{"id":1051,"date":"2024-03-16T00:26:11","date_gmt":"2024-03-15T16:26:11","guid":{"rendered":"http:\/\/www.ccwifi.cc\/blogs\/?p=1051"},"modified":"2024-03-16T00:26:11","modified_gmt":"2024-03-15T16:26:11","slug":"%e6%b8%97%e9%80%8f%e6%8a%80%e5%b7%a7%e5%88%a9%e7%94%a8netsh%e6%8a%93%e5%8f%96%e8%bf%9e%e6%8e%a5%e6%96%87%e4%bb%b6%e6%9c%8d%e5%8a%a1%e5%99%a8%e7%9a%84ntlmv2hash","status":"publish","type":"post","link":"https:\/\/www.ccwifi.cc\/blogs\/2024\/03\/16\/%e6%b8%97%e9%80%8f%e6%8a%80%e5%b7%a7%e5%88%a9%e7%94%a8netsh%e6%8a%93%e5%8f%96%e8%bf%9e%e6%8e%a5%e6%96%87%e4%bb%b6%e6%9c%8d%e5%8a%a1%e5%99%a8%e7%9a%84ntlmv2hash\/","title":{"rendered":"\u6e17\u900f\u6280\u5de7\u2014\u2014\u5229\u7528netsh\u6293\u53d6\u8fde\u63a5\u6587\u4ef6\u670d\u52a1\u5668\u7684NTLMv2 Hash"},"content":{"rendered":"
\n

\u5728\u7ebfwifi\u8dd1\u5305 \u91d1\u521a\u5305\u8dd1\u5305 cap\u8dd1\u5305 hccapx ewsa\u5728\u7ebf \u5c31\u6765 \u63e1\u624b\u5305\u8dd1\u5305<\/a><\/strong><\/p>\n

\u5404\u4f4d\u597d \u53c8\u89c1\u9762\u4e86 \u6211\u662f\u66f9\u64cd \u4eca\u5929\u7ed9\u5927\u5bb6\u5e26\u6765\u4e00\u7bc7\u65b0\u7684\u6559\u7a0b<\/p>\n

\u5e0c\u671b\u5404\u4f4d\u7ec6\u5fc3\u5b66\u4e60 \u4f4e\u8c03\u7528\u7f51<\/p>\n<\/div>\n

netsh trace start capture=yes persistent=yes traceFile=\"c:testsnmp1.etl\" overwrite=yes correlation=no protocol=tcp ipv4.address=192.168.62.130 keywords=ut:authentication\n<\/code><\/pre>\n
0x00 \u5f15\u8a00<\/p>\n
\u5728\u4e4b\u524d\u7684\u6587\u7ae0\u4e2d\uff0c\u6211\u4eec\u6bd4\u8f83\u4e86NTLM hash\u548cNet-NTLM hash\u7684\u533a\u522b\u3002\u672c\u6587\u5c06\u7ee7\u7eed\u63a2\u8ba8Net-NTLM hash\u5728\u5185\u7f51\u6e17\u900f\u4e2d\u7684\u5e94\u7528\uff0c\u89e3\u51b3\u4e00\u4e2a\u6709\u8da3\u7684\u95ee\u9898\uff1a\u5982\u679c\u6211\u4eec\u83b7\u5f97\u4e86\u5185\u7f51\u4e00\u4e2a\u6587\u4ef6\u670d\u52a1\u5668\u7684\u6743\u9650\uff0c\u5982\u4f55\u83b7\u53d6\u66f4\u591a\u7528\u6237\u7684\u53e3\u4ee4\uff1f<\/p>\n
0x01 \u7b80\u4ecb<\/p>\n
\u672c\u6587\u5c06\u4ecb\u7ecd\u4ee5\u4e0b\u5185\u5bb9\uff1a<\/p>\n
0x02 \u89e3\u51b3\u601d\u8def<\/p>\n
