{"id":20924,"date":"2025-11-15T15:50:43","date_gmt":"2025-11-15T12:20:43","guid":{"rendered":"https:\/\/liangroup.net\/blog\/?p=20924"},"modified":"2025-11-15T12:28:09","modified_gmt":"2025-11-15T08:58:09","slug":"credential-dumping-with-netexec-nxc","status":"publish","type":"post","link":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/","title":{"rendered":"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc)"},"content":{"rendered":"<p><span style=\"font-size: 10pt\">\u062f\u0631 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0645\u062f\u0631\u0646\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a Active Directory \u0627\u0631\u0632\u0634\u0645\u0646\u062f\u062a\u0631\u06cc\u0646 \u0647\u062f\u0641 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u0686\u0647 \u06cc\u06a9 Red Teamer \u0628\u0627\u0634\u06cc\u062f\u060c \u0686\u0647 \u06cc\u06a9 \u0645\u062a\u062e\u0635\u0635 \u062a\u0633\u062a\u200c\u0646\u0641\u0648\u0630 \u06cc\u0627 \u06cc\u06a9 \u0645\u062a\u062e\u0635\u0635 \u0634\u0628\u06cc\u0647\u200c\u0633\u0627\u0632\u06cc \u062d\u0645\u0644\u0627\u062a \u060c \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0631\u0627\u06cc \u00a0Privilege Escalation \u00a0(\u0628\u0627\u0644\u0627 \u0628\u0631\u062f\u0646 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc)\u060c Lateral Movement (\u062d\u0631\u06a9\u0627\u062a \u062c\u0627\u0646\u0628\u06cc) \u0648 Persistence (\u067e\u0627\u06cc\u062f\u0627\u0631\u06cc) \u0636\u0631\u0648\u0631\u06cc \u0627\u0633\u062a. \u0627\u0645\u0627 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u062f\u0631 \u0633\u0646\u0627\u0631\u06cc\u0648\u0647\u0627\u06cc \u0648\u0627\u0642\u0639\u06cc \u0686\u06af\u0648\u0646\u0647 \u0627\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u061f<\/span><\/p>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646\u062c\u0627 \u0627\u0633\u062a \u06a9\u0647 NetExec \u200f(nxc) \u0648\u0627\u0631\u062f \u0645\u06cc\u200c\u0634\u0648\u062f \u2014 \u06cc\u06a9 Framework \u0642\u062f\u0631\u062a\u0645\u0646\u062f \u0648 \u0645\u062f\u0631\u0646 \u062f\u0631 \u062d\u0648\u0632\u0647 Post-Exploitation \u0648 \u062c\u0627\u0646\u0634\u06cc\u0646 \u067e\u06cc\u0634\u0631\u0641\u062a\u0647 CrackMapExec NetExec \u0628\u0631\u0627\u06cc \u062e\u0648\u062f\u06a9\u0627\u0631\u0633\u0627\u0632\u06cc \u0648 \u062a\u0633\u0647\u06cc\u0644 \u0641\u0631\u0627\u06cc\u0646\u062f \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0633\u0627\u062e\u062a\u0647 \u0634\u062f\u0647 \u0648 \u0622\u0646 \u0631\u0627 \u0628\u0647 \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0624\u062b\u0631\u062a\u0631\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627 \u0628\u0631\u0627\u06cc Red Team\u0647\u0627 \u0648 \u0645\u062a\u062e\u0635\u0635\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a \u06a9\u0647 \u062f\u0631 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc Windows \u0648 Active Directory \u0641\u0639\u0627\u0644\u06cc\u062a \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.<\/span><\/p>\n<p><span style=\"font-size: 10pt\"><strong>NetExec<\/strong><strong>\u200f<\/strong><strong>(nxc)<\/strong><strong> \u0686\u06cc\u0633\u062a\u061f<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt\">NetExec \u06cc\u06a9 \u0627\u0628\u0632\u0627\u0631 Post-Exploitation \u0647\u0645\u0647\u200c\u06a9\u0627\u0631\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0628\u0631\u0627\u06cc \u0639\u0645\u0644\u06cc\u0627\u062a \u0634\u0628\u06a9\u0647 \u062f\u0627\u062e\u0644\u06cc \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a. \u0628\u0627 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u06af\u0633\u062a\u0631\u062f\u0647 \u0627\u0632 SMB\u060c WinRM \u0648 \u067e\u0631\u0648\u062a\u06a9\u0644\u200c\u0647\u0627\u06cc \u062f\u06cc\u06af\u0631\u060c \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u0627\u0632 \u0645\u0646\u0627\u0628\u0639 \u0645\u062e\u062a\u0644\u0641\u06cc \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u06a9\u0646\u0646\u062f\u060c \u0627\u0632 \u062c\u0645\u0644\u0647:<\/span><\/p>\n<ul>\n<li><span style=\"font-size: 10pt\">\u062d\u0627\u0641\u0638\u0647 LSASS \u200f(\u0645\u062a\u0646\u200c\u0633\u0627\u062f\u0647 \u0648 NTLM hashes)<\/span><\/li>\n<li><span style=\"font-size: 10pt\">Windows Registry \u0648 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc Winlogon<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0645\u0631\u0648\u0631\u06af\u0631\u0647\u0627\u060c \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Wi-Fi \u0648 \u06a9\u0644\u0627\u06cc\u0646\u062a\u200c\u0647\u0627\u06cc SSH<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0631\u0645\u0632\u0647\u0627\u06cc LAPS \u0648 \u067e\u0627\u06cc\u06af\u0627\u0647\u200c\u062f\u0627\u062f\u0647 dit<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0627\u0633\u0631\u0627\u0631 gMSA \u200f(Group Managed Service Accounts)<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0634\u062e\u0635 \u062b\u0627\u0644\u062b \u0645\u0627\u0646\u0646\u062f \u200ePuTTY\u200e\u060c \u200emRemoteNG\u200e \u0648 \u200eNotepad++\u200e<\/span><\/li>\n<\/ul>\n<p><span style=\"font-size: 10pt\">\u062f\u0631 \u0627\u06cc\u0646 \u0631\u0627\u0647\u0646\u0645\u0627\u06cc \u0639\u0645\u0644\u06cc\u060c \u0645\u0627 \u06cc\u06a9 \u0641\u0631\u0622\u06cc\u0646\u062f Red Team \u0631\u0627 \u06af\u0627\u0645\u200c\u0628\u0647\u200c\u06af\u0627\u0645 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u0628\u0631 \u0631\u0648\u06cc SMB \u0634\u0628\u06cc\u0647\u200c\u0633\u0627\u0632\u06cc \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645 \u062a\u0627 \u0646\u0634\u0627\u0646 \u062f\u0647\u06cc\u0645 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0686\u06af\u0648\u0646\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u0627\u0632 \u06cc\u06a9 \u0645\u062d\u06cc\u0637 Active Directory \u0628\u0627 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0627\u0634\u062a\u0628\u0627\u0647 \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0647\u0631 \u0645\u0631\u062d\u0644\u0647 \u06cc\u06a9 \u062a\u0627\u06a9\u062a\u06cc\u06a9 \u0648\u0627\u0642\u0639\u06cc \u0631\u0627 \u06a9\u0647 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u062f\u0631 \u0639\u0645\u0644\u06cc\u0627\u062a \u0627\u0645\u0646\u06cc\u062a \u062a\u0647\u0627\u062c\u0645\u06cc \u062f\u06cc\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\"><strong>\u0627\u0647\u0645\u06cc\u062a \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 \u0628\u0631\u0627\u06cc <\/strong><strong>Red Team<\/strong><strong> \u0648 <\/strong><strong>Blue Team<\/strong><strong> \u0686\u06cc\u0633\u062a\u061f<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt\">\u0628\u0631\u0627\u06cc Red Team\u0647\u0627\u060c \u0627\u06cc\u0646 \u0631\u0627\u0647\u0646\u0645\u0627 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u0686\u06af\u0648\u0646\u0647 NetExec \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc\u200c\u0647\u0627\u06cc \u0636\u0639\u06cc\u0641 \u062f\u0631 \u0686\u0646\u062f \u062f\u0642\u06cc\u0642\u0647 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f\u061b \u0634\u0628\u06cc\u0647\u200c\u0633\u0627\u0632\u06cc \u0631\u0641\u062a\u0627\u0631\u0647\u0627\u06cc Post-Exploitation \u0648\u0627\u0642\u0639\u06cc \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0631\u0648\u0632\u0627\u0646\u0647 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\">\u0628\u0631\u0627\u06cc Blue Team \u0648 \u062a\u062d\u0644\u06cc\u0644\u06af\u0631\u0627\u0646 SOC\u060c \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 \u0646\u0642\u0627\u0637 \u062d\u06cc\u0627\u062a\u06cc \u0628\u0631\u0627\u06cc \u062a\u0634\u062e\u06cc\u0635 \u0648 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc\u200c\u0647\u0627\u06cc \u0627\u0634\u062a\u0628\u0627\u0647\u06cc \u06a9\u0647 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u0631\u0627 \u0628\u0631\u062c\u0633\u062a\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0627\u0632 \u062c\u0645\u0644\u0647:<\/span><\/p>\n<ul>\n<li><span style=\"font-size: 10pt\">\u0630\u062e\u06cc\u0631\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u062a\u0646\u200c\u0633\u0627\u062f\u0647<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0646\u0627\u062f\u0631\u0633\u062a \u0627\u0632 Service Account\u0647\u0627<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0636\u0639\u0641 \u062f\u0631 \u0631\u0639\u0627\u06cc\u062a \u0627\u0635\u0648\u0644 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0631\u062c\u06cc\u0633\u062a\u0631\u06cc \u0648 Wi-Fi<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0639\u0636\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0628\u06cc\u0634\u200c\u0627\u0632\u062d\u062f \u0645\u062c\u0627\u0632 \u062f\u0631 \u06af\u0631\u0648\u0647\u200c\u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u06cc (\u0645\u062b\u0644\u0627\u064b Backup Operators)<\/span><\/li>\n<\/ul>\n<p><span