{"id":477358,"date":"2023-08-09T09:11:34","date_gmt":"2023-08-09T09:11:34","guid":{"rendered":""},"modified":"2023-09-05T11:14:33","modified_gmt":"2023-09-05T11:14:33","slug":"golden-ticket-attack","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/cn\/wiki\/golden-ticket-attack\/","title":{"rendered":"\u91d1\u7968\u653b\u51fb"},"content":{"rendered":"

\u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u662f\u4e00\u79cd\u590d\u6742\u7684\u7f51\u7edc\u653b\u51fb\uff0c\u5229\u7528\u4e86 Microsoft \u7684 Active Directory \u57fa\u7840\u67b6\u6784\u4e2d\u7684\u5f31\u70b9\u3002\u5b83\u5141\u8bb8\u653b\u51fb\u8005\u4f2a\u9020 Kerberos \u7968\u8bc1\uff08\u7528\u4e8e\u5728 Windows \u57df\u4e2d\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\uff09\uff0c\u4ece\u800c\u6388\u4e88\u4ed6\u4eec\u672a\u7ecf\u6388\u6743\u7684\u7f51\u7edc\u8bbf\u95ee\u6743\u9650\u3002\u5b89\u5168\u7814\u7a76\u5458 Benjamin Delpy \u4e8e 2014 \u5e74\u9996\u6b21\u53d1\u73b0\u5e76\u516c\u5f00\u62ab\u9732\u4e86\u8be5\u653b\u51fb\u3002\u4ece\u90a3\u65f6\u8d77\uff0c\u5b83\u5c31\u6210\u4e3a\u5168\u7403 IT \u7ba1\u7406\u5458\u548c\u7ec4\u7ec7\u5173\u6ce8\u7684\u91cd\u5927\u95ee\u9898\u3002<\/p>\n

\u91d1\u7968\u653b\u51fb\u7684\u8d77\u6e90\u5386\u53f2<\/h2>\n

\u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u7684\u8d77\u6e90\u53ef\u4ee5\u8ffd\u6eaf\u5230\u5fae\u8f6f Kerberos \u5b9e\u73b0\u4e2d\u53d1\u73b0\u7684\u4e00\u4e2a\u6f0f\u6d1e\u3002Kerberos \u8eab\u4efd\u9a8c\u8bc1\u534f\u8bae\u662f Active Directory \u7684\u6838\u5fc3\u7ec4\u4ef6\uff0c\u4e3a\u7528\u6237\u63d0\u4f9b\u4e86\u4e00\u79cd\u5b89\u5168\u7684\u8eab\u4efd\u9a8c\u8bc1\u548c\u83b7\u53d6\u7f51\u7edc\u8d44\u6e90\u8bbf\u95ee\u6743\u9650\u7684\u65b9\u5f0f\u30022014 \u5e74\uff0c\u201cMimikatz\u201d\u5de5\u5177\u7684\u521b\u5efa\u8005 Benjamin Delpy \u53d1\u73b0\u4e86 Kerberos \u7968\u8bc1\u7b7e\u53d1\u548c\u9a8c\u8bc1\u65b9\u5f0f\u4e2d\u7684\u5f31\u70b9\u3002<\/p>\n

Delpy \u900f\u9732\uff0c\u62e5\u6709\u57df\u63a7\u5236\u5668\u7ba1\u7406\u6743\u9650\u7684\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8fd9\u4e9b\u6f0f\u6d1e\u4f2a\u9020\u9ec4\u91d1\u7968\u8bc1\u3002\u5373\u4f7f\u653b\u51fb\u8005\u7684\u521d\u59cb\u5165\u53e3\u70b9\u5df2\u7ecf\u5173\u95ed\uff0c\u4f2a\u9020\u7684\u7968\u8bc1\u4e5f\u53ef\u7528\u4e8e\u83b7\u5f97\u5bf9\u7ec4\u7ec7\u8d44\u6e90\u7684\u6301\u7eed\u8bbf\u95ee\u6743\u9650\u3002<\/p>\n

