6837(\u5982\u679c\u8d26\u53f7\u5bc6\u7801\u4e00\u6837\uff0c\u6211\u4e3a\u5565\u4e0d\u76f4\u63a5pth\u5462)\uff0c\u4e0d\u7136\u6ca1\u6709\u522b\u7684\u610f\u4e49\u4e86\uff0c\u8fd9\u4e2a\u65f6\u5019\u7684\u653b\u51fb\u624b\u6bb5\u5c31\u662f\u5c06\u673a\u5668reflect\u56de\u673a\u5b50\u672c\u8eab\u3002\u56e0\u6b64\u5fae\u8f6f\u5728ms08-068\u4e2d\u5bf9smb reflect\u5230smb \u505a\u4e86\u9650\u5236\u3002\u8fd9\u4e2a\u8865\u4e01\u5728CVE-2019-1384(Ghost Potato)\u88ab\u7ed5\u8fc7\u3002\u5c06\u5728\u4e0b\u7bc7\u6587\u7ae0\u91cc\u9762\u8be6\u7ec6\u8bb2\u3002<\/p>\n<p>\u57df\u73af\u5883<\/p>\n<p>\u57df\u73af\u5883\u5e95\u4e0b\u57df\u7528\u6237\u7684\u8d26\u53f7\u5bc6\u7801Hash\u4fdd\u5b58\u5728\u57df\u63a7\u7684 ntds.dit\u91cc\u9762\u3002\u5982\u4e0b\u6ca1\u6709\u9650\u5236\u57df\u7528\u6237\u767b\u5f55\u5230\u67d0\u53f0\u673a\u5b50\uff0c\u90a3\u5c31\u53ef\u4ee5\u5c06\u8be5\u57df\u7528\u6237Relay\u5230\u522b\u4eba\u7684\u673a\u5b50\uff0c\u6216\u8005\u662f\u62ff\u5230\u57df\u63a7\u7684\u8bf7\u6c42\uff0c\u5c06\u57df\u63a7Relay\u5230\u666e\u901a\u7684\u673a\u5b50\uff0c\u6bd4\u5982\u57df\u7ba1\u8fd0\u7ef4\u6240\u5728\u7684\u673a\u5b50\u3002(\u4e3a\u5565\u4e0dRelay\u5230\u5176\u4ed6\u57df\u63a7\uff0c\u56e0\u4e3a\u57df\u5185\u5c31\u57df\u63a7\u9ed8\u8ba4\u5f00\u542fsmb\u7b7e\u540d)<\/p>\n<p>\u4e0b\u9762\u6f14\u793a\u4f7f\u7528\u51e0\u6b3e\u5de5\u5177\u5728\u57df\u73af\u5883\u5e95\u4e0b\uff0c\u4ece\u57df\u63a7relay\u5230\u666e\u901a\u673a\u5668\u6267\u884c\u547d\u4ee4<\/p>\n<p>impacket \u7684\u5e95\u4e0b\u7684smbrelayx.py<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_24.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>impacket \u7684\u5e95\u4e0b\u7684ntlmrelayx.py<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_25.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>Responder\u5e95\u4e0b\u7684MultiRelay.py<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_26.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_27.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>2. Relay2EWS<\/p>\n<p>Exchange\u7684\u8ba4\u8bc1\u4e5f\u662f\u652f\u6301NTLM SSP\u7684\u3002\u6211\u4eec\u53ef\u4ee5relay\u7684Exchange\uff0c\u4ece\u800c\u6536\u53d1\u90ae\u4ef6\uff0c\u4ee3\u7406\u7b49\u7b49\u3002\u5728\u4f7f\u7528outlook\u7684\u60c5\u51b5\u4e0b\u8fd8\u53ef\u4ee5\u901a\u8fc7homepage\u6216\u8005\u4e0b\u53d1\u89c4\u5219\u8fbe\u5230\u547d\u4ee4\u6267\u884c\u7684\u6548\u679c\u3002\u800c\u4e14\u8fd9\u79cdRelay\u8fd8\u6709\u4e00\u79cd\u597d\u5904\uff0c\u5c06Exchange\u5f00\u653e\u5728\u5916\u7f51\u7684\u516c\u53f8\u5e76\u4e0d\u5728\u5c11\u6570\uff0c\u6211\u4eec\u53ef\u4ee5\u5728\u5916\u7f51\u53d1\u8d77relay\uff0c\u800c\u4e0d\u9700\u8981\u5728\u5185\u7f51\uff0c\u8fd9\u662f\u6700\u523a\u6fc0\u7684\u3002<\/p>\n<p>\u4e0b\u9762\u6f14\u793a\u901a\u8fc7NtlmRelayToEWS(\u4e8b\u5b9e\u4e0a\uff0c\u5de5\u5177\u633a\u591a\u7684\u3002\u5176\u4ed6\u7684\u5927\u5bb6\u53ef\u4ee5\u4e0agithub\u81ea\u5df1\u627e)\u6765\u5b9e\u73b0Relay2ews<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_28.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_29.