style=\"font-size: 10pt\"><strong>\u0641\u0647\u0631\u0633\u062a \u0645\u0637\u0627\u0644\u0628<\/strong><\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Dump Local SAM Hashes<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Test Hash as Login Credential<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Extract LSA Secrets<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Retrieve Winlogon Registration Data<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Dump DAPI Password Credentials<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Extract Credentials from LSASS via LSASSASSY<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Dumping LSASS Memory with nanodump Module<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Extracting Stored Credentials from mRemoteNG Configuration<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Retrieve PuTTY Private Key Files<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Extract Notepad++ Session Logs<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Retrieve PowerShell Command History<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Extract WinSCP Configuration Files<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Dumping VNC Passwords<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Extract Wi-Fi Profiles\/PSKs as Administrator<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Dumping Backup Operators Permission<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Dumping NTDS.dit Using an Authenticated User<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Extract gMSA Credentials<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Retrieve LAPS Password via NetExec (nxc)<\/span><\/p>\n<p style=\"text-align: left\"><span style=\"font-size: 10pt\">Mitigation<\/span><\/p>\n<p><span style=\"font-size: 10pt\"><strong>\u0622\u0645\u0627\u062f\u0647\u200c\u0627\u06cc\u062f \u0633\u0637\u062d \u0628\u0639\u062f\u06cc \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0631\u0645\u0632\u0639\u0628\u0648\u0631\u0647\u0627 \u0631\u0627 \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f\u061f<\/strong><\/span><\/p>\n<p><span style=\"font-size: 10pt\">\u0628\u06cc\u0627\u06cc\u06cc\u062f \u0648\u0627\u0631\u062f \u0645\u0631\u062d\u0644\u0647 NXC SMB Post-Access Enumeration \u0634\u0648\u06cc\u0645 \u0648 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u0628\u0647 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 Dump \u06a9\u0646\u06cc\u0645.<\/span><\/p>\n<p><span style=\"font-size: 10pt\"><strong>Dump<\/strong><strong> \u06a9\u0631\u062f\u0646 <\/strong><strong>Local SAM Hash<\/strong><strong> \u0647\u0627<\/strong><\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 \u2013sam<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0628\u0647 \u200enxc\u200e \u0627\u0639\u0644\u0627\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u0627\u0632 \u0637\u0631\u06cc\u0642 SMB \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0647\u062f\u0641 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u06a9\u0631\u062f\u0647 \u0648 NTLM password hash\u0647\u0627 \u0631\u0627 \u0627\u0632 \u067e\u0627\u06cc\u06af\u0627\u0647\u200c\u062f\u0627\u062f\u0647 \u0645\u062d\u0644\u06cc SAM \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u06a9\u0646\u062f\u061b \u067e\u0627\u06cc\u06af\u0627\u0647\u200c\u062f\u0627\u062f\u0647\u200c\u0627\u06cc \u06a9\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u06cc\u0648\u0632\u0631\u0647\u0627\u06cc \u062f\u0627\u062e\u0644\u06cc \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"alignnone  wp-image-20925\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/1-300x72.png\" alt=\"\" width=\"467\" height=\"112\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/1-300x72.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/1-1024x247.png 1024w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/1-768x185.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/1-150x36.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/1.png 1031w\" sizes=\"(max-width: 467px) 100vw, 467px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">\u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 SAM hash\u0647\u0627 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0645\u06a9\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0631\u0645\u0632\u0647\u0627\u06cc \u0639\u0628\u0648\u0631 \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0622\u0641\u0644\u0627\u06cc\u0646 \u06a9\u0631\u06a9 \u06a9\u0646\u0646\u062f\u060c \u062d\u0645\u0644\u0627\u062a Pass-the-Hash \u0631\u0627 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0627\u06a9\u0627\u0646\u062a\u200c\u0647\u0627\u06cc Local \u0645\u0634\u062a\u0631\u06a9 \u062f\u0627\u0631\u0646\u062f \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u0646\u062f\u060c \u0648 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u06cc\u0627 \u0627\u06cc\u062c\u0627\u062f \u0645\u062c\u062f\u062f \u0646\u0627\u0645\u200c\u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u06cc Local\u060c \u067e\u0627\u06cc\u062f\u0627\u0631\u06cc \u0631\u0627 \u062d\u0641\u0638 \u06a9\u0646\u0646\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\"><strong>\u062a\u0633\u062a\u200c\u06a9\u0631\u062f\u0646 <\/strong><strong>Hash<\/strong><strong> \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0648\u0631\u0648\u062f<\/strong><\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 --lsa<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NTLM hash \u0628\u0647\u200c\u062f\u0633\u062a\u200c\u0622\u0645\u062f\u0647\u060c \u0639\u0645\u0644\u06cc\u0627\u062a \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0631\u0627\u0647\u200c\u062f\u0648\u0631 \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0628\u0627 \u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0633\u0631\u0642\u062a\u200c\u0634\u062f\u0647\u060c \u0627\u0645\u06a9\u0627\u0646 \u062d\u0645\u0644\u0627\u062a\u06cc \u0645\u062b\u0644: Lateral Movement \u0648 Privilege Escalation \u0631\u0627 \u062f\u0631 \u0633\u0631\u0627\u0633\u0631 \u0634\u0628\u06a9\u0647 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u0633\u0627\u0632\u062f.<\/span><\/p>\n<p><img decoding=\"async\" class=\"alignnone  wp-image-20926\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/2-300x115.png\" alt=\"\" width=\"477\" height=\"183\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/2-300x115.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/2-768x294.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/2-150x57.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/2.png 789w\" sizes=\"(max-width: 477px) 100vw, 477px\" \/><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0627\u0633\u062a\u062e\u0631\u0627\u062c Secrets\u0647\u0627\u06cc \u0645\u0648\u062c\u0648\u062f \u062f\u0631 LSA<\/span><\/strong><\/p>\n<p><span style=\"font-size: 10pt\">LSA secrets \u062f\u0631 \u0645\u0631\u062d\u0644\u0647 Post-Exploitation \u0628\u0633\u06cc\u0627\u0631 \u0627\u0631\u0632\u0634\u0645\u0646\u062f \u0647\u0633\u062a\u0646\u062f\u060c \u0632\u06cc\u0631\u0627 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c Secret \u062d\u0633\u0627\u0628 \u0633\u0631\u0648\u06cc\u0633 \u0648 \u06a9\u0644\u06cc\u062f \u0631\u0645\u0632\u06af\u0634\u0627\u06cc\u06cc\u200c\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u062f\u06cc\u06af\u0631 \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u062f\u0631 \u0634\u0628\u06a9\u0647\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc\u060c \u0627\u06cc\u0646 Secrets \u0646\u0642\u0634 \u062d\u06cc\u0627\u062a\u06cc \u062f\u0631 \u0627\u0645\u06a9\u0627\u0646\u200c\u067e\u0630\u06cc\u0631 \u06a9\u0631\u062f\u0646 Lateral Movement \u0628\u06cc\u0646 \u0645\u0627\u0634\u06cc\u0646\u200c\u0647\u0627 \u0648 \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627 \u062f\u0627\u0631\u0646\u062f.<\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 --lsa<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0633\u067e\u0633 LSA secrets \u0631\u0627 \u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f\u061b \u0645\u0627\u0646\u0646\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0648 \u06a9\u0644\u06cc\u062f Service\u0647\u0627 \u06a9\u0647 \u0634\u0627\u0645\u0644 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0644\u0646\u062f\u0645\u062f\u062a \u0648 \u0631\u0645\u0632\u0647\u0627\u06cc \u0639\u0628\u0648\u0631 Service \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc\u200c\u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc Persistent \u0647\u0633\u062a\u0646\u062f.<\/span><\/p>\n<p><img decoding=\"async\" class=\"alignnone  wp-image-20927\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/3-300x68.png\" alt=\"\" width=\"481\" height=\"109\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/3-300x68.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/3-768x173.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/3-150x34.