\u6709\u5173\u91d1\u7968\u653b\u51fb\u7684\u8be6\u7ec6\u4fe1\u606f<\/h2>\n

\u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u5229\u7528\u4e86 Microsoft \u7684 Active Directory \u57fa\u7840\u67b6\u6784\u7684\u4e24\u4e2a\u4e3b\u8981\u7ec4\u4ef6\uff1a\u7968\u8bc1\u6388\u4e88\u7968\u8bc1 (TGT) \u548c\u5bc6\u94a5\u5206\u53d1\u4e2d\u5fc3 (KDC)\u3002\u5f53\u7528\u6237\u767b\u5f55 Windows \u57df\u65f6\uff0cKDC \u4f1a\u53d1\u51fa TGT\uff0c\u8be5 TGT \u53ef\u4f5c\u4e3a\u7528\u6237\u8eab\u4efd\u7684\u8bc1\u660e\uff0c\u5e76\u6388\u4e88\u5bf9\u5404\u79cd\u8d44\u6e90\u7684\u8bbf\u95ee\u6743\u9650\uff0c\u800c\u65e0\u9700\u91cd\u590d\u8f93\u5165\u51ed\u636e\u3002<\/p>\n

\u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u6d89\u53ca\u4ee5\u4e0b\u6b65\u9aa4\uff1a<\/p>\n

    \n
  1. \n

    \u63d0\u53d6\u8ba4\u8bc1\u6750\u6599<\/strong>\uff1a\u653b\u51fb\u8005\u83b7\u5f97\u57df\u63a7\u5236\u5668\u7684\u7ba1\u7406\u8bbf\u95ee\u6743\u9650\u5e76\u63d0\u53d6\u5fc5\u8981\u7684\u8eab\u4efd\u9a8c\u8bc1\u6750\u6599\uff0c\u5305\u62ec\u4ee5\u7eaf\u6587\u672c\u5b58\u50a8\u7684 KDC \u957f\u671f\u5bc6\u94a5\u3002<\/p>\n<\/li>\n

  2. \n

    \u4f2a\u9020\u91d1\u7968<\/strong>\uff1a\u5229\u7528\u63d0\u53d6\u7684\u6750\u6599\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u4f2a\u9020\u5177\u6709\u4efb\u610f\u7528\u6237\u6743\u9650\u548c\u975e\u5e38\u957f\u7684\u6709\u6548\u671f\uff08\u901a\u5e38\u8de8\u8d8a\u51e0\u5341\u5e74\uff09\u7684 TGT\u3002<\/p>\n<\/li>\n

  3. \n

    \u6301\u4e45\u6027\u548c\u6a2a\u5411\u79fb\u52a8<\/strong>\uff1a\u7136\u540e\u4f7f\u7528\u4f2a\u9020\u7684\u7968\u8bc1\u83b7\u5f97\u7f51\u7edc\u7684\u6301\u7eed\u8bbf\u95ee\u6743\u9650\u5e76\u5728\u7cfb\u7edf\u4e4b\u95f4\u6a2a\u5411\u79fb\u52a8\uff0c\u8bbf\u95ee\u654f\u611f\u8d44\u6e90\u5e76\u5371\u53ca\u5176\u4ed6\u5e10\u6237\u3002<\/p>\n<\/li>\n<\/ol>\n

    \u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u7684\u5185\u90e8\u7ed3\u6784<\/h2>\n

    \u8981\u4e86\u89e3\u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u7684\u5185\u90e8\u7ed3\u6784\uff0c\u5fc5\u987b\u638c\u63e1 Kerberos \u7968\u8bc1\u7684\u7ec4\u6210\u90e8\u5206\uff1a<\/p>\n

      \n
    1. \n

      \u6807\u5934<\/strong>\uff1a\u5305\u542b\u6709\u5173\u52a0\u5bc6\u7c7b\u578b\u3001\u7968\u8bc1\u7c7b\u578b\u548c\u7968\u8bc1\u9009\u9879\u7684\u4fe1\u606f\u3002<\/p>\n<\/li>\n

