https://souljian.cn/tags/%E6%9D%83%E9%99%90%E5%88%86%E6%9E%90/Recent content in 权限分析 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088165/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088165/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>域渗透测试只在授权测试环境进行。</p> <h2 id="一bloodhound-拓扑">一、BloodHound 拓扑 </h2><img src="https://souljian.cn/img/bloodhound-topology.svg" alt="BloodHound 域关系分析" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 收集域数据 → ② 导入 BloodHound → ③ 查找路径 → ④ 权限提升 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二常用查询">二、常用查询 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">Find Shortest Paths to Domain Admins </span></span><span class="line"><span class="cl">Find Users with Privileged Sessions </span></span><span class="line"><span class="cl">Find Computers with Unconstrained Delegation </span></span><span class="line"><span class="cl">Find Trusts to External Domains </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">最小权限原则 · 禁止过度授权 </span></span><span class="line"><span class="cl">禁用 unconstrained delegation </span></span><span class="line"><span class="cl">定期审计 AD 权限 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>BloodHound 是域渗透的核心工具。通过可视化域关系，快速找到从低权限到 Domain Admin 的最短攻击路径。</p>