{"id":1014,"date":"2023-09-17T20:48:08","date_gmt":"2023-09-17T12:48:08","guid":{"rendered":"http:\/\/weizn.net\/?p=1014"},"modified":"2026-05-08T16:52:57","modified_gmt":"2026-05-08T08:52:57","slug":"kerberoast%e6%94%bb%e5%87%bb","status":"publish","type":"post","link":"http:\/\/weizn.net\/?p=1014","title":{"rendered":"Kerberoast"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_17 counter-hierarchy\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\">\u76ee\u5f55<\/p>\n<span class=\"ez-toc-title-toggle\"><a class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" style=\"display: none;\"><i class=\"ez-toc-glyphicon ez-toc-icon-toggle\"><\/i><\/a><\/span><\/div>\n<nav><ul class=\"ez-toc-list ez-toc-list-level-1\"><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-1\" href=\"http:\/\/weizn.net\/?p=1014\/#%E4%B8%80%E3%80%81%E8%83%8C%E6%99%AF%E7%9F%A5%E8%AF%86\" title=\"\u4e00\u3001\u80cc\u666f\u77e5\u8bc6\">\u4e00\u3001\u80cc\u666f\u77e5\u8bc6<\/a><ul class=\"ez-toc-list-level-3\"><li class=\"ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-2\" href=\"http:\/\/weizn.net\/?p=1014\/#1%E3%80%81%E7%94%A8%E6%88%B7%E6%AD%A3%E5%B8%B8%E8%AE%BF%E9%97%AE%E6%9F%90%E6%9C%8D%E5%8A%A1%E6%B5%81%E7%A8%8B\" title=\"1\u3001\u7528\u6237\u6b63\u5e38\u8bbf\u95ee\u67d0\u670d\u52a1\u6d41\u7a0b\">1\u3001\u7528\u6237\u6b63\u5e38\u8bbf\u95ee\u67d0\u670d\u52a1\u6d41\u7a0b<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-3\" href=\"http:\/\/weizn.net\/?p=1014\/#2%E3%80%81Kerberoast%E6%94%BB%E5%87%BB%E8%BF%87%E7%A8%8B\" title=\"2\u3001Kerberoast\u653b\u51fb\u8fc7\u7a0b\">2\u3001Kerberoast\u653b\u51fb\u8fc7\u7a0b<\/a><\/li><\/ul><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-4\" href=\"http:\/\/weizn.net\/?p=1014\/#%E4%BA%8C%E3%80%81%E5%88%A9%E7%94%A8%E6%9D%A1%E4%BB%B6\" title=\"\u4e8c\u3001\u5229\u7528\u6761\u4ef6\">\u4e8c\u3001\u5229\u7528\u6761\u4ef6<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-5\" href=\"http:\/\/weizn.net\/?p=1014\/#%E4%B8%89%E3%80%81%E5%88%A9%E7%94%A8%E8%BF%87%E7%A8%8B\" title=\"\u4e09\u3001\u5229\u7528\u8fc7\u7a0b\">\u4e09\u3001\u5229\u7528\u8fc7\u7a0b<\/a><ul class=\"ez-toc-list-level-3\"><li class=\"ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-6\" href=\"http:\/\/weizn.net\/?p=1014\/#1%E3%80%81%E6%8E%A2%E6%B5%8B%E5%8F%AF%E5%88%A9%E7%94%A8%E7%9A%84SPN%E8%B4%A6%E5%8F%B7\" title=\"1\u3001\u63a2\u6d4b\u53ef\u5229\u7528\u7684SPN\u8d26\u53f7\">1\u3001\u63a2\u6d4b\u53ef\u5229\u7528\u7684SPN\u8d26\u53f7<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-7\" href=\"http:\/\/weizn.net\/?p=1014\/#2%E3%80%81%E8%AF%B7%E6%B1%82%E8%AE%BF%E9%97%AE%E6%9C%8D%E5%8A%A1%E7%9A%84ST%E7%A5%A8%E6%8D%AE\" title=\"2\u3001\u8bf7\u6c42\u8bbf\u95ee\u670d\u52a1\u7684ST\u7968\u636e\">2\u3001\u8bf7\u6c42\u8bbf\u95ee\u670d\u52a1\u7684ST\u7968\u636e<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-8\" href=\"http:\/\/weizn.net\/?p=1014\/#3%E3%80%81%E7%A6%BB%E7%BA%BF%E7%A0%B4%E8%A7%A3%E5%87%AD%E6%8D%AE\" title=\"3\u3001\u79bb\u7ebf\u7834\u89e3\u51ed\u636e\">3\u3001\u79bb\u7ebf\u7834\u89e3\u51ed\u636e<\/a><\/li><\/ul><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-9\" href=\"http:\/\/weizn.net\/?p=1014\/#%E5%9B%9B%E3%80%81%E9%A3%8E%E9%99%A9%E5%8A%A0%E5%9B%BA\" title=\"\u56db\u3001\u98ce\u9669\u52a0\u56fa\">\u56db\u3001\u98ce\u9669\u52a0\u56fa<\/a><ul