📚
【MOC】活动目录

1. MOC

📂 未分类

📄 文件名15📅 创建时间🏷️ 标签
钻石票据&蓝宝石票据2025-03-14 21:19#AD域, #内网安全, #黄金票据, #白银票据, #钻石票据, #蓝宝石票据, #小迪安全学习笔记
CDN绕过技巧2025-03-14 21:19#CDN, #信息收集
CTF中各种花式绕过2025-03-14 21:19#ctf, #Bypass
HasSession2025-03-14 21:19#HasSession, #域渗透, #Bloodhound分析
SIDHistory2025-03-14 21:19#域渗透
Bypass rbash2025-03-14 21:19#rbash, #shell
Redis dll劫持2025-03-14 21:19#dll劫持
SeLoadDriverPrivilege2025-03-14 21:19#SeLoadDriverPrivilege, #windows提权
代理池搭建与爆破2025-03-14 21:19#隧道代理, #代理池, #爆破
默认受保护组2025-03-14 21:19#默认受保护组
水坑攻击2025-04-27 22:29#水坑攻击, #权限维持
SNMP利用2025-08-04 23:38#SNMP
【收集】2025-09-21 00:06#input
AD域环境搭建2026-01-25 19:30#环境搭建
Active Directory Overview2026-03-06 23:27#AD

📁 6-补充

📄 文件名20📅 创建时间🏷️ 标签
1.LSA、SAM、NTDS区别2025-06-26 18:46#渗透姿势库
2.活动目录2025-06-28 13:03#AD域
kerberos web Authentication2025-10-01 19:59#kerberos, #web
firefox 配置 negotiate-auth2025-10-01 20:24#negotiate-auth, #kerberos, #firefox
SPN2025-10-12 20:58#SPN
evil-winrm2025-10-24 23:26#winRM
evil-winrm-py2025-10-24 23:51#evil-winrm
Windows Permission Inheritance2025-10-26 01:40#windows, #DACL, #inhertance
Volume Shadow Copies2025-10-28 00:29#SecretsDump, #VolumeShadowCopies
WSL2025-11-01 01:47#WSL
Erlang2025-11-02 22:31#erlang, #EPMD
NTFS隐写2025-11-19 23:24#MISC, #NTFS隐写
GPP Password2025-11-20 00:05#GPP_Password
Microsoft Access2025-11-22 00:08
Linux SSSD2026-01-04 23:43#LInux_SSSD, #krb5_keytab
pyc poisoning2026-01-13 14:13#PYC_Poisoning, #权限维持
Shell Arithmetic Command Injection2026-01-13 14:26#Command_Injection, #shell
Python exploit2026-01-14 22:49#python, #hijacking, #pyc, #PYC_Poisoning
如何把本地计算机加入域2026-01-16 20:35#AD域
LSASS2026-04-19 17:30#LSA, #LSASS, #凭证转储

📁 7-sudo提权

📄 文件名2📅 创建时间🏷️ 标签
1.Mosh2025-08-05 00:25#Mosh
2.npbackup-cli2025-08-20 00:12#npbackup-cli

📁 ADCS

📄 文件名9📅 创建时间🏷️ 标签
ADCS介绍2025-03-14 21:19#域渗透, #证书, #ADCS
1.Certificate templates2025-05-25 23:58
2.Certificate authority（CA）2025-05-25 23:59
3.Access controls(访问控制）2025-05-25 23:59
4.Unsigned endpoints(未签名端点)2025-05-26 00:00
Certifried2025-05-26 00:01
【MOC】ADCS2026-03-10 12:37#moc, #ADCS
ADCS Enumeration2026-03-10 15:31#ADCS
证书映射2026-04-21 22:24#证书映射, #ADCS

📁 ADCS/ESC

📄 文件名12📅 创建时间🏷️ 标签
ESC162025-05-26 00:03#ADCS, #ESC16
ESC152025-06-27 19:52#ADCS, #ESC15
ESC142025-07-08 11:18#ADCS, #ESC14
ESC102025-07-21 17:12#ESC10, #ADCS
ESC42025-10-13 17:00#ESC4, #ADCS
ESC52025-10-13 17:00#ESC5, #ADCS
ESC62025-10-13 17:04#ESC6, #ADCS
ESC72025-10-13 17:04#ESC7, #ADCS
ESC82025-10-13 17:04#ADCS, #ESC8
ESC112025-10-13 17:06#ESC11, #ADCS
ESC172026-04-19 23:41#input
ESC132026-04-26 11:52#ESC13, #ADCS

