鈥?strong>鈥嬧€滅數鑴戝瘑鐮佸繕浜嗗拫鏁达紵鍒厡锛佷粖澶╂墜鎶婃墜鏁欎綘鐢ㄤ袱鎶婄鍣ㄦ壘鍥炲瘑鐮侊紒鈥濃€?/strong>鈥?br/> 浣滀负涓€涓父骞村拰鐢佃剳鎵撲氦閬撶殑鎶€鏈畢锛屾垜鍙戠幇鑷冲皯鏈?0%鐨勪汉閬囧埌杩囩郴缁熷瘑鐮佷涪澶辩殑灏村艾銆備笉杩囦綘鎳傜殑锛屽彧瑕佹帉鎻′簡Mimikatz鍜孭rocDump杩欏榛勯噾鎼。锛屽埆璇存櫘閫氱敤鎴峰瘑鐮侊紝杩炵鐞嗗憳鏉冮檺閮借兘缁欎綘鎵掓媺鍑烘潵鈥斺€斿綋鐒讹紝鍜卞緱鍏堣娓呮锛岃繖鐜╂剰鍎垮彧鑳界敤鍦ㄥ悎娉曞満鏅晩锛?/p>

涓€銆佽繖淇╁伐鍏峰埌搴曟槸鍟ユ潵澶达紵

鈥?strong>鈥婸rocDump鈥?/strong>鈥嬭鐧戒簡灏辨槸涓€滃唴瀛樺揩鐓у笀鈥濓紝涓撻棬鎶撳彇绯荤粺杩涚▼鐨勫疄鏃剁姸鎬併€傛瘮濡備綘鎯崇湅鐨刲sass.exe杩涚▼锛堣繖璐х鐫€Windows鐨勭櫥褰曢獙璇侊級锛岀敤瀹冭兘涓€閿敓鎴愬唴瀛樿浆鍌ㄦ枃浠?span>cnblogs.com銆?/p>

鑰屸€?strong>鈥婱imikatz鈥?/strong>鈥嬫洿鍍忊€滃瘑鐮佺炕璇戝畼鈥濓紝鑳芥妸ProcDump鎶撳埌鐨勫姞瀵嗘暟鎹炕璇戞垚鏄庢枃瀵嗙爜銆傚綋骞磋繖宸ュ叿鍒氬嚭鏉ョ殑鏃跺€欙紝杩炲井杞伐绋嬪笀閮芥儕鎺変簡涓嬪反鈥斺€斿師鏉ョ郴缁熼噷钘忕殑瀵嗙爜杩欎箞瀹规槗鏆撮湶锛?span>鍏紬鍙?/span>

涓句釜鏍楀瓙馃尠锛?/p>

浜屻€佸疄鎴樻搷浣滄墜鎶婃墜鏁欏

鈻峉tep1锛氭悶鍒板唴瀛樺揩鐓?/h4>

鍏堟帍鍑篜rocDump锛屽湪绠＄悊鍛樻潈闄愮殑CMD閲屾暡杩欒鍛戒护锛?/p>

powershell澶嶅埗
procdump64.exe -accepteula -ma lsass.exe lsass.dmp

鈥?strong>鈥嬫敞鎰忥紒鈥?/strong>鈥?杩欓噷鏈変釜鍧戯細Win10/2012浠ュ悗鐨勭郴缁熼粯璁や笉瀛樻槑鏂囧瘑鐮佷簡鍏紬鍙?/span>銆傝繖鏃跺€欏緱鍏堟敼娉ㄥ唽琛細