class=\"ez-toc-list-level-3\"><li class=\"ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-10\" href=\"http:\/\/weizn.net\/?p=1014\/#1%E3%80%81%E9%85%8D%E7%BD%AE%E8%BE%83%E5%BC%BA%E7%9A%84%E5%AF%86%E7%A0%81%E7%AD%96%E7%95%A5\" title=\"1\u3001\u914d\u7f6e\u8f83\u5f3a\u7684\u5bc6\u7801\u7b56\u7565\">1\u3001\u914d\u7f6e\u8f83\u5f3a\u7684\u5bc6\u7801\u7b56\u7565<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-11\" href=\"http:\/\/weizn.net\/?p=1014\/#2%E3%80%81%E7%A6%81%E7%94%A8%E4%B8%8D%E5%AE%89%E5%85%A8%E7%9A%84%E5%8A%A0%E5%AF%86%E7%AE%97%E6%B3%95\" title=\"2\u3001\u7981\u7528\u4e0d\u5b89\u5168\u7684\u52a0\u5bc6\u7b97\u6cd5\">2\u3001\u7981\u7528\u4e0d\u5b89\u5168\u7684\u52a0\u5bc6\u7b97\u6cd5<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"%E4%B8%80%E3%80%81%E8%83%8C%E6%99%AF%E7%9F%A5%E8%AF%86\"><\/span>\u4e00\u3001\u80cc\u666f\u77e5\u8bc6<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>kerberoast\u653b\u51fb\u53d1\u751f\u5728kerberos\u534f\u8bae\u7684TGS-REP\u9636\u6bb5\uff0ckerberos\u534f\u8bae\u6d41\u7a0b\u56fe\u5982\u4e0b\uff1a<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/post-1014-69fd9a1c810f5.\" alt=\"\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"1%E3%80%81%E7%94%A8%E6%88%B7%E6%AD%A3%E5%B8%B8%E8%AE%BF%E9%97%AE%E6%9F%90%E6%9C%8D%E5%8A%A1%E6%B5%81%E7%A8%8B\"><\/span>1\u3001\u7528\u6237\u6b63\u5e38\u8bbf\u95ee\u67d0\u670d\u52a1\u6d41\u7a0b<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li>\n<p>\u9996\u5148\u7528\u6237\u5c06 AS-REQ \u6570\u636e\u5305\u53d1\u9001\u7ed9 KDC \u5bc6\u94a5\u5206\u53d1\u4e2d\u5fc3\uff0c\u8981\u5bf9\u4e00\u4e2a\u57df\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\u3002<\/p>\n<\/li>\n<li>\n<p>KDC \u6536\u5230\u7528\u6237\u7684\u8bf7\u6c42\u540e\u4f1a\u9a8c\u8bc1\u7528\u6237\u7684\u51ed\u636e\uff0c\u5982\u679c\u51ed\u636e\u6709\u6548\uff0c\u5219\u8fd4\u56de TGT \u8ba4\u8d2d\u6743\u8bc1\uff0c\u8be5 TGT \u8ba4\u8d2d\u6743\u8bc1\u7528\u4e8e\u4ee5\u540e\u7684 ST \u670d\u52a1\u7968\u636e\u7684\u8bf7\u6c42\u3002<\/p>\n<\/li>\n<li>\n<p>\u5982\u679c\u7528\u6237\u60f3\u901a\u8fc7\u8eab\u4efd\u8ba4\u8bc1\u8bbf\u95ee\u67d0\u4e2a\u670d\u52a1\u7684\u8bdd\uff0c\u90a3\u4e48\u4ed6\u9700\u8981\u53d1\u8d77\u7968\u636e\u6388\u4e88\u8bf7\u6c42\uff0c\u8bf7\u6c42\u4e2d\u5305\u542b TGT \u4ee5\u53ca\u6240\u8bf7\u6c42\u670d\u52a1\u7684 SPN \u670d\u52a1\u4e3b\u4f53\u540d\u79f0\u3002<\/p>\n<\/li>\n<li>\n<p>\u5982\u679c TGT \u6709\u6548\u5e76\u4e14\u6ca1\u6709\u8fc7\u671f\uff0c\u90a3\u4e48 TGS \u4f1a\u4ece TGT \u8ba4\u8d2d\u6743\u8bc1\u4e2d\u63d0\u53d6\u4fe1\u606f\u521b\u5efa\u4e00\u4e2a\u7528\u4e8e\u8bbf\u95ee\u76ee\u6807\u670d\u52a1\u7684\u4e00\u4e2a ST \u670d\u52a1\u7968\u636e\uff0c\u8be5 ST \u670d\u52a1\u7968\u636e\u4f7f\u7528\u670d\u52a1\u8d26\u6237\u7684\u51ed\u636e\u8fdb\u884c\u52a0\u5bc6\u3002\u7136\u540e\uff0c\u57df\u63a7\u5236\u5668\u5f00\u59cb\u67e5\u627e\u54ea\u4e2a\u5e10\u6237\u5728 ServicedPrincipalName\uff08SPN\uff09\u5b57\u6bb5\u4e2d\u6ce8\u518c\u4e86\u6240\u8bf7\u6c42\u7684 SPN\u3002<\/p>\n<\/li>\n<li>\n<p>\u7528\u6237\u6536\u5230\u5305\u542b\u4e86\u670d\u52a1\u7968\u636e\u7684 TGS \u54cd\u5e94\u6570\u636e\u5305\u3002<\/p>\n<\/li>\n<li>\n<p>\u6700\u540e\uff0c\u670d\u52a1\u7968\u636e\u4f1a\u8f6c\u53d1\u7ed9\u76ee\u6807\u670d\u52a1\uff0c\u7136\u540e\u4f7f\u7528\u670d\u52a1\u8d26\u6237\u7684\u51ed\u636e\u8fdb\u884c\u89e3\u5bc6\u3002<\/p>\n<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"2%E3%80%81Kerberoast%E6%94%BB%E5%87%BB%E8%BF%87%E7%A8%8B\"><\/span>2\u3001Kerberoast\u653b\u51fb\u8fc7\u7a0b<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<blockquote>\n<p>\u7531\u4e8eKDC\u8fd4\u56de\u7684ST\u7968\u636e\uff0c\u4f7f\u7528\u4e86SPN\u8d26\u6237\u7684NTLM\u54c8\u5e0c\u52a0\u5bc6\uff0c\u5e76\u4e14\u653b\u51fb\u8005\u53ef\u4ee5\u4e0eKDC\u534f\u5546\u6b64ST\u7684\u52a0\u5bc6\u7b97\u6cd5\uff0c\u5982\u679c\u57df\u63a7\u652f\u6301\u4f7f\u7528\u4e0d\u5b89\u5168\u7684\u52a0\u5bc6\u7b97\u6cd5\uff0c\u53ef\u80fd\u5bfc\u81f4ST\u7968\u636e\u4e2d\uff0cSPN\u8d26\u6237\u7684NTLM\u54c8\u5e0c\u88ab\u653b\u51fb\u8005\u79bb\u7ebf\u7834\u89e3<\/p>\n<\/blockquote>\n<ul>\n<li>\n<p>\u653b\u51fb\u8005\u5bf9\u4e00\u4e2a\u57df\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\uff0c\u7136\u540e\u4ece\u57df\u63a7\u5236\u5668\u83b7\u5f97\u4e00\u4e2aTGT\u8ba4\u8d2d\u6743\u8bc1\uff0c\u8be5TGT\u8ba4\u8d2d\u6743\u8bc1\u7528\u4e8e\u4ee5\u540e\u7684ST\u670d\u52a1\u7968\u636e\u8bf7\u6c42<\/p>\n<\/li>\n<li>\n<p>\u653b\u51fb\u8005\u4f7f\u7528 TGT\u8ba4\u8d2d\u6743\u8bc1 \u53d1\u51faST\u670d\u52a1\u7968\u636e\u8bf7\u6c42\uff08TGS-REQ\uff09\u83b7\u53d6\u7279\u5b9a\u5f62\u5f0f(name\/host)\u7684 ServicePrincipalName (SPN)\u4f8b\u5982: MSSdlSvc\/SQL.domain.com\u3002\u6b64SPN\u5728\u57df\u4e2d\u662f\u552f\u4e00\u7684\uff0c\u5e76\u4e14\u5728\u7528\u6237\u6216\u8ba1\u7b97\u673a\u5e10\u6237\u7684servicePrincipalName \u5b57\u6bb5\u4e2d\u6ce8\u518c\u5728\u670d\u52a1\u7968\u8bc1\u8bf7\u6c42(TGS-REQ)\u8fc7\u7a0b\u4e2d\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u6307\u5b9a\u5b83\u4eec\u652f\u6301\u7684Kerberos\u52a0\u5bc6\u7c7b\u578b(\u4f8b\u5982RC4_HMAC_MD5\uff0cAES256_HMAC_SHA1\u7b49\u7b49)\u3002<\/p>\n<\/li>\n<li>\n<p>\u5982\u679c\u653b\u51fb\u8005\u7684 TGT \u662f\u6709\u6548\u7684\uff0c\u5219DC \u5c06\u4eceTGT\u8ba4\u8d2d\u6743\u8bc1\u4e2d\u63d0\u53d6\u4fe1\u606f\u5e76\u586b\u5145\u5230ST\u670d\u52a1\u7968\u636e\u4e2d\u3002\u7136\u540e\uff0c\u57df\u63a7\u5236\u5668\u67e5\u627e\u54ea\u4e2a\u5e10\u6237\u5728ServicedPrincipaName \u5b57\u6bb5\u4e2d\u6ce8\u518c\u4e86\u6240\u8bf7\u6c42\u7684 SPN\u3002<strong>ST\u670d\u52a1\u7968\u636e\u4f7f\u7528SPN\u8d26\u6237\u7684NTLM\u54c8\u5e0c\u8fdb\u884c\u52a0\u5bc6\uff0c\u5e76\u4f7f\u7528\u653b\u51fb\u8005\u548c\u670d\u52a1\u5e10\u6237\u5171\u540c\u5546\u5b9a\u7684\u4e0d\u5b89\u5168\u7684\u52a0\u5bc6\u7b97\u6cd5\uff08RC4_HMAC_MD5\uff09<\/strong>\u3002ST\u670d\u52a1\u7968\u636e\u4ee5\u670d\u52a1\u7968\u636e\u56de\u590d(TGS-REP)\u7684\u5f62\u5f0f\u53d1\u9001\u56de\u653b\u51fb\u8005\u3002<\/p>\n<\/li>\n<li>\n<p>\u653b\u51fb\u8005\u4ece TGS-REP \u4e2d\u63d0\u53d6\u52a0\u5bc6\u7684\u670d\u52a1\u7968\u8bc1\u3002\u7531\u4e8e\u670d\u52a1\u7968\u8bc1\u662f\u7528\u6240\u5c5e\u7684SPN\u8d26\u6237\u7684NTLM\u54c8\u5e0c\u52a0\u5bc6\u7684\uff0c\u6240\u4ee5\u653b\u51fb\u8005\u53ef\u4ee5\u79bb\u7ebf\u7834\u89e3\u8fd9\u4e2a\u52a0\u5bc6\u5757\uff0c\u6062\u590dSPN\u5e10\u6237\u7684\u660e\u6587\u5bc6\u7801\u3002<\/p>\n<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"%E4%BA%8C%E3%80%81%E5%88%A9%E7%94%A8%E6%9D%A1%E4%BB%B6\"><\/span>\u4e8c\u3001\u5229\u7528\u6761\u4ef6<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>\n<p>\u63a7\u5236\u4e86\u57df\u5185\u673a\u5668\u6216\u67d0\u57df\u8d26\u53f7\u51ed\u636e<\/p>\n<\/li>\n<li>\n<p>\u57df\u5185\u6709\u5c5e\u4e8e\u666e\u901a\u57df\u8d26\u53f7\u7684SPN\u670d\u52a1<\/p>\n<blockquote>\n<p>\u867d\u7136\u57df\u73af\u5883\u5185\u6709\u5f88\u591a\u9ed8\u8ba4\u7684SPN\u670d\u52a1\uff0c\u4f46\u8fd9\u4e9b\u9ed8\u8ba4\u670d\u52a1\u57fa\u672c\u6240\u5c5e\u4e8e\u673a\u5668\u8d26\u53f7\uff0c\u800c\u673a\u5668\u8d26\u53f7\u7684\u5bc6\u7801\u662f\u968f\u673a\u7684\uff0c\u7834\u89e3\u96be\u5ea6\u5f88\u9ad8\uff0c\u56e0\u6b64\u8fd9\u90e8\u5206\u9ed8\u8ba4\u670d\u52a1\u6ca1\u6709\u5229\u7528\u4ef7\u503c\uff0c\u653b\u51fb\u8005\u9700\u8981\u5148\u7b5b\u9009\u51fa\u6240\u5c5e\u5728\u57df\u8d26\u6237\u4e0b\u7684SPN\u670d\u52a1\u3002<br \/>\n\u57df\u5185\u7684\u57fa\u672c\u8d26\u53f7\u5206\u4e3a2\u7c7b\uff0c\u57df\u8d26\u53f7\uff0c\u4ee5\u53ca\u673a\u5668\u8d26\u53f7\uff0c\u800cSPN\u8d26\u53f7\u662f\u57df\u8d26\u53f7\u540d\u4e0b\u521b\u5efa\u4e86SPN\u670d\u52a1\uff0c\u5c31\u6210\u4e3a\u4e86SPN\u8d26\u53f7<\/p>\n<\/blockquote>\n<\/li>\n<li>\n<p>\u7ec4\u7b56\u7565\u5bf9Kerberos\u7684\u52a0\u5bc6\u7c7b\u578b\u652f\u6301RC4_HMAC_MD5\u7b97\u6cd5<\/p>\n<blockquote>\n<p>RC4_HMAC_MD5\u8f83\u5176\u5b83\u52a0\u5bc6\u7b97\u6cd5\uff08\u5982AES\uff09\u7834\u89e3\u901f\u7387\u66f4\u5feb\uff0c\u56e0\u6b64\u653b\u51fb\u6210\u529f\u7387\u66f4\u9ad8<\/p>\n<\/blockquote>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/post-1014-69fd9a1c8df5b.\" alt=\"\" \/><\/p>\n<h2><span class=\"ez-toc-section\" id=\"%E4%B8%89%E3%80%81%E5%88%A9%E7%94%A8%E8%BF%87%E7%A8%8B\"><\/span>\u4e09\u3001\u5229\u7528\u8fc7\u7a0b<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>\u6d4b\u8bd5\u73af\u5883\uff1a<\/strong><\/p>\n<table>\n<thead>\n<tr>\n<th>\u4e3b\u673a\u540d<\/th>\n<th>\u4e3b\u673aIP<\/th>\n<th>\u4e3b\u673a\u8d26\u6237<\/th>\n<th>\u4e3b\u673a\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>dc-main-1.qiuqiu.com<\/td>\n<td>10.10.10.10<\/td>\n<td>qiuqiu.com\\domain_admin<\/td>\n<td>\u4e3b\u57df<\/td>\n<\/tr>\n<tr>\n<td>user1.qiuqiu.com<\/td>\n<td>10.100.0.6<\/td>\n<td>qiuqiu.com\\yefan<\/td>\n<td>\u666e\u901a\u57df\u5185\u673a\u5668\uff0c\u88ab\u653b\u51fb\u8005\u63a7\u5236<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3><span class=\"ez-toc-section\" id=\"1%E3%80%81%E6%8E%A2%E6%B5%8B%E5%8F%AF%E5%88%A9%E7%94%A8%E7%9A%84SPN%E8%B4%A6%E5%8F%B7\"><\/span>1\u3001\u63a2\u6d4b\u53ef\u5229\u7528\u7684SPN\u8d26\u53f7<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<pre><code>cscript.exe .\\GetUserSPNs.vbs<\/code><\/pre>\n<p><img decoding=\"async\" src=\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/post-1014-69fd9a1c98b42.