    2. \n

      \u7968\u52a1\u4fe1\u606f<\/strong>\uff1a\u5305\u62ec\u6709\u5173\u7528\u6237\u8eab\u4efd\u3001\u6743\u9650\u4ee5\u53ca\u4ed6\u4eec\u53ef\u4ee5\u8bbf\u95ee\u7684\u7f51\u7edc\u670d\u52a1\u7684\u8be6\u7ec6\u4fe1\u606f\u3002<\/p>\n<\/li>\n

    3. \n

      \u4f1a\u8bdd\u5bc6\u94a5<\/strong>\uff1a\u7528\u4e8e\u52a0\u5bc6\u548c\u7b7e\u540d\u4f1a\u8bdd\u4e2d\u7684\u6d88\u606f\u3002<\/p>\n<\/li>\n

    4. \n

      \u9644\u52a0\u4fe1\u606f<\/strong>\uff1a\u53ef\u80fd\u5305\u62ec\u7528\u6237\u7684IP\u5730\u5740\u3001\u7968\u8bc1\u7684\u8fc7\u671f\u65f6\u95f4\u4ee5\u53ca\u5176\u4ed6\u76f8\u5173\u6570\u636e\u3002<\/p>\n<\/li>\n<\/ol>\n

      \u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u7684\u5173\u952e\u7279\u5f81\u5206\u6790<\/h2>\n

      \u91d1\u7968\u653b\u51fb\u5177\u6709\u51e0\u4e2a\u5173\u952e\u7279\u5f81\uff0c\u4f7f\u5176\u6210\u4e3a\u4e00\u79cd\u5f3a\u5927\u7684\u5a01\u80c1\uff1a<\/p>\n

        \n
      1. \n

        \u575a\u6301<\/strong>\uff1a\u4f2a\u9020\u7968\u8bc1\u7684\u957f\u6709\u6548\u671f\u53ef\u4f7f\u653b\u51fb\u8005\u5728\u8f83\u957f\u65f6\u95f4\u5185\u4fdd\u6301\u5bf9\u7f51\u7edc\u7684\u8bbf\u95ee\u3002<\/p>\n<\/li>\n

      2. \n

        \u7279\u6743\u63d0\u5347<\/strong>\uff1a\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u4f2a\u9020\u5177\u6709\u66f4\u9ad8\u7ea7\u522b\u8bbf\u95ee\u6743\u9650\u7684\u7968\u8bc1\u6765\u63d0\u5347\u4ed6\u4eec\u7684\u6743\u9650\uff0c\u4ece\u800c\u6388\u4e88\u4ed6\u4eec\u5bf9\u5173\u952e\u7cfb\u7edf\u548c\u6570\u636e\u7684\u63a7\u5236\u6743\u3002<\/p>\n<\/li>\n

      3. \n

        \u6a2a\u5411\u8fd0\u52a8<\/strong>\uff1a\u901a\u8fc7\u6301\u7eed\u8bbf\u95ee\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5728\u7f51\u7edc\u4e2d\u6a2a\u5411\u79fb\u52a8\uff0c\u5371\u5bb3\u5176\u4ed6\u7cfb\u7edf\u5e76\u5347\u7ea7\u5176\u63a7\u5236\u3002<\/p>\n<\/li>\n

      4. \n

        \u9690\u8eab<\/strong>\uff1a\u8fd9\u6b21\u653b\u51fb\u5728\u7cfb\u7edf\u65e5\u5fd7\u4e2d\u7559\u4e0b\u7684\u75d5\u8ff9\u5f88\u5c11\u751a\u81f3\u6ca1\u6709\uff0c\u56e0\u6b64\u5f88\u96be\u88ab\u53d1\u73b0\u3002<\/p>\n<\/li>\n<\/ol>\n

        \u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u7684\u7c7b\u578b<\/h2>\n

        \u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u4e3b\u8981\u6709\u4e24\u79cd\u7c7b\u578b\uff1a<\/p>\n

          \n
        1. \n

          \u5077\u7968<\/strong>\uff1a\u8fd9\u79cd\u65b9\u6cd5\u6d89\u53ca\u4ece\u57df\u63a7\u5236\u5668\u7a83\u53d6\u8eab\u4efd\u9a8c\u8bc1\u6750\u6599\uff0c\u4f8b\u5982 KDC \u957f\u671f\u5bc6\u94a5\u3002<\/p>\n<\/li>\n