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/3.png 865w\" sizes=\"(max-width: 481px) 100vw, 481px\" \/><\/p>\n<p><span style=\"font-size: 10pt\"><strong>\u0628\u0627\u0632\u06cc\u0627\u0628\u06cc Winlogon Registration Data<\/strong><\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 -M reg-winlogon<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 \u200ereg-winlogon\u200e \u062f\u0631 NetExec \u0628\u0631\u0627\u06cc Query \u06af\u0631\u0641\u062a\u0646 \u0627\u0632 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc Registry \u0645\u0648\u062c\u0648\u062f \u062f\u0631 \u0645\u0633\u06cc\u0631<\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f\u061b \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u06a9\u0646\u062a\u0631\u0644\u200c\u06a9\u0646\u0646\u062f\u0647 \u0644\u0627\u06af\u06cc\u0646 \u062e\u0648\u062f\u06a9\u0627\u0631 \u062f\u0631 Windows \u0647\u0633\u062a\u0646\u062f. \u0645\u0642\u0627\u062f\u06cc\u0631 \u06a9\u0644\u06cc\u062f\u06cc \u0645\u0627\u0646\u0646\u062f \u200eAutoAdminLogon\u200e\u060c \u200eDefaultUsername\u200e \u0648 \u200eDefaultPassword\u200e \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u062a\u0646 \u0633\u0627\u062f\u0647 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u0646\u062f \u0648 \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 \u0622\u0646\u200c\u0647\u0627 \u0631\u0627 \u0628\u0647 \u06cc\u06a9 \u0647\u062f\u0641 \u0627\u0631\u0632\u0634\u0645\u0646\u062f \u0628\u0631\u0627\u06cc \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u062a\u0628\u062f\u06cc\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0628\u0647\u200c\u0648\u06cc\u0698\u0647 \u062f\u0631 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0627\u0634\u062a\u0628\u0627\u0647 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u0648 \u0642\u0627\u0628\u0644\u06cc\u062a \u0644\u0627\u06af\u06cc\u0646 \u062e\u0648\u062f\u06a9\u0627\u0631 \u0641\u0639\u0627\u0644 \u0627\u0633\u062a.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20928\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/4-300x64.png\" alt=\"\" width=\"502\" height=\"107\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/4-300x64.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/4-768x163.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/4-150x32.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/4.png 826w\" sizes=\"(max-width: 502px) 100vw, 502px\" \/><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u06a9\u0631\u062f\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 DPAPI<\/span><\/strong><\/p>\n<p><span style=\"font-size: 10pt\">DPAPI \u200f(Data Protection API) \u06cc\u06a9 \u0642\u0627\u0628\u0644\u06cc\u062a Windows \u0627\u0633\u062a \u06a9\u0647 Secrets \u06a9\u0627\u0631\u0628\u0631 \u0645\u0627\u0646\u0646\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0648\u0628\u060c \u0631\u0645\u0632\u0647\u0627\u06cc \u0639\u0628\u0648\u0631 \u0645\u0631\u0648\u0631\u06af\u0631\u0647\u0627\u060c Outlook\u060c RDP\u060c WiFi \u0648 \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 \u0648\u0631\u0648\u062f \u062f\u0627\u0645\u0646\u0647(Cached Domain Credentials) \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0627\u0645\u0646 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0622\u0646\u200c\u0647\u0627 \u0631\u0627 \u0628\u0627 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0645\u062e\u0635\u0648\u0635 \u06a9\u0627\u0631\u0628\u0631 \u06a9\u0647 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u062d\u0644\u06cc \u0630\u062e\u06cc\u0631\u0647 \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc \u0645\u06cc\u200c\u0646\u0645\u0627\u06cc\u062f.<\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 --dapi<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0633\u067e\u0633 \u0631\u0645\u0632\u0647\u0627\u06cc\u06cc \u0631\u0627 \u06a9\u0647 \u062a\u0648\u0633\u0637 \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc Legacy DAPI \u0630\u062e\u06cc\u0631\u0647 \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f\u061b \u0631\u0645\u0632\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc Windows \u06a9\u0647 \u0646\u0633\u0628\u062a \u0628\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0645\u0646\u0633\u0648\u062e\u200c\u0634\u062f\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0647\u0633\u062a\u0646\u062f\u060c \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u06cc\u06a9 \u0628\u0631\u062f\u0627\u0631\u062d\u0645\u0644\u0647 \u0628\u0631\u0627\u06cc Privilege Escalation \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20929\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/5-300x47.png\" alt=\"\" width=\"511\" height=\"80\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/5-300x47.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/5-1024x160.png 1024w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/5-768x120.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/5-150x23.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/5.png 1225w\" sizes=\"(max-width: 511px) 100vw, 511px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u0641\u0631\u0622\u06cc\u0646\u062f \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u0622\u0634\u06a9\u0627\u0631 \u0645\u06cc\u200c\u0633\u0627\u0632\u062f:<\/span><\/p>\n<ul>\n<li><span style=\"font-size: 10pt\">Dump \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647 \u0648\u06cc\u0646\u062f\u0648\u0632 (\u200fraj:Password@1)<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0648\u0631\u0648\u062f Facebook \u0627\u0632 \u0645\u0631\u0648\u0631\u06af\u0631 Microsoft Edge<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u0631\u0645\u0632\u0647\u0627\u06cc \u0639\u0628\u0648\u0631 LinkedIn \u0627\u0632 \u0645\u0631\u0648\u0631\u06af\u0631 Firefox<\/span><\/li>\n<\/ul>\n<p><span style=\"font-size: 10pt\">\u0646\u06a9\u062a\u0647: \u0627\u06cc\u0646 \u06cc\u06a9 \u06af\u0646\u062c\u06cc\u0646\u0647 Post-Exploitation \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f\u061b \u06a9\u0647 \u0627\u0645\u06a9\u0627\u0646 Lateral Movement\u060c Credential Chaining \u0648 Account Hijacking \u0631\u0627 \u062f\u0631 \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0627\u0633\u062a\u062e\u0631\u0627\u062c Credentials \u0627\u0632 \u0641\u0631\u0622\u06cc\u0646\u062f LSASS \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u0628\u0632\u0627\u0631 LSASSASSY<\/span><\/strong><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 -M lsassy<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 \u200elsassy\u200e \u062f\u0631 NetExec \u0628\u0631\u0627\u06cc \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u0633\u062a\u0642\u06cc\u0645 \u0627\u0632 LSASS \u200f(Local Security Authority Subsystem Service) \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f\u061b \u0641\u0631\u0622\u06cc\u0646\u062f\u06cc \u062d\u06cc\u0627\u062a\u06cc \u062f\u0631 Windows \u06a9\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0648\u0631\u0648\u062f\u0647\u0627 \u0648 \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0645\u0627\u0646\u0646\u062f Hash\u0647\u0627\u06cc \u06a9\u0644\u0645\u0627\u062a \u0639\u0628\u0648\u0631 \u0648 \u0628\u0644\u06cc\u0637\u200c\u0647\u0627\u06cc Kerberos \u0631\u0627 \u0628\u0631\u0639\u0647\u062f\u0647 \u062f\u0627\u0631\u062f. \u0627\u06cc\u0646 \u0645\u0627\u0698\u0648\u0644 \u0641\u0631\u0622\u06cc\u0646\u062f \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f Procdump via SMB\u060c \u062a\u0632\u0631\u06cc\u0642 \u200eComsvcs.dll\u200e \u0648 API\u0647\u0627\u06cc \u200eMiniDumpWriteDump\u200e \u062e\u0648\u062f\u06a9\u0627\u0631\u0633\u0627\u0632\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20930\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/6-300x42.png\" alt=\"\" width=\"521\" height=\"73\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/6-300x42.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/6-768x109.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/6-150x21.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/6.png 955w\" sizes=\"(max-width: 521px) 100vw, 521px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">LSASS \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0631\u0627 \u062f\u0631 \u062d\u0627\u0641\u0638\u0647 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0634\u0627\u0645\u0644 NTLM hash\u0647\u0627\u060c \u0631\u0645\u0632\u0647\u0627\u06cc \u0639\u0628\u0648\u0631 \u0645\u062a\u0646 \u0633\u0627\u062f\u0647 (\u062f\u0631 \u0635\u0648\u0631\u062a \u0641\u0639\u0627\u0644 \u0628\u0648\u062f\u0646 WDigest) \u060c \u0628\u0644\u06cc\u0637\u200c\u0647\u0627\u06cc Kerberos \u0648 \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u060c \u062f\u0633\u062a\u0631\u0633\u06cc Post-Exploitation \u0628\u0633\u06cc\u0627\u0631 \u0627\u0631\u0632\u0634\u0645\u0646\u062f\u06cc \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f\u061b \u0628\u0647\u200c\u0648\u06cc\u0698\u0647 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 Domain Admin \u06cc\u0627 \u0633\u0627\u06cc\u0631 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u0627\u0631\u0627\u06cc \u0627\u0645\u062a\u06cc\u0627\u0632 \u0628\u0627\u0644\u0627 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0648\u0631\u0648\u062f \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u0646\u062f.