\" alt=\"\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"2%E3%80%81%E8%AF%B7%E6%B1%82%E8%AE%BF%E9%97%AE%E6%9C%8D%E5%8A%A1%E7%9A%84ST%E7%A5%A8%E6%8D%AE\"><\/span>2\u3001\u8bf7\u6c42\u8bbf\u95ee\u670d\u52a1\u7684ST\u7968\u636e<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>\u8bf7\u6c42\u5230\u7684\u76ee\u7684\u670d\u52a1\u7684ST\u7968\u636e\uff0c\u4f7f\u7528\u4e86\u670d\u52a1\u6240\u5c5e\u7684SPN\u8d26\u53f7\u7684NTLM\u54c8\u5e0c\u52a0\u5bc6\uff0c\u5982\u679c\u52a0\u5bc6\u7b97\u6cd5\u4e0d\u5b89\u5168\uff0c\u6709\u6982\u7387\u7834\u89e3\u51fa\u8d26\u53f7\u7684\u660e\u6587\u5bc6\u7801\u3002<\/p>\n<pre><code>\/\/ \u5217\u4e3e\u51fa\u6240\u6709\u53ef\u5229\u7528\u7684\u666e\u901a\u57df\u8d26\u53f7\u7684SPN\u670d\u52a1\u7968\u636e\uff0c\u5e76\u8f93\u51fa\u4e3ahashcat\u53ef\u7834\u89e3\u7684\u683c\u5f0f\n\nRubeus.exe kerberoast \/nowrap \/format:hashcat<\/code><\/pre>\n<p>etype\u4e3a23\uff0c\u8868\u660e\u4f7f\u7528<strong>RC4_HMAC_MD5<\/strong>\u7b97\u6cd5\u52a0\u5bc6\uff1a<br \/>\n<img decoding=\"async\" src=\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/post-1014-69fd9a1ca51eb.\" alt=\"\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"3%E3%80%81%E7%A6%BB%E7%BA%BF%E7%A0%B4%E8%A7%A3%E5%87%AD%E6%8D%AE\"><\/span>3\u3001\u79bb\u7ebf\u7834\u89e3\u51ed\u636e<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>\u5c06\u4e0a\u8ff0hash\u5b57\u7b26\u4e32\u4fdd\u5b58\u5230\u6587\u4ef6\u4e2d\u540e\uff0c\u53ef\u4f7f\u7528hashcat\u5c1d\u8bd5\u7834\u89e3\uff0c\u4f7f\u7528\u5b57\u5178\uff0c\u6216\u8005\u4f7f\u7528\u63a9\u7801\u679a\u4e3e\u7834\u89e3\u65b9\u5f0f\uff1a<\/p>\n<ul>\n<li>\u4f7f\u7528\u5b57\u5178\u7834\u89e3<\/li>\n<\/ul>\n<pre><code>\/\/ -d 1\uff1a\u9009\u62e9\u540e\u7aef\u8ba1\u7b97\u7684\u786c\u4ef6\u8bbe\u5907\uff0c\u5982CPU\u6216GPU\n\/\/ -m 13100\uff1a\u5bf9\u5e94\u300cKerberos 5, etype 23, TGS-REP\u300d\u52a0\u5bc6\u7b97\u6cd5\n\/\/ --force\uff1a\u5ffd\u7565\u67d0\u4e9b\u786c\u4ef6\u8b66\u544a\u5e76\u542f\u52a8hashcat\n\/\/ -a 0\uff1a\u4f7f\u7528\u5b57\u5178\u7834\u89e3\n\nhashcat.exe -d 1 -m 13100 --force -a 0 kerberoast.txt pass.txt<\/code><\/pre>\n<p><img decoding=\"async\" src=\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/post-1014-69fd9a1cb08a6.\" alt=\"\" \/><\/p>\n<ul>\n<li>\u4f7f\u7528\u63a9\u7801\u7834\u89e3<br \/>\n<blockquote>\n<p>\u6b64\u529f\u80fd\u9700\u8981GPU\u652f\u6301<\/p>\n<\/blockquote>\n<\/li>\n<\/ul>\n<pre><code>\n\/\/ -O\uff1a\u542f\u7528\u5185\u6838\u4f18\u5316\n\/\/ -1\uff1a\u5b9a\u4e491\u7684\u63a9\u7801\u7c7b\u578b\uff0c\u5177\u4f53\u53c2\u9605\u5b98\u7f51\n\/\/ ?1?1?1?1?1?1?1?1\uff1a\u603b\u51718\u4f4d\u4ee5\u5185\u7684\u5bc6\u7801\u957f\u5ea6\uff0c\u6bcf\u4e00\u4f4d\u7528\u76841\u7c7b\u578b\u63a9\u7801\n\nhashcat.exe  -m 13100 -a 3 .\\kerberoast.txt -O -1 ?l?u?d ?1?1?1?1?1?1?1?1<\/code><\/pre>\n<p><img decoding=\"async\" src=\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/post-1014-69fd9a1cb9238.\" alt=\"\" \/><\/p>\n<p>\u8fd9\u91cc\u53ef\u4ee5\u770b\u5230\u7834\u89e3\u901f\u7387\u4e3a840w\u4e2a\u54c8\u5e0c\u6bcf\u79d2\uff0c\u603b\u8fdb\u5ea6\u4e3a0.01%\uff0c\u7b49\u5f85\u4e00\u6bb5\u65f6\u95f4\u540e\uff0c\u6210\u529f\u7834\u89e3\u51fa\u5bc6\u7801\uff1a<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/post-1014-69fd9a1cc3cdb.\" alt=\"\" \/><\/p>\n<h2><span class=\"ez-toc-section\" id=\"%E5%9B%9B%E3%80%81%E9%A3%8E%E9%99%A9%E5%8A%A0%E5%9B%BA\"><\/span>\u56db\u3001\u98ce\u9669\u52a0\u56fa<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"1%E3%80%81%E9%85%8D%E7%BD%AE%E8%BE%83%E5%BC%BA%E7%9A%84%E5%AF%86%E7%A0%81%E7%AD%96%E7%95%A5\"><\/span>1\u3001\u914d\u7f6e\u8f83\u5f3a\u7684\u5bc6\u7801\u7b56\u7565<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>\u57df\u63a7\u9ed8\u8ba4\u5bc6\u7801\u7b56\u7565\u6700\u4f4e\u8fd0\u884c\u957f\u5ea6\u4e3a7\uff0c\u9700\u8981\u5f3a\u5236\u5bc6\u7801\u7b56\u7565\u6ee1\u8db3\u5b89\u5168\u9700\u6c42\u3002<\/p>\n<h3><span