📁 ADCS/ESC/滥用证书模板

📄 文件名4📅 创建时间🏷️ 标签
ESC32025-06-25 15:31#ESC3, #ADCS
ESC92025-07-07 23:04#ADCS, #ESC9
ESC12025-08-08 00:19#ESC1, #ADCS, #SAN
ESC22025-10-13 16:55#ESC2, #ADCS

📁 DC-Vuln

📄 文件名4📅 创建时间🏷️ 标签
NoPAC2026-02-22 21:00#NoPAC, #SamAccountName_Spoofing
【MOC】DC_Vuln2026-03-13 10:25#moc, #域控漏洞
PrintNightmare2026-03-13 12:19#CVE, #windows提权, #CVE-2021-34527, #打印机
PetitPotam2026-03-13 20:10#PetitPotam

📁 Evasion

📄 文件名1📅 创建时间🏷️ 标签
AppLocker2025-03-14 21:19#AppLocker, #应用程序控制策略

📁 LDAP

📄 文件名5📅 创建时间🏷️ 标签
LDAP Enum2025-05-09 23:43#LDAP, #信息收集, #域渗透
LDAP Anonymous Bind2026-03-03 00:14#LDAP_Anonymous_Bind
LDAP Signing&Channel Binding2026-03-03 21:07#LDAP
LDAP Overview2026-03-06 23:24#LDAP
【MOC】LDAP2026-03-07 13:11#moc

📁 Movement

📄 文件名4📅 创建时间🏷️ 标签
PTH2025-03-14 21:19#PTH
WSUS2026-01-04 01:41#LPE, #WSUS
AutoLogon2026-01-27 14:47#AutoLogon
RODC2026-04-06 23:19

📁 Movement/1-Credentials

📄 文件名3📅 创建时间🏷️ 标签
DCSync2025-03-14 21:19#域渗透, #DCSync
SAM & LSA secrets2025-03-14 21:19#域渗透
Secrets dump2025-03-15 16:31#域渗透

📁 Movement/1-Credentials/1-Dumping

📄 文件名1📅 创建时间🏷️ 标签
DPAPI2025-05-21 22:10#域渗透, #内网凭证, #DPAPI

📁 Movement/2-MITM coerced-auths

📄 文件名9📅 创建时间🏷️ 标签
00-MITM coerced-auths(中间人攻击与强制认证）2025-05-25 23:25#域渗透, #MITM
1.arp欺骗2025-05-25 23:28
2.DNS欺骗2025-05-25 23:29
3.DHCPv6欺骗2025-05-25 23:29
4.WSUS 欺骗2025-05-25 23:29
LLMNR NBT-NS mDNS Response Spoofing2025-05-25 23:29#LLMNR/NBT-NS_Resonse_spoofing, #LLMNR
ADIDNS poisoning2025-05-25 23:30#ADIDNS_poisoning
7.WPAD欺骗2025-05-25 23:30
【MOC】MITM2026-03-08 19:45#moc