\u5728\u4e4b\u524d\u7684\u6587\u7ae0\u4e2d\u63d0\u5230\uff0c\u5f53\u5ba2\u6237\u7aef\u8fde\u63a5\u6587\u4ef6\u670d\u52a1\u5668\u65f6\uff0c\u9ed8\u8ba4\u4f1a\u5c06\u5f53\u524d\u767b\u5f55\u7528\u6237\u7684\u5bc6\u7801Hash\u53d1\u9001\u81f3\u670d\u52a1\u5668\u8fdb\u884c\u9a8c\u8bc1\u3002\u5982\u679c\u9a8c\u8bc1\u5931\u8d25\uff0c\u9700\u8981\u91cd\u65b0\u8f93\u5165\u767b\u5f55\u7528\u6237\u540d\u548c\u53e3\u4ee4\u3002\u5982\u679c\u6211\u4eec\u83b7\u5f97\u4e86\u5185\u7f51\u4e00\u4e2a\u6587\u4ef6\u670d\u52a1\u5668\u7684\u6743\u9650\uff0c\u90a3\u4e48\u5f53\u5185\u7f51\u4e2d\u7684\u5176\u4ed6\u4e3b\u673a\u5c1d\u8bd5\u8bbf\u95ee\u8be5\u670d\u52a1\u5668\u65f6\uff0c\u9996\u5148\u4f1a\u5c06\u672c\u673a\u7684\u5bc6\u7801Hash\u53d1\u9001\u81f3\u670d\u52a1\u5668\u8fdb\u884c\u9a8c\u8bc1\u3002\u901a\u8fc7\u5728\u670d\u52a1\u5668\u7aef\u6293\u53d6\u6570\u636e\u5305\uff0c\u6211\u4eec\u53ef\u4ee5\u83b7\u53d6\u5230NTLM Response\u3002\u6211\u4eec\u53ef\u4ee5\u89e3\u6790NTLM Response\u7684\u683c\u5f0f\uff0c\u63d0\u53d6\u7279\u5b9a\u4fe1\u606f\uff0c\u5e76\u4f7f\u7528Hashcat\u5c1d\u8bd5\u5b57\u5178\u7834\u89e3\u6216\u66b4\u529b\u7834\u89e3\uff0c\u4ece\u800c\u6709\u53ef\u80fd\u8fd8\u539f\u51fa\u7528\u6237\u672c\u673a\u7684\u660e\u6587\u53e3\u4ee4\u3002\u56e0\u6b64\uff0c\u6211\u4eec\u9700\u8981\u89e3\u51b3\u7b2c\u4e00\u4e2a\u95ee\u9898\uff1a\u5982\u4f55\u5728\u6587\u4ef6\u670d\u52a1\u5668\u4e0a\u6293\u53d6\u6570\u636e\u5305\uff1f<\/p>\n
0x03 Windows\u5e73\u53f0\u4e0b\u8fdb\u884c\u7f51\u7edc\u6293\u5305\u7684\u65b9\u6cd5<\/p>\n
\u6700\u5e38\u7528\u7684\u65b9\u6cd5\u662f\u5b89\u88c5Wireshark\uff0c\u4f46\u5982\u679c\u6211\u4eec\u80fd\u627e\u5230\u4e00\u79cd\u4e0d\u9700\u8981\u5b89\u88c5\u4efb\u4f55\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5e93\u7684\u65b9\u6cd5\uff0c\u76f4\u63a5\u4f7f\u7528\u7cfb\u7edf\u81ea\u5e26\u5de5\u5177\u6765\u6293\u5305\uff0c\u5c82\u4e0d\u662f\u66f4\u597d\uff1f\u4e8b\u5b9e\u4e0a\uff0c\u6211\u4eec\u662f\u53ef\u4ee5\u505a\u5230\u7684\u3002\u901a\u8fc7Windows\u7cfb\u7edf\u81ea\u5e26\u7684netsh\u547d\u4ee4\u4e2d\u7684trace\u529f\u80fd\uff0c\u6211\u4eec\u53ef\u4ee5\u5728\u547d\u4ee4\u884c\u4e0b\u8fdb\u884c\u6293\u5305\u3002\u8fd9\u4e2a\u529f\u80fd\u652f\u6301Win7\u3001Server2008R2\u53ca\u4ee5\u540e\u7684\u7cfb\u7edf\uff0c\u4f46\u4e0d\u652f\u6301Server2008\u3002\u5177\u4f53\u7684\u4f7f\u7528\u65b9\u6cd5\u5982\u4e0b\uff1a<\/p>\n
    \n
  1. \u5f00\u542f\u8bb0\u5f55\u529f\u80fd<\/li>\n<\/ol>\n