        2. \n

          \u79bb\u7ebf\u653b\u51fb<\/strong>\uff1a\u5728\u79bb\u7ebf\u653b\u51fb\u573a\u666f\u4e2d\uff0c\u653b\u51fb\u8005\u4e0d\u9700\u8981\u76f4\u63a5\u653b\u51fb\u57df\u63a7\u5236\u5668\u3002\u76f8\u53cd\uff0c\u4ed6\u4eec\u53ef\u4ee5\u4ece\u5907\u4efd\u6216\u57df\u5feb\u7167\u4e2d\u63d0\u53d6\u5fc5\u8981\u7684\u6750\u6599\u3002<\/p>\n<\/li>\n<\/ol>\n

          \u4e0b\u9762\u662f\u4e24\u79cd\u7c7b\u578b\u7684\u6bd4\u8f83\u8868\uff1a<\/p>\n\n\n\n\n\n\n
          \u7c7b\u578b<\/th>\n\u653b\u51fb\u65b9\u6cd5<\/th>\n\u590d\u6742<\/th>\n\u68c0\u6d4b\u96be\u5ea6<\/th>\n<\/tr>\n<\/thead>\n
          \u5077\u7968<\/td>\n\u76f4\u63a5\u8bbf\u95ee\u57df\u63a7\u5236\u5668<\/td>\n\u9ad8\u7684<\/td>\n\u4e2d\u7b49\u7684<\/td>\n<\/tr>\n
          \u79bb\u7ebf\u653b\u51fb<\/td>\n\u8bbf\u95ee\u5907\u4efd\u6216\u5feb\u7167<\/td>\n\u4e2d\u7b49\u7684<\/td>\n\u4f4e\u7684<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          \u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u7684\u4f7f\u7528\u65b9\u6cd5\u3001\u95ee\u9898\u53ca\u89e3\u51b3\u65b9\u6848<\/h2>\n

          \u91d1\u7968\u653b\u51fb\u7ed9\u7ec4\u7ec7\u5e26\u6765\u4e86\u4e25\u5cfb\u7684\u5b89\u5168\u6311\u6218\uff1a<\/p>\n

            \n
          1. \n

            \u8d8a\u6743\u5b58\u53d6<\/strong>\uff1a\u653b\u51fb\u8005\u53ef\u4ee5\u672a\u7ecf\u6388\u6743\u8bbf\u95ee\u654f\u611f\u6570\u636e\u548c\u8d44\u6e90\uff0c\u4ece\u800c\u5bfc\u81f4\u6f5c\u5728\u7684\u6570\u636e\u6cc4\u9732\u3002<\/p>\n<\/li>\n

          2. \n

            \u6743\u9650\u63d0\u5347<\/strong>\uff1a\u901a\u8fc7\u4f2a\u9020\u9ad8\u6743\u9650\u7968\u8bc1\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u63d0\u5347\u6743\u9650\u5e76\u63a7\u5236\u5173\u952e\u7cfb\u7edf\u3002<\/p>\n<\/li>\n

          3. \n

            \u7f3a\u4e4f\u68c0\u6d4b<\/strong>\uff1a\u8fd9\u6b21\u653b\u51fb\u7559\u4e0b\u7684\u75d5\u8ff9\u5f88\u5c11\uff0c\u56e0\u6b64\u5f88\u96be\u68c0\u6d4b\u548c\u9884\u9632\u3002<\/p>\n<\/li>\n<\/ol>\n

            \u4e3a\u4e86\u51cf\u8f7b\u91d1\u7968\u653b\u51fb\u7684\u98ce\u9669\uff0c\u7ec4\u7ec7\u5e94\u8003\u8651\u4ee5\u4e0b\u89e3\u51b3\u65b9\u6848\uff1a<\/p>\n