class=\"ez-toc-section\" id=\"2%E3%80%81%E7%A6%81%E7%94%A8%E4%B8%8D%E5%AE%89%E5%85%A8%E7%9A%84%E5%8A%A0%E5%AF%86%E7%AE%97%E6%B3%95\"><\/span>2\u3001\u7981\u7528\u4e0d\u5b89\u5168\u7684\u52a0\u5bc6\u7b97\u6cd5<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>\u9700\u8981\u5728\u6bcf\u4e2a\u57df\u63a7\u672c\u5730\u7ec4\u7b56\u7565\u4e2d\u7981\u7528\u9ed8\u8ba4\u5f00\u542f\u7684<strong>RC4_HMAC_MD5<\/strong>\u52a0\u5bc6\u7b97\u6cd5\u5373\u53ef\uff1a<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/post-1014-69fd9a1ccfd66.\" alt=\"\" \/><\/p>\n<p>\u4fee\u6539\u5b8c\u6210\u540e\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u5f3a\u5236\u66f4\u65b0\u7ec4\u7b56\u7565\uff1a<\/p>\n<pre><code>gpupdate \/force<\/code><\/pre>\n<p>\u6700\u540e\u518d\u6d4b\u8bd5\u4e00\u4e0b\uff0c\u5982\u679c\u653b\u51fb\u8005\u83b7\u53d6\u5230AES\u52a0\u5bc6\u7684TGS-REP\u5bc6\u6587\uff0c\u89e3\u5bc6\u5c06\u975e\u5e38\u56f0\u96be\uff0c\u7834\u89e3\u901f\u7387\u8dcc\u5230\u4e8678w\u4e2a\u54c8\u5e0c\u6bcf\u79d2\uff0c\u76f8\u6bd4RC4\u964d\u4f4e\u4e8610\u500d\uff1a<\/p>\n<pre><code>\/\/ -m 19700\uff1a19700 | Kerberos 5, etype 18, TGS-REP\uff0cetype\u4e3a18\u8868\u660e\u4f7f\u7528AES256_HMAC\u52a0\u5bc6\n\nhashcat.exe  -m 19700 -a 3 .\\kerberoast.txt -O -1 ?l?u?d ?1?1?1?1?1?1?1?1<\/code><\/pre>\n<p><img decoding=\"async\" src=\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/post-1014-69fd9a1cd8274.\" alt=\"\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u7531\u4e8eKDC\u8fd4\u56de\u7684ST\u7968\u636e\uff0c\u4f7f\u7528\u4e86SPN\u8d26\u6237\u7684NTLM\u54c8\u5e0c\u52a0\u5bc6\uff0c\u5e76\u4e14\u653b\u51fb\u8005\u53ef\u4ee5\u4e0eKDC\u534f\u5546\u6b64ST\u7684\u52a0\u5bc6\u7b97\u6cd5\uff0c\u5982\u679c\u57df\u63a7\u652f\u6301\u4f7f\u7528\u4e0d\u5b89\u5168\u7684\u52a0\u5bc6\u7b97\u6cd5\uff0c\u53ef\u80fd\u5bfc\u81f4ST\u7968\u636e\u4e2d\uff0cSPN\u8d26\u6237\u7684NTLM\u54c8\u5e0c\u88ab\u653b\u51fb\u8005\u79bb\u7ebf\u7834\u89e3<\/p>\n","protected":false},"author":1,"featured_media":1015,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[322],"tags":[],"class_list":["post-1014","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v16.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Kerberoast - Wayne&#039;s Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/weizn.net\/?p=1014\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kerberoast - Wayne&#039;s Blog\" \/>\n<meta property=\"og:description\" content=\"\u7531\u4e8eKDC\u8fd4\u56de\u7684ST\u7968\u636e\uff0c\u4f7f\u7528\u4e86SPN\u8d26\u6237\u7684NTLM\u54c8\u5e0c\u52a0\u5bc6\uff0c\u5e76\u4e14\u653b\u51fb\u8005\u53ef\u4ee5\u4e0eKDC\u534f\u5546\u6b64ST\u7684\u52a0\u5bc6\u7b97\u6cd5\uff0c\u5982\u679c\u57df\u63a7\u652f\u6301\u4f7f\u7528\u4e0d\u5b89\u5168\u7684\u52a0\u5bc6\u7b97\u6cd5\uff0c\u53ef\u80fd\u5bfc\u81f4ST\u7968\u636e\u4e2d\uff0cSPN\u8d26\u6237\u7684NTLM\u54c8\u5e0c\u88ab\u653b\u51fb\u8005\u79bb\u7ebf\u7834\u89e3\" \/>\n<meta property=\"og:url\" content=\"http:\/\/weizn.net\/?p=1014\" \/>\n<meta property=\"og:site_name\" content=\"Wayne&#039;s Blog\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-17T12:48:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-08T08:52:57+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/kerberos-windows.