📁 Movement/4-Kerberos

📄 文件名21📅 创建时间🏷️ 标签
11.Pass the Certificate2025-03-14 21:19#PTC
AS-REPRoasting2025-03-14 21:19#AS-REPRoasting, #域渗透, #Kerberoast, #Targeted_AS-REPRoasting
kerbeos Enumeration2025-03-14 21:19#域渗透, #横向移动, #kerbrute爆破, #Kerberos
Kerberoasting2025-03-14 21:19#域渗透, #SPN, #Kerberoast, #Kerberoast_without_pass
Kerberos原理2025-03-14 21:19#kerberos, #域渗透, #票据, #Kerberos
1.Pre-auth bruteforce2025-05-25 23:33
2.Pass the key2025-05-25 23:34
3.Overpass the hash2025-05-25 23:35
Pass-the-Ticket2025-05-25 23:35
5.Pass the cache2025-05-25 23:36
Kerberos Relay2025-05-25 23:36#Kerberos, #Kerberos_Relay
Shadow Credentials2025-05-25 23:47#msDS-KeyCredentialLink, #Shadow_Credentials
10.UnPAC the hash2025-05-25 23:48
12.sAMAccountName spoofing2025-05-25 23:50
13.SPN-jacking2025-05-25 23:51
Targeted Kerberoasting2025-05-25 23:55#Kerberos, #kerberoasting, #DACL_Abuse, #kerberos
Kerberos 'Double Hop'2026-03-04 21:46#Kerberos_Double_Hop, #PSCredential, #PSSession
Hardening Kerberos2026-03-06 16:48#Kerberos, #AS-REPRoasting, #kerberoasting, #Delegation, #GoldTicket, #SilverTicket, #pass-the-Ticket
Kerberos Detection2026-03-06 18:48#kerberos
【MOC】Kerberos2026-03-06 23:17#moc, #kerberos
Key List Attack2026-04-07 09:45#Key_List_Attack

📁 Movement/4-Kerberos/Delegations

📁 Movement/4-Kerberos/Forged tickets

📄 文件名6📅 创建时间🏷️ 标签
Golden Ticket2025-05-12 12:05#kerberos, #域渗透, #票据, #权限维持, #横向移动
silver ticket2025-05-12 12:16#横向移动, #权限维持, #域渗透, #票据
3.钻石票据2025-05-25 23:38
4.蓝宝石票据2025-05-25 23:39
RODC黄金票据2025-05-25 23:40#RODC, #黄金票据, #RODC黄金票据, #Key_List_Attack
MS14-0682025-05-25 23:42#kerberos, #trcket

📁 Movement/5-DACL abuse

📄 文件名18📅 创建时间🏷️ 标签
AddMember2025-05-25 23:55#AD域
ForceChangePassword2025-05-25 23:55#AD域, #DACL_Abuse
4.ReadLAPSPassword2025-05-25 23:55#ReadLAPSPassword
ReadGMSAPassword2025-05-25 23:55#gMSA
WriteOwner2025-05-25 23:56#DACL_Abuse, #grant-ownership, #Ownership, #WriteOwner
7.Grant rights2025-05-25 23:56
8.Logon script2025-05-25 23:56
9.Rights on RODC object2025-05-25 23:56
GPOAbuse2025-07-07 11:43#GPOAbuse
11.All attributes2025-07-20 21:34#attributes, #DACL_Abuse, #手动枚举
GenericWrite2025-10-22 01:10#DACL_Abuse, #DACL, #GenericWrite
nTSecurityDescriptor2025-10-24 10:48#ACL, #windows
Write Dacl2025-10-25 01:28#DACL
UPN Spoofing2026-01-19 16:29#UPN_Spoofing, #LInux_SSSD, #kerberos, #GSSAPI, #SSPI, #DACL_Abuse
Write Property2026-03-05 21:10#input
【MOC】DACL Abuse2026-03-08 19:43#moc, #DACL_Abuse, #DACL
WriteAccountRestrictions2026-04-06 09:51#input
Login Script2026-04-06 10:02#Login_Script, #scriptPath, #DACL_Abuse

📁 Movement/6-Netlogon

📄 文件名1📅 创建时间🏷️ 标签
Zerologon2025-05-11 22:06#zerologon, #横向移动, #域渗透, #netlogon

📁 Movement/8-组策略

📄 文件名1📅 创建时间🏷️ 标签
组策略2025-05-25 23:57

📁 Movement/Exchange

📄 文件名5📅 创建时间🏷️ 标签
Exchange 枚举2026-03-16 18:25#Exchange
Exchange 漏洞2026-03-16 22:25#Exchange, #ProxyShell
Exchange 钓鱼2026-03-16 22:44#Exchange, #钓鱼
Exchange防御2026-03-16 23:05#Exchange
【MOC】Exchange2026-03-17 15:00#moc, #Exchange