<\/span><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u062d\u0627\u0641\u0638\u0647\u0654 LSASS \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 nanodump<\/span><\/strong><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 -M nanodump<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 nanodump \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 NetExec \u0628\u0631\u0627\u06cc Dump \u06af\u0631\u0641\u062a\u0646 \u0627\u0632 \u0645\u062d\u062a\u0648\u0627\u06cc LSASS \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0631\u0627\u0647\u200c\u062f\u0648\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0641\u0631\u0622\u06cc\u0646\u062f \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u0628\u0632\u0627\u0631 NanoDump \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f\u061b \u06cc\u06a9 LSASS dumper \u0645\u062f\u0631\u0646 \u0648 \u0645\u062e\u0641\u06cc\u200c\u06a9\u0627\u0631 \u06a9\u0647 \u0628\u0631\u0627\u06cc \u062f\u0648\u0631 \u0632\u062f\u0646 \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u0646\u0646\u062f Windows Defender\u060c Anti-malware Scan Interface (AMSI) \u0648 \u0645\u062d\u062f\u0648\u062f\u06cc\u062a\u200c\u0647\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 LSASS \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a. \u062f\u0631 \u0627\u06cc\u0646 \u0631\u0648\u0634\u060c NanoDump \u0627\u0632 \u0637\u0631\u06cc\u0642 SMB \u0645\u0646\u062a\u0642\u0644 \u0648 \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062d\u0627\u0641\u0638\u0647 LSASS \u0631\u0627 \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0641\u0627\u06cc\u0644 dump \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u062d\u0644\u06cc \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u0646\u0645\u0627\u06cc\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20931\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/7-300x108.png\" alt=\"\" width=\"525\" height=\"189\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/7-300x108.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/7-768x276.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/7-150x54.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/7.png 1009w\" sizes=\"(max-width: 525px) 100vw, 525px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">NanoDump \u062f\u0631 \u0641\u0631\u0627\u06cc\u0646\u062f \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0633\u06cc\u0627\u0631 \u06a9\u0627\u0631\u0622\u0645\u062f \u0627\u0633\u062a\u060c \u0632\u06cc\u0631\u0627 \u0627\u0632 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u062a\u0648\u0633\u0637 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc AV\/EDR \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0645\u062d\u062f\u0648\u062f\u06cc\u062a\u200c\u0647\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0631\u0627 \u062f\u0648\u0631 \u0645\u06cc\u200c\u0632\u0646\u062f \u0648 \u06cc\u06a9 \u0641\u0627\u06cc\u0644 \u062a\u0645\u06cc\u0632 \u0628\u0627 \u0641\u0631\u0645\u062a .dmp \u0628\u0631\u0627\u06cc \u062a\u062d\u0644\u06cc\u0644 \u0622\u0641\u0644\u0627\u06cc\u0646 \u062a\u0648\u0644\u06cc\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0648\u06cc\u0698\u06af\u06cc\u200c\u0647\u0627 NanoDump \u0631\u0627 \u0646\u0633\u0628\u062a \u0628\u0647 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631\u060c \u0628\u0647 \u0631\u0648\u0634\u06cc \u0645\u062e\u0641\u06cc\u200c\u06a9\u0627\u0631\u0627\u0646\u0647\u200c\u062a\u0631 \u0648 \u0642\u0627\u0628\u0644\u200c\u0627\u0639\u062a\u0645\u0627\u062f\u062a\u0631 \u062a\u0628\u062f\u06cc\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\"><strong>\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u06a9\u0627\u0631\u0628\u0631\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 \u0627\u0632 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc mRemoteNG<\/strong><\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 -M mremoteng<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631\u060c \u0627\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 mRemoteNG \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f\u061b \u06cc\u06a9 \u0627\u0628\u0632\u0627\u0631 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0627\u062a\u0635\u0627\u0644 \u0631\u0627\u0647\u200c\u062f\u0648\u0631 \u06a9\u0647 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u062a\u0648\u0633\u0637 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f. \u0645\u0627\u0698\u0648\u0644 mremoteng \u062f\u0631 NetExec \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0645\u0627\u0646\u0646\u062f confCons.xml \u0631\u0627 \u062c\u0633\u062a\u200c\u0648\u062c\u0648 \u06a9\u0631\u062f\u0647\u060c \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 \u0631\u0627 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062b\u0627\u0628\u062a \u0648 \u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0634\u062f\u0647 \u0631\u0645\u0632\u06af\u0634\u0627\u06cc\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0622\u0646\u200c\u0647\u0627 \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u062a\u0646 \u0633\u0627\u062f\u0647 \u0628\u0631\u0627\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0628\u0639\u062f\u06cc \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20932\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/8-300x37.png\" alt=\"\" width=\"519\" height=\"64\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/8-300x37.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/8-1024x128.png 1024w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/8-768x96.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/8-150x19.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/8.png 1097w\" sizes=\"(max-width: 519px) 100vw, 519px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">\u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0627\u063a\u0644\u0628 \u0628\u0631\u0627\u06cc \u0633\u0647\u0648\u0644\u062a \u06a9\u0627\u0631\u060c \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0628\u0627 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0627\u0644\u0627 \u0631\u0627 \u062f\u0631 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a \u0646\u0634\u0633\u062a\u200c\u0647\u0627\u06cc \u0631\u0627\u0647\u200c\u062f\u0648\u0631 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u06cc\u0627 \u0631\u0645\u0632\u0647\u0627\u06cc \u0639\u0628\u0648\u0631 \u0631\u0627 \u062f\u0631 \u0686\u0646\u062f\u06cc\u0646 \u0633\u0631\u0648\u06cc\u0633 reuse \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u062f\u0631 \u0635\u0648\u0631\u062a \u06cc\u0627\u0641\u062a\u0646 mRemoteNG\u060c \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc dump\u200c\u0634\u062f\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0634\u0627\u0645\u0644 Domain Admins\u060c \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0633\u0631\u0648\u06cc\u0633 \u06cc\u0627 \u0633\u0627\u06cc\u0631 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u0627\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0627\u0644\u0627 \u0628\u0627\u0634\u062f\u060c \u06a9\u0647 \u0627\u0645\u06a9\u0627\u0646 lateral movement \u0641\u0648\u0631\u06cc \u0627\u0632 \u0637\u0631\u06cc\u0642 WinRM\u060c RDP \u06cc\u0627 SSH \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc PuTTY<\/span><\/strong><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 -M putty<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 putty \u062f\u0631 NetExec \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062e\u0635\u0648\u0635\u06cc SSH \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 \u062a\u0648\u0633\u0637 PuTTY \u06a9\u0647 \u06cc\u06a9 SSH client \u0631\u0627\u06cc\u062c \u062f\u0631 \u0645\u062d\u06cc\u0637 \u0648\u06cc\u0646\u062f\u0648\u0632 \u0627\u0633\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0645\u0627\u0698\u0648\u0644\u060c \u0647\u0645 \u0631\u062c\u06cc\u0633\u062a\u0631\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0631\u0627 \u062f\u0631 \u0645\u0633\u06cc\u0631<\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">HKCU\\Software\\SimonTatham\\PuTTY\\Sessions<\/pre>\n<p><span style=\"font-size: 10pt\">\u0648 \u0647\u0645 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 \u0631\u0648\u06cc \u062f\u06cc\u0633\u06a9 (\u06a9\u0647 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0627 \u0641\u0631\u0645\u062a .ppk \u0647\u0633\u062a\u0646\u062f) \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 hostname\u200c\u0647\u0627\u060c username\u200c\u0647\u0627 \u0648 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062e\u0635\u0648\u0635\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 (\u0686\u0647 \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc\u200c\u0634\u062f\u0647 \u0648 \u0686\u0647 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u062a\u0646 \u0633\u0627\u062f\u0647) \u0631\u0627 \u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20933\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/9-300x63.png\" alt=\"\" width=\"519\" height=\"109\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/9-300x63.