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"512\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"zinan\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"http:\/\/weizn.net\/#website\",\"url\":\"http:\/\/weizn.net\/\",\"name\":\"Wayne&#039;s Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/weizn.net\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"ImageObject\",\"@id\":\"http:\/\/weizn.net\/?p=1014#primaryimage\",\"inLanguage\":\"zh-Hans\",\"url\":\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/kerberos-windows.png\",\"contentUrl\":\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/kerberos-windows.png\",\"width\":1024,\"height\":512},{\"@type\":\"WebPage\",\"@id\":\"http:\/\/weizn.net\/?p=1014#webpage\",\"url\":\"http:\/\/weizn.net\/?p=1014\",\"name\":\"Kerberoast - Wayne&#039;s Blog\",\"isPartOf\":{\"@id\":\"http:\/\/weizn.net\/#website\"},\"primaryImageOfPage\":{\"@id\":\"http:\/\/weizn.net\/?p=1014#primaryimage\"},\"datePublished\":\"2023-09-17T12:48:08+00:00\",\"dateModified\":\"2026-05-08T08:52:57+00:00\",\"breadcrumb\":{\"@id\":\"http:\/\/weizn.net\/?p=1014#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/weizn.net\/?p=1014\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/weizn.net\/?p=1014#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\\u9996\\u9875\",\"item\":\"http:\/\/weizn.net\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kerberoast\"}]},{\"@type\":\"Article\",\"@id\":\"http:\/\/weizn.net\/?p=1014#article\",\"isPartOf\":{\"@id\":\"http:\/\/weizn.net\/?p=1014#webpage\"},\"author\":{\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\"},\"headline\":\"Kerberoast\",\"datePublished\":\"2023-09-17T12:48:08+00:00\",\"dateModified\":\"2026-05-08T08:52:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\/\/weizn.net\/?p=1014#webpage\"},\"wordCount\":122,\"commentCount\":0,\"publisher\":{\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\"},\"image\":{\"@id\":\"http:\/\/weizn.net\/?p=1014#primaryimage\"},\"thumbnailUrl\":\"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/kerberos-windows.png\",\"articleSection\":[\"\\u6280\\u672f\\u6587\\u7ae0\"],\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\/\/weizn.net\/?p=1014#respond\"]}]},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\",\"name\":\"zinan\",\"logo\":{\"@id\":\"http:\/\/weizn.net\/#personlogo\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Kerberoast - Wayne&#039;s Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/weizn.net\/?p=1014","og_locale":"zh_CN","og_type":"article","og_title":"Kerberoast - Wayne&#039;s Blog","og_description":"\u7531\u4e8eKDC\u8fd4\u56de\u7684ST\u7968\u636e\uff0c\u4f7f\u7528\u4e86SPN\u8d26\u6237\u7684NTLM\u54c8\u5e0c\u52a0\u5bc6\uff0c\u5e76\u4e14\u653b\u51fb\u8005\u53ef\u4ee5\u4e0eKDC\u534f\u5546\u6b64ST\u7684\u52a0\u5bc6\u7b97\u6cd5\uff0c\u5982\u679c\u57df\u63a7\u652f\u6301\u4f7f\u7528\u4e0d\u5b89\u5168\u7684\u52a0\u5bc6\u7b97\u6cd5\uff0c\u53ef\u80fd\u5bfc\u81f4ST\u7968\u636e\u4e2d\uff0cSPN\u8d26\u6237\u7684NTLM\u54c8\u5e0c\u88ab\u653b\u51fb\u8005\u79bb\u7ebf\u7834\u89e3","og_url":"http:\/\/weizn.net\/?p=1014","og_site_name":"Wayne&#039;s