reg澶嶅埗
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1

鏀瑰畬蹇呴』閲嶅惎鎴栬€呴攣灞忚鐢ㄦ埛閲嶆柊鐧诲綍锛屾柊瀵嗙爜鎵嶄細琚褰?span>cnblogs.com銆?/p>

鈻峉tep2锛氬瘑鐮佺炕璇戞椂闂?/h4>

鎶婄敓鎴愮殑lsass.dmp鏂囦欢鎷栧埌鏈湴锛屾墦寮€Mimikatz杈撳叆锛?/p>

powershell澶嶅埗
sekurlsa::minidump lsass.dmp  
sekurlsa::logonPasswords full

杩欐椂鍊欏睆骞曚細鍞板敯寮瑰嚭鐧诲綍杩囩殑鎵€鏈夎处鍙峰瘑鐮侊紝鍖呮嫭锛?/p>

• 鈥?strong>鈥嬫湰鍦扮鐞嗗憳瀵嗙爜鈥?/strong>鈥嬶紙Administrator锛?/li>
• 鈥?strong>鈥嬭繙绋嬫闈㈠嚟璇佲€?/strong>鈥嬶紙姣斿鍏徃VPN璐﹀彿锛?/li>
• 鈥?strong>鈥嬫祻瑙堝櫒鑷姩濉厖鐨勫瘑鐮佲€?/strong>鈥嬶紙鎯婁笉鎯婂枩锛燂級blog.csdn.net

---

涓夈€佷綘鍙兘閬囧埌鐨勫购铔惧瓙

1. 鈥?strong>鈥嬫潃姣掕蒋浠舵姤璀﹀拫鍔烇紵鈥?/strong>鈥?br/> 寰堝鏉€杞細鎶奙imikatz褰撶梾姣掞紝杩欐椂鍊欏彲浠ョ敤ProcDump鐨勨€滅櫧鍚嶅崟鐗规潈鈥濃€斺€旀瘯绔熻繖鏄井杞翰鍎垮瓙宸ュ叿锛屾潃姣掕蒋浠朵竴鑸細鏀捐blog.csdn.net銆?/p>

2. 鈥?strong>鈥嬫姄鍒扮殑鍏ㄦ槸涔辩爜锛熲€?/strong>鈥?br/> 濡傛灉鏄疻in10/2012浠ヤ笂绯荤粺锛岃寰楁鏌ユ湁娌℃湁寮€WDigest鍔熻兘銆傛垜涓婃甯湅鍙嬩慨鐢佃剳灏辨牻鍦ㄨ繖锛屾姌鑵惧崐澶╁彂鐜版敞鍐岃〃娌℃敼鎴愬姛鍏紬鍙?/span>銆?/p>

3. 鈥?strong>鈥嬫枃浠舵潈闄愪笉澶燂紵鈥?/strong>鈥?br/> 涓€瀹氳鐢ㄢ€?strong>鈥嬬鐞嗗憳韬唤杩愯CMD鈥?/strong>鈥嬶紒灏卞儚浣犲幓閾惰鍙栭挶涓嶅甫韬唤璇侊紝绯荤粺褰撶劧涓嶇粰浣犵湅鏁忔劅淇℃伅鍟婏紒

鍥涖€佽€佸徃鏈恒伄缁忛獙涔嬭皥

铏界劧杩欐柟娉曞ソ鐢ㄥ埌椋炶捣锛屼絾蹇呴』鎻愰啋涓夌偣锛?/p>

1. 鈥?strong>鈥嬫硶寰嬬孩绾垮埆纰扳€?/strong>鈥嬶細鏈粡鍏佽鎵弿浠栦汉鐢佃剳灞炰簬杩濇硶琛屼负锛屼笂娆℃湁涓摜浠敤杩欐嫑鏌ヨ€佸﹩鑱婂ぉ璁板綍锛岀粨鏋滄妸鑷繁閫佽繘鍘讳簡鍏紬鍙?/span>銆?/li>
2. 鈥?strong>鈥嬮槻鎶ゅ缓璁€?/strong>鈥嬶細瀹氭湡鏇存柊绯荤粺琛ヤ竵锛屼紒涓氱敤鎴峰缓璁惎鐢↙SA淇濇姢鍔熻兘锛岃Mimikatz鏃犱粠涓嬫墜鍏紬鍙?/span>銆?/li>
3. 鈥?strong>鈥嬪鐢ㄦ柟妗堚€?/strong>鈥嬶細閲嶈瀵嗙爜杩樻槸寰楃敤1Password杩欑被涓撲笟宸ュ叿绠＄悊锛屾寚鏈涗汉鑴戣瀵嗙爜锛熶笉瀛樺湪鐨勶紒

宸ュ叿鏈韩娌℃湁鍠勬伓锛屽叧閿湅鐢ㄧ殑浜恒€傚氨鍍忚彍鍒€鑳藉垏鑿滀篃鑳戒激浜猴紝鎺屾彙鏍稿績鎶€鏈殑鍚屾椂锛屽挶浠洿寰楀畧浣忛亾寰峰簳绾夸笉鏄紵