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u914d\u5408homepage \u80fd\u591f\u5b9e\u73b0\u547d\u4ee4\u6267\u884c\u7684\u6548\u679c<\/p>\n<p>homepage\u7684\u7b80\u6613demo\u4ee3\u7801\u5982\u4e0b<\/p>\n<\/p>\n<pre class=\"pure-highlightjs\"><section class=\"code-snippet__fix code-snippet__js\"><ul class=\"code-snippet__line-index code-snippet__js\"><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><li><\/li><\/ul><pre class=\"code-snippet__js\" data-lang=\"xml\"><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;<span class=\"code-snippet__name\">html<\/span>&gt;<\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;<span class=\"code-snippet__name\">head<\/span>&gt;<\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;<span class=\"code-snippet__name\">meta<\/span> <span class=\"code-snippet__attr\">http-equiv<\/span>=<span class=\"code-snippet__string\">\"Content-Language\"<\/span> <span class=\"code-snippet__attr\">content<\/span>=<span class=\"code-snippet__string\">\"en-us\"<\/span>&gt;<\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;<span class=\"code-snippet__name\">meta<\/span> <span class=\"code-snippet__attr\">http-equiv<\/span>=<span class=\"code-snippet__string\">\"Content-Type\"<\/span> <span class=\"code-snippet__attr\">content<\/span>=<span class=\"code-snippet__string\">\"text\/html; charset=windows-1252\"<\/span>&gt;<\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;<span class=\"code-snippet__name\">title<\/span>&gt;<\/span>Outlook<span class=\"code-snippet__tag\">&lt;\/<span class=\"code-snippet__name\">title<\/span>&gt;<\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;<span class=\"code-snippet__name\">script<\/span> <span class=\"code-snippet__attr\">id<\/span>=<span class=\"code-snippet__string\">clientEventHandlersVBS<\/span> <span class=\"code-snippet__attr\">language<\/span>=<span class=\"code-snippet__string\">vbscript<\/span>&gt;<\/span><span class=\"xml\"><\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__comment\"><\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;\/<span class=\"code-snippet__name\">script<\/span>&gt;<\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;\/<span class=\"code-snippet__name\">head<\/span>&gt;<\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><br><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;<span class=\"code-snippet__name\">body<\/span>&gt;<\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;<span class=\"code-snippet__name\">object<\/span> <span class=\"code-snippet__attr\">classid<\/span>=<span class=\"code-snippet__string\">\"clsid:0006F063-0000-0000-C000-000000000046\"<\/span> <span class=\"code-snippet__attr\">id<\/span>=<span class=\"code-snippet__string\">\"ViewCtl1\"<\/span> <span class=\"code-snippet__attr\">data<\/span>=<span class=\"code-snippet__string\">\"\"<\/span> <span class=\"code-snippet__attr\">width<\/span>=<span class=\"code-snippet__string\">\"100%\"<\/span> <span class=\"code-snippet__attr\">height<\/span>=<span class=\"code-snippet__string\">\"100%\"<\/span>&gt;<\/span><span