Blog","article_published_time":"2023-09-17T12:48:08+00:00","article_modified_time":"2026-05-08T08:52:57+00:00","og_image":[{"width":1024,"height":512,"filesize":97271,"url":"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/kerberos-windows.png","path":"\/app\/wp-content\/uploads\/2026\/05\/kerberos-windows.png","size":"full","id":1015,"alt":"","pixels":524288,"type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"zinan","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"1 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"http:\/\/weizn.net\/#website","url":"http:\/\/weizn.net\/","name":"Wayne&#039;s Blog","description":"","publisher":{"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/weizn.net\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"ImageObject","@id":"http:\/\/weizn.net\/?p=1014#primaryimage","inLanguage":"zh-Hans","url":"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/kerberos-windows.png","contentUrl":"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/kerberos-windows.png","width":1024,"height":512},{"@type":"WebPage","@id":"http:\/\/weizn.net\/?p=1014#webpage","url":"http:\/\/weizn.net\/?p=1014","name":"Kerberoast - Wayne&#039;s Blog","isPartOf":{"@id":"http:\/\/weizn.net\/#website"},"primaryImageOfPage":{"@id":"http:\/\/weizn.net\/?p=1014#primaryimage"},"datePublished":"2023-09-17T12:48:08+00:00","dateModified":"2026-05-08T08:52:57+00:00","breadcrumb":{"@id":"http:\/\/weizn.net\/?p=1014#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["http:\/\/weizn.net\/?p=1014"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/weizn.net\/?p=1014#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"http:\/\/weizn.net\/"},{"@type":"ListItem","position":2,"name":"Kerberoast"}]},{"@type":"Article","@id":"http:\/\/weizn.net\/?p=1014#article","isPartOf":{"@id":"http:\/\/weizn.net\/?p=1014#webpage"},"author":{"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264"},"headline":"Kerberoast","datePublished":"2023-09-17T12:48:08+00:00","dateModified":"2026-05-08T08:52:57+00:00","mainEntityOfPage":{"@id":"http:\/\/weizn.net\/?p=1014#webpage"},"wordCount":122,"commentCount":0,"publisher":{"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264"},"image":{"@id":"http:\/\/weizn.net\/?p=1014#primaryimage"},"thumbnailUrl":"http:\/\/weizn.net\/wp-content\/uploads\/2026\/05\/kerberos-windows.png","articleSection":["\u6280\u672f\u6587\u7ae0"],"inLanguage":"zh-Hans","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/weizn.net\/?p=1014#respond"]}]},{"@type":["Person","Organization"],"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264","name":"zinan","logo":{"@id":"http:\/\/weizn.net\/#personlogo"}}]}},"_links":{"self":[{"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/posts\/1014","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1014"}],"version-history":[{"count":2,"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/posts\/1014\/revisions"}],"predecessor-version":[{"id":1025,"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/posts\/1014\/revisions\/1025"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/media\/1015"}],"wp:attachment":[{"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1014"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}