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/9-768x162.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/9-150x32.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/9.png 970w\" sizes=\"(max-width: 519px) 100vw, 519px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">\u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0627\u0632 PuTTY \u0628\u0631\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a \u0633\u0631\u0648\u0631\u0647\u0627\u06cc Linux \u06cc\u0627 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0634\u0628\u06a9\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0648 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062e\u0635\u0648\u0635\u06cc \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0627 passphrase \u0636\u0639\u06cc\u0641 \u06cc\u0627 \u0628\u062f\u0648\u0646 passphrase \u0630\u062e\u06cc\u0631\u0647 \u0634\u062f\u0647 \u0628\u0627\u0634\u0646\u062f. \u0627\u06af\u0631 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc SSH \u062f\u0631 \u0686\u0646\u062f \u0645\u062d\u06cc\u0637 \u0645\u062e\u062a\u0644\u0641 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u062c\u062f\u062f \u0634\u062f\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631\u060c \u0628\u0647 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc SSH \u062f\u0633\u062a \u06cc\u0627\u0628\u062f.<\/span><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc PuTTY<\/span><\/strong><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 -M putty<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 putty \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 NetExec \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062e\u0635\u0648\u0635\u06cc SSH \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u062a\u0648\u0633\u0637 Putty (\u06a9\u0644\u0627\u06cc\u0646\u062a \u0645\u062d\u0628\u0648\u0628 SSH \u062f\u0631 \u0648\u06cc\u0646\u062f\u0648\u0632) \u0630\u062e\u06cc\u0631\u0647 \u0634\u062f\u0647\u200c\u0627\u0646\u062f. \u0627\u06cc\u0646 \u0641\u0631\u0622\u06cc\u0646\u062f \u0631\u062c\u06cc\u0633\u062a\u0631\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0631\u0627 \u062f\u0631 \u0645\u0633\u06cc\u0631<\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">HKCU\\Software\\SimonTatham\\PuTTY\\Sessions<\/pre>\n<p><span style=\"font-size: 10pt\">\u0648 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 \u0631\u0648\u06cc \u062f\u06cc\u0633\u06a9 (\u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0627 \u0641\u0631\u0645\u062a.ppk) \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 hostname\u200c\u0647\u0627\u060c username\u200c\u0647\u0627 \u0648 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062e\u0635\u0648\u0635\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 (\u0686\u0647 \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc\u200c\u0634\u062f\u0647 \u0648 \u0686\u0647 \u0628\u062f\u0648\u0646 \u0631\u0645\u0632) \u0631\u0627 \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20934\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/10-300x63.png\" alt=\"\" width=\"562\" height=\"118\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/10-300x63.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/10-768x162.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/10-150x32.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/10.png 970w\" sizes=\"(max-width: 562px) 100vw, 562px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">\u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0627\u0632 PuTTY \u0628\u0631\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a \u0633\u0631\u0648\u0631\u0647\u0627\u06cc Linux \u06cc\u0627 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0634\u0628\u06a9\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062e\u0635\u0648\u0635\u06cc \u0627\u063a\u0644\u0628 \u0628\u062f\u0648\u0646 passphrase \u06cc\u0627 \u0628\u0627 \u0639\u0628\u0648\u0631\u0647\u0627\u06cc \u0636\u0639\u06cc\u0641 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u0627\u06af\u0631 \u0627\u06cc\u0646 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc SSH \u062f\u0631 \u0686\u0646\u062f \u0645\u062d\u06cc\u0637 \u0645\u062e\u062a\u0644\u0641 \u0645\u062c\u062f\u062f\u0627\u064b \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u067e\u0633\u0648\u0631\u062f\u060c \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc SSH \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627 \u0631\u0627 \u0628\u0647\u200c\u062f\u0633\u062a \u0622\u0648\u0631\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\"><strong>\u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0644\u06cc\u062f \u0627\u0633\u062a\u062e\u0631\u0627\u062c\u200c\u0634\u062f\u0647 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0645\u062d\u0644\u06cc<\/strong><\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">cat 'putty_IEUser_UbuntuKey_2025-05-22_175949.sec'<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631\u060c \u06a9\u0644\u06cc\u062f\u062e\u0635\u0648\u0635\u06cc \u06cc\u0627 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 passphrase \u0627\u0633\u062a\u062e\u0631\u0627\u062c\u200c\u0634\u062f\u0647 \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0633\u067e\u0633 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc SSH \u0628\u0627\u0632\u06cc\u0627\u0628\u06cc\u200c\u0634\u062f\u0647 \u0631\u0627 \u0631\u0648\u06cc \u0627\u0647\u062f\u0627\u0641 \u062f\u0631 \u062f\u0633\u062a\u0631\u0633 \u062a\u0633\u062a \u06a9\u0631\u062f\u061b \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc Linux \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 ssh -i \u0648 \u062f\u0631 Windows \u0628\u0627 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f Plink \u06cc\u0627 WinSCP.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20935\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/11-300x231.png\" alt=\"\" width=\"535\" height=\"412\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/11-300x231.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/11-390x300.png 390w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/11-150x116.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/11.png 717w\" sizes=\"(max-width: 535px) 100vw, 535px\" \/><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0627\u0633\u062a\u062e\u0631\u0627\u062c Session Log\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Notepad++<\/span><\/strong><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 -M notepad++<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 notepad++ \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 NetExec \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 session\u060c \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0648 \u0628\u06a9\u0627\u067e\u200c\u0647\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 \u062a\u0648\u0633\u0637 Notepad++ \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06af\u0631\u0686\u0647 Notepad++ \u0628\u0631\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647 \u0637\u0631\u0627\u062d\u06cc \u0646\u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0642\u0627\u0628\u0644\u06cc\u062a \u0630\u062e\u06cc\u0631\u0647 \u062e\u0648\u062f\u06a9\u0627\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u200c\u0637\u0648\u0631 \u0646\u0627\u062e\u0648\u0627\u0633\u062a\u0647 \u0631\u0645\u0632\u0647\u0627\u06cc \u0639\u0628\u0648\u0631 \u0631\u0627 \u062f\u0631 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a\u200c\u0647\u0627\u060c \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0628\u0627\u0632 \u062d\u0627\u0648\u06cc \u062f\u0627\u062f\u0647 \u062d\u0633\u0627\u0633 \u06cc\u0627 \u062d\u062a\u06cc \u062a\u0627\u0631\u06cc\u062e\u0686\u0647 clipboard \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20936\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/12-300x78.png\" alt=\"\" width=\"538\" height=\"140\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/12-300x78.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/12-768x200.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/12-150x39.