              \n
            1. \n

              \u6700\u4f4e\u6743\u9650<\/strong>\uff1a\u5b9e\u65bd\u6700\u5c0f\u6743\u9650\u6a21\u578b\u4ee5\u9650\u5236\u4e0d\u5fc5\u8981\u7684\u8bbf\u95ee\u5e76\u6700\u5927\u9650\u5ea6\u5730\u51cf\u5c11\u6210\u529f\u653b\u51fb\u7684\u5f71\u54cd\u3002<\/p>\n<\/li>\n

            2. \n

              \u5b9a\u671f\u76d1\u6d4b<\/strong>\uff1a\u6301\u7eed\u76d1\u63a7\u7f51\u7edc\u6d3b\u52a8\u662f\u5426\u5b58\u5728\u53ef\u7591\u884c\u4e3a\u548c\u5f02\u5e38\u3002<\/p>\n<\/li>\n

            3. \n

              \u51ed\u8bc1\u7ba1\u7406<\/strong>\uff1a\u52a0\u5f3a\u51ed\u8bc1\u7ba1\u7406\u5b9e\u8df5\uff0c\u4f8b\u5982\u5b9a\u671f\u8f6e\u6362\u5bc6\u94a5\u548c\u5bc6\u7801\u3002<\/p>\n<\/li>\n

            4. \n

              \u591a\u91cd\u8eab\u4efd\u9a8c\u8bc1<\/strong>\uff1a\u5f3a\u5236\u6267\u884c\u591a\u56e0\u7d20\u8eab\u4efd\u9a8c\u8bc1 (MFA) \u4ee5\u589e\u52a0\u989d\u5916\u7684\u5b89\u5168\u6027\u3002<\/p>\n<\/li>\n<\/ol>\n

              \u4e3b\u8981\u7279\u70b9\u53ca\u5176\u4ed6\u6bd4\u8f83<\/h2>\n

              \u4e0b\u9762\u662f\u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u4e0e\u7c7b\u4f3c\u672f\u8bed\u7684\u6bd4\u8f83\u8868\uff1a<\/p>\n\n\n\n\n\n\n\n
              \u5b66\u671f<\/th>\n\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n
              \u91d1\u7968\u653b\u51fb<\/td>\n\u5229\u7528 Kerberos \u7684\u5f31\u70b9\u8fdb\u884c\u672a\u7ecf\u6388\u6743\u7684\u8bbf\u95ee\u3002<\/td>\n<\/tr>\n
              \u94f6\u7968\u653b\u51fb<\/td>\n\u4f2a\u9020\u670d\u52a1\u7968\u8bc1\u4ee5\u8fdb\u884c\u672a\u7ecf\u6388\u6743\u7684\u8d44\u6e90\u8bbf\u95ee\u3002<\/td>\n<\/tr>\n
              \u4f20\u9012\u7968\u8bc1\u653b\u51fb<\/td>\n\u4f7f\u7528\u88ab\u76d7\u7684 TGT \u6216 TGS \u8fdb\u884c\u672a\u7ecf\u6388\u6743\u7684\u8bbf\u95ee\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

              \u672a\u6765\u7684\u89c2\u70b9\u548c\u6280\u672f<\/h2>\n

              \u968f\u7740\u6280\u672f\u7684\u53d1\u5c55\uff0c\u7f51\u7edc\u5a01\u80c1\u4e5f\u5728\u4e0d\u65ad\u589e\u52a0\u3002\u4e3a\u4e86\u5e94\u5bf9\u91d1\u7968\u653b\u51fb\u548c\u76f8\u5173\u5a01\u80c1\uff0c\u4ee5\u4e0b\u6280\u672f\u53ef\u80fd\u4f1a\u53d8\u5f97\u66f4\u52a0\u7a81\u51fa\uff1a<\/p>\n

                \n
              1. \n

                \u96f6\u4fe1\u4efb\u67b6\u6784<\/strong>\uff1a\u9ed8\u8ba4\u60c5\u51b5\u4e0b\u4e0d\u4fe1\u4efb\u4efb\u4f55\u7528\u6237\u6216\u8bbe\u5907\u7684\u5b89\u5168\u6a21\u578b\uff0c\u9700\u8981\u4e0d\u65ad\u9a8c\u8bc1\u8eab\u4efd\u548c\u8bbf\u95ee\u6743\u9650\u3002<\/p>\n<\/li>\n