    Netsh trace stop\n<\/code><\/pre>\n
      \n
    1. \u5173\u95ed\u8bb0\u5f55\u529f\u80fd<\/li>\n<\/ol>\n
      easy_install scapy\neasy_install scapy_http\n<\/code><\/pre>\n
      \u5173\u95ed\u529f\u80fd\u540e\uff0c\u7cfb\u7edf\u4f1a\u5c06\u6355\u83b7\u5230\u7684\u6570\u636e\u5305\u4fdd\u5b58\u4e3a.etl\u7ed3\u5c3e\u7684\u6587\u4ef6\u3002\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528Windows Message Analyzer\u5de5\u5177\u5c06.etl\u6587\u4ef6\u8f6c\u6362\u6210.cap\u683c\u5f0f\uff0c\u4ee5\u4fbf\u4f7f\u7528Wireshark\u6253\u5f00\u5e76\u8bfb\u53d6\u6570\u636e\u5305\u3002\u4ece\u6570\u636e\u5305\u4e2d\uff0c\u6211\u4eec\u53ef\u4ee5\u627e\u5230SMB2\u534f\u8bae\uff0c\u5e76\u63d0\u53d6\u51faNTLM v2\u7684\u5173\u952e\u4fe1\u606f\u3002\u6211\u4eec\u53ef\u4ee5\u62fc\u63a5\u56fa\u5b9a\u683c\u5f0f\u7684\u6570\u636e\uff0c\u5982username::domain:challenge:HMAC-MD5:blob\uff0c\u5e76\u4f7f\u7528Hashcat\u8fdb\u884c\u7834\u89e3\u3002\u8fd9\u91cc\u4e0d\u518d\u6f14\u793a\u5177\u4f53\u7684\u7834\u89e3\u65b9\u6cd5\uff0c\u8be6\u7ec6\u5185\u5bb9\u53ef\u4ee5\u53c2\u8003\u4e4b\u524d\u7684\u6587\u7ae0\u300aWindows\u4e0b\u7684\u5bc6\u7801hash\u2014\u2014NTLM hash\u548cNet-NTLM hash\u4ecb\u7ecd\u300b\u3002<\/p>\n
      \u5982\u679c\u6211\u4eec\u624b\u52a8\u7ec4\u88c5\u591a\u4e2aNTLM v2\u54cd\u5e94\u5305\uff0c\u4f1a\u975e\u5e38\u8d39\u4e8b\u8d39\u529b\u3002\u56e0\u6b64\uff0c\u6211\u4eec\u9700\u8981\u7f16\u5199\u7a0b\u5e8f\u6765\u81ea\u52a8\u89e3\u6790\u6570\u636e\u5305\uff0c\u63d0\u53d6\u51faHashcat\u53ef\u7528\u7684NTLM v2\u5185\u5bb9\u3002\u8fd9\u5c31\u662f\u7b2c\u4e8c\u4e2a\u95ee\u9898\uff1a\u5982\u4f55\u901a\u8fc7\u7a0b\u5e8f\u5b9e\u73b0\u81ea\u52a8\u89e3\u6790\u6570\u636e\u5305\uff0c\u63d0\u53d6NTLM v2\u7684\u5185\u5bb9\uff1f<\/p>\n
      0x04 \u901a\u8fc7\u7a0b\u5e8f\u5b9e\u73b0\u81ea\u52a8\u89e3\u6790\u6570\u636e\u5305<\/p>\n
      \u5f00\u53d1\u8bed\u8a00\uff1aPython<\/p>\n
      \u6240\u9700\u6a21\u5757\uff1aScapy<\/p>\n
      Scapy\u662f\u4e00\u4e2aPython\u6a21\u5757\uff0c\u53ef\u4ee5\u7528\u4e8e\u89e3\u6790pcap\u6570\u636e\u5305\u3002\u5728\u4f7f\u7528\u4e4b\u524d\uff0c\u6211\u4eec\u9700\u8981\u4f7f\u7528Wireshark\u5c06.cap\u5305\u8f6c\u6362\u6210.pcap\u5305\u3002\u4e0b\u9762\u662f\u4f7f\u7528Scapy\u7684\u793a\u4f8b\u4ee3\u7801\uff1a<\/p>\n