class=\"code-snippet__tag\">&lt;\/<span class=\"code-snippet__name\">object<\/span>&gt;<\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;\/<span class=\"code-snippet__name\">body<\/span>&gt;<\/span><\/span><\/code><code><span class=\"code-snippet_outer\"><span class=\"code-snippet__tag\">&lt;\/<span class=\"code-snippet__name\">html<\/span>&gt;<\/span><\/span><\/code><\/pre>\n<\/p>\n<p>\u653e\u7f6e\u4e8eweb\u670d\u52a1\u5668\u3002\u5728NtlmRelayToEWS\u91cc\u9762\u901a\u8fc7-u \u53c2\u6570\u6307\u5b9a\u3002<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_30.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_31.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>3. Relay2LDAP<\/p>\n<p>\u4e0d\u7ba1\u662f\u6740\u4f24\u529b\u5de8\u5927\u76848581\u8fd8\u662f1040\u3002Relay\u5230ldap\u90fd\u5728\u91cc\u9762\u53d1\u6325\u7740\u5de8\u5927\u7684\u4f5c\u7528\u3002<\/p>\n<p>relay \u5230ldap\u7684\u8bdd\uff0c\u80fd\u5e72\u561b\u5462<\/p>\n<p>\u8fd9\u91cc\u7740\u91cd\u4ecb\u7ecd\u4e09\u79cd\u901a\u7528\u6027\u6bd4\u8f83\u5f3a\u7684\u5229\u7528\u601d\u8def\u3002\u8fd9\u4e09\u79cd\u5728impacket\u91cc\u9762\u7684ntlmrelayx\u90fd\u6709\u5b9e\u73b0\u3002(\u8fd9\u4e09\u79cd\u901a\u7528\u6027\u6bd4\u8f83\u5f3a\u800c\u5df2\uff0c\u5b9e\u9645\u4e2d\u8fd9\u4e2a\u7684\u5229\u7528\u6bd4\u8f83\u7075\u6d3b\uff0c\u9700\u8981\u901a\u8fc7 nTSecurityDescriptor\u5206\u6790\u7528\u6237\u5728\u57df\u5185\u5bf9\u54ea\u4e9bacl\u6709\u6743\u9650\uff0c\u4ec0\u4e48\u6743\u9650\u3002\u5173\u4e8eacl\u600e\u4e48\u6df1\u5165\u5229\u7528,\u8fd9\u91cc\u4e0d\u518d\u5c55\u5f00\uff0c\u540e\u9762\u5728ldap\u7bc7\u4f1a\u8be6\u7ec6\u8bf4\u660e)<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_33.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u9ad8\u6743\u9650\u7528\u6237<\/p>\n<p>\u5982\u679cNTLM\u53d1\u8d77\u7528\u6237\u5728\u4ee5\u4e0b\u7528\u6237\u7ec4<\/p>\n<p>\u90a3\u4e48\u5c31\u53ef\u4ee5\u5c06\u4efb\u610f\u7528\u6237\u62c9\u8fdb\u8be5\u7ec4\uff0c\u4ece\u800c\u4f7f\u8be5\u7528\u6237\u79f0\u4e3a\u9ad8\u6743\u9650\u7528\u6237\uff0c\u6bd4\u5982\u57df\u7ba1<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_35.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>write-acl \u6743\u9650<\/p>\n<p>\u5982\u679c\u53d1\u8d77\u8005\u5bf9DS-Replication-GetChanges(GUID: 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2)\u548cDS-Replication-Get-Changes-All(1131f6ad-9c07-11d1-f79f-00c04fc2dcd2)\u6709write-acl \u6743\u9650\uff0c\u90a3\u4e48\u5c31\u53ef\u4ee5\u5728\u8be5acl\u91cc\u9762\u6dfb\u52a0\u4efb\u610f\u7528\u6237\uff0c\u4ece\u800c\u4f7f\u5f97\u8be5\u7528\u6237\u53ef\u4ee5\u5177\u5907dcsync\u7684\u6743\u9650<\/p>\n<p>\u8fd9\u4e2a\u6848\u4f8b\u7684\u5178\u578b\u4f8b\u5b50\u5c31\u662fExchange Windows Permissions\u7ec4\uff0c\u6211\u4eec\u5c06\u5728\u4e0b\u4e00\u7bc7\u4ecb\u7ecd8581\u7684 \u65f6\u5019\u8be6\u7ec6\u8bf4\u4e0b\u8fd9\u4e2a\u7528\u6237\u7ec4\u7684\u6743\u9650\u3002<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_37.png\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>\u666e\u901a\u7528\u6237\u6743\u9650<\/p>\n<p>\u5728server2012r2\u4e4b\u540e\uff0c\u5982\u679c\u6ca1\u6709\u4ee5\u4e0a\u4e24\u4e2a\u6743\u9650\u3002\u53ef\u4ee5\u901a\u8fc7\u8bbe\u7f6e\u57fa\u4e8e\u8d44\u6e90\u7684\u7ea6\u675f\u59d4\u6d3e\u3002<\/p>\n<p>\u5728NTLM\u53d1\u8d77\u8005\u5c5e\u6027msDS-AllowedToActOnBehalfOfOtherIdentity\u91cc\u9762\u6dfb\u52a0\u4e00\u6761ace,\u53ef\u4ee5\u8ba9\u4efb\u4f55\u673a\u5668\u7528\u6237\u548c\u670d\u52a1\u7528\u6237\u53ef\u4ee5\u63a7\u5236\u8be5\u7528\u6237(NTLM\u53d1\u8d77\u8005)\u3002<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.ccwifi.cc\/blogs\/wp-content\/uploads\/2024\/03\/1710505625905_38.jpg\" alt=\"hashcat\u6ca1\u6709\u6743\u9650\"><\/p>\n<p>0x03 \u5f15\u7528<\/p>\n<p>LM-Hash\u3001NTLM-Hash\u3001Net-NTLMv1\u3001Net-NTLMv2\u8be6\u89e3<\/p>\n<p>The NTLM Authentication Protocol and Security Support Provider<\/p>\n<p><!-- \u6587\u7ae0\u6765\u6e90:http:\/\/mp.weixin.qq.com\/s?src=11&amp;timestamp=1710505588&amp;ver=5140&amp;signature=a7ipb679-h32E2sq9ZX0RTHtKTw9KuewHjsLbGpbG06DcH9ggwGtyFym908UpS1oa3HTQZkL5YAjaNoBEKtyEtj98tEkAHgf21xEFjqTleZpl0rSgtlP09uOtvSZxyE7&amp;new=1 --><\/section>\n<\/section>\n<p>Responder\u7684NTLM SSP\u5b9e\u73b0\u5e76\u4e0d\u901a\u7528\uff0c\u8fd9\u8ba9\u4eba\u6709\u4e9b\u56f0\u6270\u3002\u5176\u4ed6\u534f\u8bae\u7684\u5b9e\u73b0\u9700\u8981\u81ea\u884c\u67e5\u627e\u4ee3\u7801\u3002\u8ddf\u8fdb\u4ee3\u7801\u5e76\u4e0d\u56f0\u96be\u3002<\/p>\n<ol start=\"2\">\n<li>Net-NTLM v2\u7684\u7834\u89e3\u76ee\u524d\u6ca1\u6709\u6bd4\u8f83\u597d\u7528\u7684\u65b9\u6cd5\uff0c\u901a\u5e38\u4f7f\u7528hashcat\u8fdb\u884c\u79bb\u7ebf\u7206\u7834\u660e\u6587\u5bc6\u7801\uff0c\u662f\u5426\u80fd\u591f\u6210\u529f\u53d6\u51b3\u4e8e\u5b57\u5178\u4e2d\u662f\u5426\u5305\u542b\u5bc6\u7801\u3002<\/li>\n<\/ol>\n<p>\u4f7f\u7528hashcat\u8fdb\u884c\u5b57\u5178\u7834\u89e3\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Windows\u5185\u7f51\u534f\u8bae\u5b66\u4e60NTLM\u7bc7\u4e4bNet-NTLM\u5229\u7528\u539f\u6765\u662fNegoFlags\u7684\u503c\u662fx05x02x89xa2\uff0c\u6539\u6210x05x02x81xa2\u7136\u540e\u83b7\u53d6\u5230Net-NTLM v1\u3002\u518d\u4f7f\u7528ntlmv1-multi\u91cc\u9762\u7684ntlmv1.py\u8f6c\u6362<\/p>\n","protected":false},"author":1,"featured_media":1008,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"topic":[],"class_list":["post-1007","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-1"],"_links":{"self":[{"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/posts\/1007","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/comments?post=1007"}],"version-history":[{"count":0,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/posts\/1007\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/media\/1008"}],"wp:attachment":[{"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/media?parent=1007"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/categories?post=1007"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/tags?post=1007"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/topic?post=1007"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}