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/12.png 904w\" sizes=\"(max-width: 538px) 100vw, 538px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">\u062a\u0648\u0633\u0639\u0647\u200c\u062f\u0647\u0646\u062f\u06af\u0627\u0646\u060c \u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0648 \u062d\u062a\u06cc red teamer\u0647\u0627 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0647\u0646\u06af\u0627\u0645 \u06a9\u0627\u0631\u060c \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u0648\u0642\u062a secrets \u0631\u0627 \u062f\u0631 Notepad++ \u0646\u06af\u0647\u200c\u062f\u0627\u0631\u06cc \u06a9\u0646\u0646\u062f. \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 session recovery \u06cc\u0627 backup \u062d\u062a\u06cc \u067e\u0633 \u0627\u0632 \u0628\u0633\u062a\u0647 \u0634\u062f\u0646 \u0628\u0631\u0646\u0627\u0645\u0647 \u0646\u06cc\u0632 \u0628\u0627\u0642\u06cc \u0645\u06cc\u200c\u0645\u0627\u0646\u0646\u062f \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a\u06cc \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u0632 \u0637\u0631\u06cc\u0642 SMB \u062f\u0627\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u0639\u062a\u0628\u0631 \u0628\u0627\u0634\u062f\u060c \u0642\u0627\u0628\u0644 \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0647\u0633\u062a\u0646\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\">\u0646\u06a9\u062a\u0647: \u0627\u06cc\u0646 \u0645\u0631\u062d\u0644\u0647 \u062f\u0642\u062a \u0639\u0645\u0644\u06cc\u0627\u062a \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062f\u0631 \u0641\u0631\u0622\u06cc\u0646\u062f \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u0627\u0641\u0632\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06af\u0631\u0686\u0647 \u0647\u0645\u06cc\u0634\u0647 \u0645\u0648\u0641\u0642\u06cc\u062a\u200c\u0622\u0645\u06cc\u0632 \u0646\u06cc\u0633\u062a\u060c \u0627\u0645\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0645\u0642\u0627\u062f\u06cc\u0631 \u0627\u0631\u0632\u0634\u0645\u0646\u062f\u06cc \u0645\u0627\u0646\u0646\u062f access token\u200c\u0647\u0627\u060c \u0631\u0634\u062a\u0647\u200c\u0647\u0627\u06cc \u0627\u062a\u0635\u0627\u0644 \u067e\u0627\u06cc\u06af\u0627\u0647 \u062f\u0627\u062f\u0647 \u0648 SSH \u06cc\u0627 \u0627\u0637\u0644\u0627\u0639\u0627\u062a admin \u0642\u0631\u0627\u0631\u06af\u0631\u0641\u062a\u0647 \u062f\u0631 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a\u200c\u0647\u0627\u06cc \u0645\u062a\u0646\u200c\u0633\u0627\u062f\u0647 \u0631\u0627 \u0622\u0634\u06a9\u0627\u0631 \u06a9\u0646\u062f.<\/span><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0628\u0627\u0632\u06cc\u0627\u0628\u06cc PowerShell Command History<\/span><\/strong><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 -M powershell_history<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 powershell_history \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 NetExec \u0628\u0631\u0627\u06cc \u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u0648 \u062a\u062d\u0644\u06cc\u0644 \u062a\u0627\u0631\u06cc\u062e\u0686\u0647\u200c\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a PowerShell \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u06a9\u0627\u0631\u0628\u0631 \u0647\u062f\u0641 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20937\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/13-300x124.png\" alt=\"\" width=\"542\" height=\"224\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/13-300x124.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/13-1024x423.png 1024w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/13-768x317.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/13-150x62.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/13.png 1147w\" sizes=\"(max-width: 542px) 100vw, 542px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">\u0628\u0647\u200c\u0635\u0648\u0631\u062a \u067e\u06cc\u0634\u200c\u0641\u0631\u0636\u060c PowerShell \u062a\u0627\u0631\u06cc\u062e\u0686\u0647 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0627 \u062f\u0631 \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f:<\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">C:\\Users\\IEUser(user)\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt<\/pre>\n<p><span style=\"font-size: 10pt\">\u0645\u0647\u0627\u062c\u0645\u0627\u0646\u060c \u0645\u062f\u06cc\u0631\u0627\u0646 \u06cc\u0627 \u062a\u0648\u0633\u0639\u0647\u200c\u062f\u0647\u0646\u062f\u06af\u0627\u0646 \u0627\u063a\u0644\u0628 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u062f\u0631 PowerShell \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u061b \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/span><\/p>\n<p><span style=\"font-size: 10pt\">\u062f\u0633\u062a\u0648\u0631\u0627\u062a net use \u0647\u0645\u0631\u0627\u0647 \u0628\u0627 \u0631\u0645\u0632\u0647\u0627\u06cc \u0639\u0628\u0648\u0631 hardcoded\u060c \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062f\u0631 AD \u0647\u0645\u0631\u0627\u0647 \u0628\u0627 \u067e\u0627\u0631\u0627\u0645\u062a\u0631 -Credential\u060c \u06cc\u0627 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062d\u0633\u0627\u0633 \u0645\u0627\u0646\u0646\u062f Set-ADAccountPassword \u0648 New-ADUser.<\/span><\/p>\n<p><span style=\"font-size: 10pt\">\u062f\u0631 \u0635\u0648\u0631\u062a \u067e\u0627\u06a9 \u0646\u0634\u062f\u0646 \u062a\u0627\u0631\u06cc\u062e\u0686\u0647\u060c \u062a\u0645\u0627\u0645\u06cc \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0644\u0627\u06af \u0634\u062f\u0647 \u0648 \u0642\u0627\u0628\u0644 \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0647\u0633\u062a\u0646\u062f \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062d\u0633\u0627\u0633 \u0631\u0627 \u0627\u0641\u0634\u0627 \u06a9\u0646\u0646\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\">\u0646\u06a9\u062a\u0647: \u062a\u0627\u0631\u06cc\u062e\u0686\u0647 PowerShell \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062d\u0627\u0648\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0645\u062a\u0646 \u0633\u0627\u062f\u0647 \u06cc\u0627 \u062c\u0632\u0626\u06cc\u0627\u062a \u06a9\u0644\u06cc\u062f\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0628\u0627\u0634\u062f \u0648 \u062f\u0631 \u0645\u0631\u062d\u0644\u0647 post-exploitation \u0628\u0627 \u0641\u0631\u0627\u0647\u0645 \u06a9\u0631\u062f\u0646 \u0627\u0645\u06a9\u0627\u0646 lateral movement \u06cc\u0627 privilege escalation \u0628\u0631 \u0627\u0633\u0627\u0633 \u0641\u0639\u0627\u0644\u06cc\u062a \u06a9\u0627\u0631\u0628\u0631\u060c \u0646\u0642\u0634 \u0645\u0647\u0645\u06cc \u0627\u06cc\u0641\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\"><strong>\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc WinSCP<\/strong><\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 -M winscp<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 winscp \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 NetExec \u0628\u0631\u0627\u06cc \u0627\u0633\u062a\u062e\u0631\u0627\u062c Site Profile\u0647\u0627 \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 \u062f\u0631 WinSCP \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0634\u0627\u0645\u0644 Password\u060c Username\u060c Hostname \u0648 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc SSH \u0628\u0627\u0634\u0646\u062f \u06a9\u0647 \u062f\u0631 \u0641\u0627\u06cc\u0644 WinSCP.ini \u06cc\u0627 \u0631\u062c\u06cc\u0633\u062a\u0631\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u062f\u0633\u062a\u06cc\u0627\u0628\u06cc \u0628\u0647 \u0627\u06cc\u0646 \u062f\u0627\u062f\u0647\u200c\u0647\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0645\u0647\u0627\u062c\u0645 \u0631\u0627 \u0642\u0627\u062f\u0631 \u0628\u0647 \u0627\u062a\u0635\u0627\u0644 \u0628\u0647 \u0627\u0647\u062f\u0627\u0641 FTP\/SFTP\/SSH\u060c \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u062f\u0627\u062f\u0647 \u06cc\u0627 \u0627\u062c\u0631\u0627\u06cc payload \u06a9\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20938\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/14-300x88.png\" alt=\"\" width=\"549\" height=\"161\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/14-300x88.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/14-768x225.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/14-150x44.