              2. \n

                \u884c\u4e3a\u5206\u6790<\/strong>\uff1a\u5148\u8fdb\u7684\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\uff0c\u53ef\u8bc6\u522b\u5f02\u5e38\u884c\u4e3a\u548c\u51ed\u8bc1\u4f2a\u9020\u7684\u6f5c\u5728\u8ff9\u8c61\u3002<\/p>\n<\/li>\n

              3. \n

                \u589e\u5f3a\u52a0\u5bc6<\/strong>\uff1a\u66f4\u5f3a\u5927\u7684\u52a0\u5bc6\u65b9\u6cd5\uff0c\u9632\u6b62\u8eab\u4efd\u9a8c\u8bc1\u6750\u6599\u88ab\u8f7b\u6613\u63d0\u53d6\u3002<\/p>\n<\/li>\n<\/ol>\n

                \u4ee3\u7406\u670d\u52a1\u5668\u5982\u4f55\u88ab\u5229\u7528\u6216\u4e0e\u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u5173\u8054<\/h2>\n

                \u4ee3\u7406\u670d\u52a1\u5668\uff08\u4f8b\u5982 OneProxy \u63d0\u4f9b\u7684\u4ee3\u7406\u670d\u52a1\u5668\uff09\u5728\u7f51\u7edc\u5b89\u5168\u4e2d\u8d77\u7740\u81f3\u5173\u91cd\u8981\u7684\u4f5c\u7528\u3002\u867d\u7136\u4ee3\u7406\u670d\u52a1\u5668\u672c\u8eab\u5e76\u4e0d\u76f4\u63a5\u53c2\u4e0e\u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\uff0c\u4f46\u5b83\u4eec\u53ef\u4ee5\u901a\u8fc7\u4ee5\u4e0b\u65b9\u5f0f\u5e2e\u52a9\u589e\u5f3a\u5b89\u5168\u6027\uff1a<\/p>\n

                  \n
                1. \n

                  \u4ea4\u901a\u5de1\u68c0<\/strong>\uff1a\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u68c0\u67e5\u7f51\u7edc\u6d41\u91cf\uff0c\u68c0\u6d4b\u5e76\u963b\u6b62\u53ef\u7591\u6d3b\u52a8\u3002<\/p>\n<\/li>\n

                2. \n

                  \u8bbf\u95ee\u63a7\u5236<\/strong>\uff1a\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u5f3a\u5236\u8bbf\u95ee\u63a7\u5236\uff0c\u9632\u6b62\u672a\u7ecf\u6388\u6743\u7684\u7528\u6237\u8bbf\u95ee\u654f\u611f\u8d44\u6e90\u3002<\/p>\n<\/li>\n

                3. \n

                  \u8fc7\u6ee4<\/strong>\uff1a\u4ee3\u7406\u53ef\u4ee5\u8fc7\u6ee4\u548c\u963b\u6b62\u6076\u610f\u6d41\u91cf\uff0c\u51cf\u5c11\u6f5c\u5728\u6f0f\u6d1e\u7684\u653b\u51fb\u9762\u3002<\/p>\n<\/li>\n<\/ol>\n

                  \u76f8\u5173\u94fe\u63a5<\/h2>\n

                  \u6709\u5173\u91d1\u7968\u653b\u51fb\u53ca\u76f8\u5173\u4e3b\u9898\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u8bf7\u53c2\u9605\u4ee5\u4e0b\u8d44\u6e90\uff1a<\/p>\n

                    \n
                  1. MITRE ATT&CK \u2013 \u9ec4\u91d1\u7968\u8bc1<\/a><\/li>\n
                  2. Microsoft \u5173\u4e8e Golden Ticket \u7684\u5b89\u5168\u516c\u544a<\/a><\/li>\n
                  3. SANS \u7814\u7a76\u6240 \u2013 \u9ec4\u91d1\u7968\u8bc1\u653b\u51fb\u89e3\u6790<\/a><\/li>\n
                  4. Mimikatz GitHub \u5b58\u50a8\u5e93<\/a><\/li>\n<\/ol>\n