📁 Movement/MSSQL

📄 文件名8📅 创建时间🏷️ 标签
impacket-mssqlclient2025-10-08 22:21#impacket, #MSSQL
MSSQL introduciton2026-03-14 16:19#MSSQL
MSSQL提权2026-03-15 01:39#MSSQL, #PrivilegeEscalation
MSSQL命令执行2026-03-15 02:39#MSSQL, #OLE
MSSQL 横向移动2026-03-16 13:45#MSSQL
PowerUpSQL2026-03-16 15:42#MSSQL, #PowerUpSQL
MSSQL 防御2026-03-16 16:25
【MOC】MSSQL2026-03-16 18:24#moc, #MSSQL

📁 Movement/NTLM Relay

📄 文件名3📅 创建时间🏷️ 标签
【MOC】NTLM Relay2026-03-08 19:47#moc, #NTLM_Relay
NTLM Authentication Protocol2026-03-10 17:25#input
NTLM Realy Introduction2026-03-10 20:36#NTLM_Relay, #NTLM_Reflection

📁 Movement/NTLM Relay/Authentication Coercion

📁 Movement/NTLM Relay/NTLM Relay Attack

📁 Movement/Remote Service

📄 文件名4📅 创建时间🏷️ 标签
【MOC】Remote Service2026-03-12 16:12#moc, #Remote_Service
RDP2026-03-12 16:13#Remote_Service, #RDP
SMB2026-03-12 17:02#SMB
WMI2026-03-12 19:04#WMI, #Remote_Service

📁 Movement/SCCM

📄 文件名5📅 创建时间🏷️ 标签
SCCM介绍2026-03-17 15:00#SCCM
SCCM利用2026-03-17 22:32#SCCM
SCCM站点接管2026-03-17 23:40#SCCM, #MSSQL, #NTLM_Relay
SCCM后渗透2026-03-18 19:15#SCCM
SCCM防御2026-03-18 19:53#SCCM

📁 Movement/Trusts

📄 文件名4📅 创建时间🏷️ 标签
AD Trusts Expliot2025-10-08 21:39#AD域, #Trusts
Mssql_links Abuse in AD Trusts2025-10-08 21:59#MSSQL, #Trusts
【MOC】Trusts2026-03-07 13:34#moc, #域信任
防御域信任攻击2026-03-09 22:31#Detection, #Trusts

📁 Movement/Trusts/Cross Forest

📁 Movement/Trusts/Enum

📄 文件名2📅 创建时间🏷️ 标签
Trusts Overview2026-03-07 13:35#域信任, #Get-ADTrust
Trusts Enum2026-03-07 13:45#Trusts

📁 Movement/Trusts/Intra Forest

📁 Privilege Escalation/User Rights

📁 Reconnaissance

📄 文件名18📅 创建时间🏷️ 标签
Domain Recon2025-05-09 23:41#信息收集, #内网安全, #域渗透
DHCP2025-05-09 23:42#DHCP, #信息收集, #域渗透
DNS2025-05-09 23:43#信息收集, #域渗透, #DNS
NBT-NS2025-05-09 23:43#信息收集, #域渗透, #NBT-NS
Responder2025-05-09 23:43#域渗透, #Responder, #NTLM_Relay
BloodHound2025-05-09 23:44#域渗透, #信息收集, #Bloodhound分析
MS-RPC2025-05-09 23:45#MS-RPC, #信息收集, #域渗透, #RID-Cycling, #IObjectExporter
Enum4linux2025-05-09 23:45#Enum4linux, #域渗透, #信息收集
Password policy2025-05-09 23:45#信息收集, #域渗透, #密码策略
Common AD Ports2025-05-09 23:51#端口扫描, #信息收集, #域渗透
NFS2025-07-20 22:55#NFS, #信息收集
SMB Null Session2025-08-07 22:13#SMB, #信息收集, #SMB空会话
ISAKMP udp(500)2025-09-21 11:35#ISAKMP, #IPSEC, #IKE
Pre-Windows 2000 computers2026-03-01 14:05#Pre-Windows2000, #pre2k
SMB Signing2026-03-03 21:06#SMB
MachineAccountQuota2026-03-03 21:09#MachineAccountQuota
Domain Controller Coercion2026-03-03 23:18#PrinterBug, #PetitPotam, #ShadowCoerce, #DFSCoerce
SMB Shares2026-03-03 23:28#SMB_Shares, #SMB