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/14.png 789w\" sizes=\"(max-width: 549px) 100vw, 549px\" \/><\/p>\n<p><span style=\"font-size: 10pt\"><strong>\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u067e\u0633\u0648\u0631\u062f\u0647\u0627\u06cc VNC<\/strong><\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.80 -u ieuser -p 123 -M vnc<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 vnc \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 NetExec \u0628\u0631\u0627\u06cc \u062c\u0633\u062a\u200c\u0648\u062c\u0648\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 VNC \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0647\u062f\u0641 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0645\u0627\u0698\u0648\u0644 \u0631\u062c\u06cc\u0633\u062a\u0631\u06cc \u0648 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u06a9\u0644\u0627\u06cc\u0646\u062a\u200c\u0647\u0627\u06cc \u0631\u0627\u06cc\u062c VNC \u0645\u0627\u0646\u0646\u062f UltraVNC, RealVNC, \u0648 TightVNC \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f\u061b \u062c\u0627\u06cc\u06cc \u06a9\u0647 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0631\u0645\u0632\u0647\u0627\u06cc \u0639\u0628\u0648\u0631 \u0628\u0627 \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc \u0636\u0639\u06cc\u0641 \u06cc\u0627 \u062d\u062a\u06cc \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u062a\u0646 \u0633\u0627\u062f\u0647 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u0646\u0645\u0648\u0646\u0647 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc\u200c\u0634\u062f\u0647:<\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">HKEY_LOCAL_MACHINE\\SOFTWARE\\ORL\\WinVNC3\\Password\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\RealVNC\\vncserver\r\n<\/pre>\n<p><span style=\"font-size: 10pt\">NetExec \u062a\u0644\u0627\u0634 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u06cc\u0627\u0641\u062a\u200c\u0634\u062f\u0647 \u0631\u0627 \u0631\u0645\u0632\u06af\u0634\u0627\u06cc\u06cc \u06a9\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20939\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/15-300x43.png\" alt=\"\" width=\"558\" height=\"80\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/15-300x43.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/15-768x109.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/15-150x21.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/15.png 808w\" sizes=\"(max-width: 558px) 100vw, 558px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">VNC \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u06a9\u0644\u0645\u0627\u062a \u0639\u0628\u0648\u0631 \u0627\u0632 \u0631\u062c\u06cc\u0633\u062a\u0631\u06cc \u06cc\u0627 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u062f\u0631 Windows \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0647\u062f\u0641 \u062f\u0633\u062a\u0631\u0633\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0627\u063a\u0644\u0628 \u062f\u0631 \u0686\u0646\u062f \u0633\u06cc\u0633\u062a\u0645 \u0645\u062e\u062a\u0644\u0641 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f\u060c \u06a9\u0647 \u0627\u0645\u06a9\u0627\u0646 lateral movement \u0648 persistence \u062f\u0631 \u0634\u0628\u06a9\u0647 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\">\u0646\u06a9\u062a\u0647: \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a VNC \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0648\u06cc\u0646\u062f\u0648\u0632 \u0631\u0627 \u062f\u0648\u0631 \u0628\u0632\u0646\u0646\u062f\u061b \u0627\u06cc\u0646 \u0627\u0645\u0631 \u0628\u0647\u200c\u0648\u06cc\u0698\u0647 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc legacy \u06cc\u0627 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc\u06cc \u0628\u0627 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0646\u0627\u0645\u0646\u0627\u0633\u0628 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0645\u0634\u0627\u0647\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/span><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0627\u0633\u062a\u062e\u0631\u0627\u062c Wi-Fi Credentials<\/span><\/strong><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.46 -u administrator -p 123 -M wifi<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 wifi \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 NetExec \u0628\u0631\u0627\u06cc \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0630\u062e\u06cc\u0631\u0647 \u0634\u062f\u0647 Wi-FI \u0634\u0627\u0645\u0644 SSID\u0647\u0627 \u0648 PSK\u0647\u0627 \u0627\u0632 \u0633\u06cc\u0633\u062a\u0645 Windows \u0647\u062f\u0641 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0641\u0631\u0622\u06cc\u0646\u062f \u0628\u0627 \u06a9\u0648\u0626\u0631\u06cc \u06af\u0631\u0641\u062a\u0646 \u0627\u0632 PowerShell \u06cc\u0627 \u062e\u0648\u0627\u0646\u062f\u0646 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0631\u062c\u06cc\u0633\u062a\u0631\u06cc \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f \u0648 \u0627\u0645\u06a9\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u0647\u0627\u062c\u0645 \u0628\u0647 \u0634\u0628\u06a9\u0647\u200c\u0647\u0627\u06cc \u062f\u0627\u062e\u0644\u06cc\u060c pivot \u06a9\u0631\u062f\u0646 \u0628\u0647 Wi-Fi\u0647\u0627\u06cc \u0646\u0627\u0627\u0645\u0646 \u0648 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u062c\u062f\u062f \u0627\u0632 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20940\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/16-300x94.png\" alt=\"\" width=\"568\" height=\"178\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/16-300x94.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/16-768x240.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/16-150x47.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/16.png 987w\" sizes=\"(max-width: 568px) 100vw, 568px\" \/><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0628\u0631\u0631\u0633\u06cc Dumping Backup Operators Permission<\/span><\/strong><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.53 -u raj -p Password@1 -M backup_operator<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 backup_operator \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 NetExec \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u0622\u06cc\u0627 \u06a9\u0627\u0631\u0628\u0631 (\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 raj) \u0639\u0636\u0648 \u06af\u0631\u0648\u0647 Backup Operators \u0627\u0633\u062a \u06cc\u0627 \u062e\u06cc\u0631. \u0647\u0645\u0686\u0646\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u0622\u06cc\u0627 \u06a9\u0627\u0631\u0628\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0645\u0627\u0646\u0646\u062f SAM, SYSTEM, SECURITY \u0648 NTDS.dit \u0631\u0627 \u0628\u062e\u0648\u0627\u0646\u062f\u061b \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0641\u0642\u0637 \u0628\u0631\u0627\u06cc administrators \u0642\u0627\u0628\u0644 \u062f\u0633\u062a\u0631\u0633\u06cc \u0647\u0633\u062a\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20941\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/19-300x169.png\" alt=\"\" width=\"546\" height=\"307\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/19-300x169.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/19-1024x578.png 1024w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/19-150x85.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/19.png 1082w\" sizes=\"(max-width: 546px) 100vw, 546px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">\u0627\u0639\u0636\u0627\u06cc \u06af\u0631\u0648\u0647 Backup Operators \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u062f\u0648\u0646 \u062a\u0648\u062c\u0647 \u0628\u0647 \u0645\u062c\u0648\u0632\u0647\u0627\u06cc \u0641\u0627\u06cc\u0644\u200c\u0633\u06cc\u0633\u062a\u0645\u060c \u0639\u0645\u0644\u06cc\u0627\u062a \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u200c\u06af\u06cc\u0631\u06cc \u0648 \u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u0646\u062f. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u062d\u062a\u06cc \u06cc\u06a9 \u06a9\u0627\u0631\u0628\u0631 \u0628\u062f\u0648\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc admin \u0646\u06cc\u0632 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f:<\/span><\/p>\n<ul>\n<li><span style=\"font-size: 10pt\">\u0627\u0633\u062a\u062e\u0631\u0627\u062c dit database<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 SAM \u0648 SYSTEM hive<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u062f\u0648\u0631 \u0632\u062f\u0646 \u0628\u0631\u062e\u06cc \u0627\u0632 protections \u0633\u06cc\u0633\u062a\u0645<\/span><\/li>\n<\/ul>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639\u060c \u06cc\u06a9 \u06a9\u0627\u0631\u0628\u0631 \u0628\u0627 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u067e\u0627\u06cc\u06cc\u0646 \u0627\u0645\u0627 \u0639\u0636\u0648 Backup Operators \u0631\u0627 \u0628\u0647 \u06cc\u06a9 domain takeover vector \u0628\u0633\u06cc\u0627\u0631 \u0645\u0647\u0645 \u062a\u0628\u062f\u06cc\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\">\u0646\u06a9\u062a\u0647: \u06af\u0631\u0648\u0647 Backup Operators \u062f\u0631 AD\u0647\u0627\u06cc\u06cc \u0628\u0627 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0627\u0634\u062a\u0628\u0627\u0647 \u06cc\u06a9 \u06af\u0631\u0648\u0647 \u0628\u0627 \u0633\u0637\u062d \u0631\u06cc\u0633\u06a9 \u0628\u0627\u0644\u0627 \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f \u0648 \u0628\u0627\u06cc\u062f \u0645\u0634\u0627\u0628\u0647 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0645\u062c\u0648\u0632\u062f\u0627\u0631 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0634\u0648\u062f\u061b \u0647\u0645\u0631\u0627\u0647 \u0628\u0627 audit \u062f\u0648\u0631\u0647\u200c\u0627\u06cc \u0627\u0639\u0636\u0627.