      try:\n    import scapy.all as scapy\nexcept ImportError:\n    import scapy\ntry:\n    # This import works from the project directory\n    import scapy_http.http\nexcept ImportError:\n    # If you installed this package via pip, you just need to execute this\n    from scapy.layers import http\npackets = scapy.rdpcap('test.pcap')\nfor p in packets:\n    print('=' * 78)\n    p.show()\n<\/code><\/pre>\n
      \u4f7f\u7528\u4e0a\u8ff0\u4ee3\u7801\uff0c\u6211\u4eec\u53ef\u4ee5\u81ea\u52a8\u89e3\u6790\u51fa\u6bcf\u4e2a\u6570\u636e\u5305\u7684\u683c\u5f0f\uff0c\u5206\u4e3aEthernet\u3001IP\u3001TCP\u548cRaw\u3002\u63a5\u4e0b\u6765\uff0c\u6211\u4eec\u53ef\u4ee5\u6309\u7167\u4ee5\u4e0b\u6b65\u9aa4\u5f00\u53d1\u7a0b\u5e8f\uff1a<\/p>\n
        \n
      1. \n
        \u5bf9\u76ee\u7684\u7aef\u53e3\u8fdb\u884c\u5224\u65ad\uff0c\u9009\u51faSMB\u534f\u8bae\u7684\u6570\u636e\u5305\u3002<\/p>\n<\/li>\n
      2. \n
        \u7b5b\u9009\u51faNTLMv2 Response\u6570\u636e\u5305\u3002<\/p>\n<\/li>\n
      3. \n
        \u901a\u8fc7\u5f53\u524d\u6570\u636e\u5305\u83b7\u5f97username\u3001domain\u3001HMAC-MD5\u548cblob\u3002<\/p>\n<\/li>\n
      4. \n
        \u901a\u8fc7\u524d\u4e00\u4e2a\u6570\u636e\u5305\u83b7\u5f97Server challenge\u3002<\/p>\n<\/li>\n<\/ol>\n
        \u5177\u4f53\u7684\u5b9e\u73b0\u4ee3\u7801\u5982\u4e0a\u6240\u793a\u3002\u6267\u884c\u7a0b\u5e8f\u540e\uff0c\u6211\u4eec\u53ef\u4ee5\u5f97\u5230\u76f8\u5e94\u7684\u8f93\u51fa\u7ed3\u679c\u3002\u7136\u540e\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528Hashcat\u8fdb\u884c\u7834\u89e3\u3002<\/p>\n
        \u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u89e3\u6790pcap\u5305\u7684\u5f00\u6e90\u5de5\u5177\u8fd8\u6709\u5176\u4ed6\u9009\u62e9\uff0c\u4f46\u5728\u89e3\u6790NTLMv2\u7684challenge\u65f6\u53ef\u80fd\u4f1a\u51fa\u73b0bug\u3002<\/p>\n
        0x05 \u8865\u5145<\/p>\n
        \u5bf9\u4e8e\u6587\u4ef6\u670d\u52a1\u5668\uff0c\u5982\u679c\u5f00\u542f\u4e86NetBIOS over TCP\/IP\uff0c\u90a3\u4e48\u7981\u7528445\u7aef\u53e3\u540e\uff0c\u7cfb\u7edf\u4f1a\u5c1d\u8bd5\u4f7f\u7528139\u7aef\u53e3\u8fdb\u884c\u8fde\u63a5\u3002\u6211\u4eec\u53ef\u4ee5\u8fdb\u884c\u5982\u4e0b\u6d4b\u8bd5\uff1a<\/p>\n
