Compromising Active Directory - 妥协活动目录
TryHackMe | Compromising Active Directory
通过错误配置产生的核心安全问题来了解和利用 Active Directory 网络。
Learn and exploit Active Directory networks through core security issues stemming from misconfigurations.
全球《财富》1000 强企业中约有 90% 使用活动目录 (AD)。如果一家企业使用 Microsoft Windows，那么几乎肯定会发现 AD。由于 AD 用于整个企业的身份和访问管理，因此它掌握着整个王国的钥匙，很可能成为攻击者的目标。本模块将向您传授 AD 的基础知识，并带您体验在红色小组中入侵 AD 的典型过程。您将学习入侵 AD、枚举 AD、利用 AD 并最终通过 AD 部署持久性。
Approximately 90% of the Global Fortune 1000 companies use Active Directory (AD). If an organisation's estate uses Microsoft Windows, you are almost guaranteed to find AD. Since AD is used for Identity and Access Management of the entire estate, it holds the keys to the kingdom, making it a very likely target for attackers. This module will teach you the basics of AD and take you on the typical journey of compromising AD during a red team. You will learn to breach AD, enumerate AD, exploit AD, and finally deploy persistence through AD.
Active Directory Basics - Active Directory 基础
本房间将介绍 Active Directory 的基本概念和功能。
This room will introduce the basic concepts and functionality provided by Active Directory.
Breaching Active Directory - Active Directory 突破
该网络环境涵盖可用于获取第一套 Active Directory 凭据的技术和工具，这些凭据可用于枚举 AD。
This network covers techniques and tools that can be used to acquire that first set of AD credentials that can then be used to enumerate AD.
Enumerating Active Directory - Active Directory 列举
本房间涵盖各种 Active Directory 枚举技术、使用案例以及缺点。
This room covers various Active Directory enumeration techniques, their use cases as well as drawbacks.
Lateral Movement and Pivoting - 横向移动和枢纽
了解在 Windows 网络中横向移动的常用技术。
Learn about common techniques used to move laterally across a Windows network.
Exploiting Active Directory - Active Directory 利用
学习常见的 AD 利用技术，让你在 AD 环境中达成目标。
Learn common AD exploitation techniques that can allow you to reach your goal in an AD environment.
Persisting Active Directory - Active Directory 持久化
了解常见的 Active Directory 持久性技术，这些技术可在入侵后使用，以确保蓝队无法在红队演习中将您踢出。
Learn about common Active Directory persistence techniques that can be used post-compromise to ensure the blue team will not be able to kick you out during a red team exercise.
Credentials Harvesting - 凭据收集
将现代环境中采用的身份验证模型，应用到红色团队方法中。
Apply current authentication models employed in modern environments to a red team approach.