                    \u8bf7\u8bb0\u4f4f\uff0c\u4fdd\u6301\u77e5\u60c5\u548c\u4e3b\u52a8\u6027\u662f\u4fdd\u62a4\u60a8\u7684\u7ec4\u7ec7\u514d\u53d7\u8bf8\u5982\u91d1\u7968\u653b\u51fb\u4e4b\u7c7b\u7684\u590d\u6742\u7f51\u7edc\u5a01\u80c1\u7684\u5173\u952e\u3002\u5b9a\u671f\u8fdb\u884c\u5b89\u5168\u8bc4\u4f30\u3001\u5458\u5de5\u57f9\u8bad\u548c\u91c7\u7528\u6700\u4f73\u5b9e\u8df5\u662f\u4fdd\u62a4\u60a8\u7684\u7f51\u7edc\u548c\u6570\u636e\u7684\u91cd\u8981\u6b65\u9aa4\u3002<\/p>","protected":false},"featured_media":477359,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477358","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about Golden Ticket Attack: Unraveling the Dark Secrets of Credential Forgery<\/mark>","faq_items":[{"question":"What is the Golden Ticket Attack, and how does it work?","answer":"

                    The Golden Ticket Attack is a sophisticated cyber attack that exploits weaknesses in Microsoft's Active Directory infrastructure. It allows attackers to forge Kerberos tickets, granting them unauthorized access to a network. Attackers gain administrative access to a domain controller, extract authentication material, and then forge a long-lasting ticket with arbitrary user privileges, providing persistent access to the network.<\/p>"},{"question":"Who discovered the Golden Ticket Attack?","answer":"

                    The Golden Ticket Attack was first discovered and publicly revealed by security researcher Benjamin Delpy in 2014.<\/p>"},{"question":"What are the key features of the Golden Ticket Attack?","answer":"

                    The Golden Ticket Attack offers persistence, elevation of privilege, lateral movement, and stealth. Its long-lasting forged ticket grants attackers prolonged access to the network, allowing them to escalate privileges and move laterally across systems with little trace.<\/p>"},{"question":"Are there different types of Golden Ticket Attacks?","answer":"

                    Yes, there are two primary types. One involves stealing authentication material directly from a domain controller, while the other is an offline attack that extracts the necessary material from backups or domain snapshots.<\/p>"},{"question":"How can organizations defend against Golden Ticket Attacks?","answer":"

                    To mitigate the risk, organizations should implement least-privilege access, regularly monitor network activities, strengthen credential management, and enforce multi-factor authentication (MFA).<\/p>"},{"question":"What is the difference between Golden Ticket Attack, Silver Ticket Attack, and Pass-the-Ticket Attack?","answer":"

                    While all three attacks involve exploiting Kerberos weaknesses, the Golden Ticket Attack forges Kerberos tickets for unauthorized access. The Silver Ticket Attack, on the other hand, forges service tickets, and Pass-the-Ticket Attack uses stolen tickets for unauthorized access.<\/p>"},{"question":"What are the future perspectives and technologies to counter such attacks?","answer":"

                    Technologies like Zero Trust Architecture, behavioral analytics, and enhanced encryption may become prominent to combat Golden Ticket Attacks and related threats in the future.<\/p>"},{"question":"How can proxy servers help in dealing with Golden Ticket Attacks?","answer":"

                    Proxy servers can enhance security by inspecting network traffic, enforcing access controls, and filtering malicious traffic, reducing the attack surface for potential exploits.<\/p>"},{"question":"Where can I find more information about Golden Ticket Attacks?","answer":"

                    For more information about Golden Ticket Attacks and related topics, you can refer to the links provided below:<\/p>

                    1. MITRE ATT&CK - Golden Ticket<\/a><\/li>
                    2. Microsoft Security Advisory on Golden Ticket<\/a><\/li>
                    3. SANS Institute - Golden Ticket Attack Explained<\/a><\/li>
                    4. Mimikatz GitHub Repository<\/a><\/li><\/ol>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477358","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477358\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media\/477359"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media?parent=477358"}],"curies":[{"name":"\u53ef\u6e7f\u6027\u7c89\u5242","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}