        \u670d\u52a1\u5668\u7981\u7528445\u7aef\u53e3\uff0c\u5f00\u542f139\u7aef\u53e3\u3002\u5ba2\u6237\u7aef\u5c1d\u8bd5\u8fde\u63a5\uff0cSMB\u534f\u8bae\u4f7f\u7528139\u7aef\u53e3\uff0c\u6293\u5305\u7ed3\u679c\u5982\u4e0a\u6240\u793a\u3002\u5982\u679c\u7981\u7528\u4e86NetBIOS over TCP\/IP\uff0c\u90a3\u4e48\u7981\u7528445\u7aef\u53e3\u540e\uff0c\u5c06\u65e0\u6cd5\u4f7f\u7528\u6587\u4ef6\u5171\u4eab\u3002<\/p>\n
        0x06 \u5c0f\u7ed3<\/p>\n
        \u672c\u6587\u89e3\u51b3\u4e86\u5728\u83b7\u5f97\u5185\u7f51\u4e00\u4e2a\u6587\u4ef6\u670d\u52a1\u5668\u7684\u6743\u9650\u540e\uff0c\u5982\u4f55\u83b7\u53d6\u66f4\u591a\u7528\u6237\u53e3\u4ee4\u7684\u95ee\u9898\u3002\u6211\u4eec\u901a\u8fc7Windows\u547d\u4ee4\u884c\u6293\u5305\u83b7\u53d6SMB\u534f\u8bae\u5185\u5bb9\uff0c\u5e76\u7f16\u5199\u7a0b\u5e8f\u81ea\u52a8\u63d0\u53d6NTLMv2 Hash\uff0c\u6700\u540e\u4f7f\u7528Hashcat\u8fdb\u884c\u7834\u89e3\uff0c\u6709\u53ef\u80fd\u8fd8\u539f\u51fa\u7528\u6237\u672c\u673a\u7684\u660e\u6587\u53e3\u4ee4\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
        \u6e17\u900f\u6280\u5de7\u2014\u2014\u5229\u7528netsh\u6293\u53d6\u8fde\u63a5\u6587\u4ef6\u670d\u52a1\u5668\u7684NTLMv2 Hash0x00 \u524d\u8a00\u5728\u4e0a\u7bc7\u6587\u7ae0\u300aWindows\u4e0b\u7684\u5bc6\u7801hash\u2014\u2014NTLM hash\u548cNet-NTLM hash\u4ecb\u7ecd\u300b\u6bd4\u8f83\u4e86NTLM hash\u548cNet-NTLM hash\u7684\u533a\u522b\uff0c\u672c\u6587\u5c06\u7ee7\u7eed\u5bf9Net-<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"topic":[],"class_list":["post-1051","post","type-post","status-publish","format-standard","hentry","category-1"],"_links":{"self":[{"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/posts\/1051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/comments?post=1051"}],"version-history":[{"count":0,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/posts\/1051\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/media?parent=1051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/categories?post=1051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/tags?post=1051"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.ccwifi.cc\/blogs\/wp-json\/wp\/v2\/topic?post=1051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}