<\/span><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0628\u0631\u0631\u0633\u06cc Dumping NTDS.dit Using an Authenticated User<\/span><\/strong><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.53 -u yashika -p Password@1 --ntds<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0642\u0627\u0628\u0644\u06cc\u062a &#8211;ntds \u062f\u0631 NetExec \u0628\u0631\u0627\u06cc \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0641\u0627\u06cc\u0644 NTDS.dit \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0641\u0627\u06cc\u0644 NTDS.dit \u0634\u0627\u0645\u0644 \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u062d\u06cc\u0627\u062a\u06cc Active Directory \u0627\u0632 \u062c\u0645\u0644\u0647 username\u0647\u0627\u060c NTLM hash\u0647\u0627\u060c group membership\u200c\u0647\u0627 \u0648 \u0627\u0637\u0644\u0627\u0639\u0627\u062a domain trust \u0627\u0633\u062a. NetExec \u0627\u06cc\u0646 \u0641\u0631\u0622\u06cc\u0646\u062f \u0631\u0627 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Volume Shadow Copy \u0648 \u0627\u0633\u062a\u062e\u0631\u0627\u062c hive \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 SYSTEM \u062c\u0647\u062a \u0631\u0645\u0632\u06af\u0634\u0627\u06cc\u06cc hash\u0647\u0627 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20942\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/20-300x91.png\" alt=\"\" width=\"547\" height=\"166\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/20-300x91.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/20-1024x309.png 1024w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/20-768x232.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/20-150x45.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/20.png 1165w\" sizes=\"(max-width: 547px) 100vw, 547px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">NTDS.dit \u06cc\u06a9\u06cc \u0627\u0632 \u06a9\u0644\u06cc\u062f\u06cc\u200c\u062a\u0631\u06cc\u0646 \u0627\u0647\u062f\u0627\u0641 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u062f\u0631 \u06cc\u06a9 Windows domain \u0627\u0633\u062a. \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0622\u0646 \u0627\u0645\u06a9\u0627\u0646 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f:<\/span><\/p>\n<ul>\n<li><span style=\"font-size: 10pt\">\u06a9\u0631\u06a9 \u06a9\u0631\u062f\u0646 \u0622\u0641\u0644\u0627\u06cc\u0646 \u0628\u0631\u0627\u06cc \u06a9\u0644\u0645\u0627\u062a \u0639\u0628\u0648\u0631 \u062f\u0627\u0645\u0646\u0647<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0627\u062c\u0631\u0627\u06cc Pass-the-Hash attack<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u062f\u0633\u062a\u0631\u0633\u06cc \u06a9\u0627\u0645\u0644 \u0628\u0647 \u062a\u0645\u0627\u0645 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u0627\u0645\u0646\u0647\u060c \u0634\u0627\u0645\u0644 administrators \u0648 service account\u0647\u0627<\/span><\/li>\n<\/ul>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u0645\u0631\u062d\u0644\u0647 \u0628\u0631\u0627\u06cc \u0639\u0645\u0644\u06cc\u0627\u062a red team \u06cc\u0627 APT \u06cc\u06a9 \u06af\u0627\u0645 \u06a9\u0644\u06cc\u062f\u06cc \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\">\u0646\u06a9\u062a\u0647: \u0627\u0633\u062a\u062e\u0631\u0627\u062c NTDS.dit \u0627\u0645\u06a9\u0627\u0646 domain-wide credential exfiltration \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f hash\u0647\u0627\u06cc \u0636\u0639\u06cc\u0641 \u0631\u0627 crack \u06a9\u0646\u062f\u060c \u0622\u0646\u200c\u0647\u0627 \u0631\u0627 \u062f\u0631 Pass-the-Hash \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f \u06cc\u0627 \u062d\u062a\u06cc Golden Ticket \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 krbtgt credentials \u062c\u0639\u0644 \u0646\u0645\u0627\u06cc\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\"><strong>\u0627\u0633\u062a\u062e\u0631\u0627\u062c gMSA Credentials<\/strong><\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.53 -u komal -p Passwor@1 \u2013gmsa<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0642\u0627\u0628\u0644\u06cc\u062a gmsa \u062f\u0631 NetExec \u0628\u0631\u0627\u06cc \u062c\u0645\u0639 \u0622\u0648\u0631\u06cc \u06a9\u0631\u062f\u0646 Group Managed Service Account (gMSA) \u200c\u0647\u0627 \u062f\u0631 AD \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06af\u0631 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u062c\u0627\u0632\u0647 \u062f\u0647\u062f\u060c NetExec \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f account name\u200c\u0647\u0627\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc Kerberos \u0648 Metadata\u0647\u0627\u06cc \u0645\u0631\u062a\u0628\u0637 \u0631\u0627 \u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u06a9\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20943\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/21-300x42.png\" alt=\"\" width=\"564\" height=\"79\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/21-300x42.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/21-1024x143.png 1024w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/21-768x108.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/21-150x21.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/21.png 1100w\" sizes=\"(max-width: 564px) 100vw, 564px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">\u0627\u0633\u062a\u062e\u0631\u0627\u062c secret \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 gMSA \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0622\u0646 \u062d\u0633\u0627\u0628 \u0631\u0627 \u0633\u0631\u0642\u062a \u06a9\u0646\u062f\u060c lateral movement \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u062f \u0648 \u0628\u0647 \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f MSSQL \u06cc\u0627 IIS \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u06a9\u0646\u062f.<\/span><\/p>\n<p><span style=\"font-size: 10pt\"><strong>\u0628\u0627\u0632\u06cc\u0627\u0628\u06cc LAPS Password \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec<\/strong><\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">nxc smb 192.168.1.53 -u komal -p Passwor@1 -M laps<\/pre>\n<p><span style=\"font-size: 10pt\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0632 \u0645\u0627\u0698\u0648\u0644 laps \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 NetExec \u0628\u0631\u0627\u06cc \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 Microsoft LAPS (Local Administrator Password Solution) \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f\u061b \u0642\u0627\u0628\u0644\u06cc\u062a\u06cc \u06a9\u0647 \u067e\u0633\u0648\u0631\u062f\u0647\u0627\u06cc \u06cc\u06a9\u062a\u0627\u06cc local admin \u0631\u0627 \u062f\u0631 Active Directory \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0645\u0627\u0698\u0648\u0644 \u062a\u0644\u0627\u0634 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0645\u0642\u062f\u0627\u0631 attribute \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 ms-Mcs-AdmPwd \u0631\u0627 \u0631\u0648\u06cc \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u06a9\u0627\u0645\u067e\u06cc\u0648\u062a\u0631 \u06a9\u0648\u0626\u0631\u06cc \u06a9\u0646\u062f \u062a\u0627 \u067e\u0633\u0648\u0631\u062f \u0641\u0639\u0644\u06cc local admin \u0631\u0627 \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u06a9\u0646\u062f.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-20944\" src=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/22-300x43.png\" alt=\"\" width=\"572\" height=\"82\" srcset=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/22-300x43.png 300w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/22-1024x148.png 1024w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/22-768x111.png 768w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/22-150x22.png 150w, https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/22.png 1097w\" sizes=\"(max-width: 572px) 100vw, 572px\" \/><\/p>\n<p><span style=\"font-size: 10pt\">\u062f\u0631 \u0635\u0648\u0631\u062a \u0645\u0648\u0641\u0642\u06cc\u062a\u060c \u0627\u06cc\u0646 \u0641\u0631\u0622\u06cc\u0646\u062f \u062f\u0633\u062a\u0631\u0633\u06cc local admin \u0628\u0647 \u0645\u0627\u0634\u06cc\u0646 \u0647\u062f\u0641 \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0645\u06a9\u0627\u0646 \u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f privilege escalation\u060c lateral movement \u0648 \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u067e\u0631\u0648\u062a\u06a9\u0644\u200c\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f SMB\u060c PSExec \u0648 WinRM \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/span><\/p>\n<p><strong><span style=\"font-size: 10pt\">\u0631\u0627\u0647\u06a9\u0627\u0631\u0647\u0627\u06cc \u06a9\u0627\u0647\u0634 \u062a\u0647\u062f\u06cc\u062f<\/span><\/strong><\/p>\n<ul>\n<li><span style=\"font-size: 10pt\">\u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc SMB (\u0628\u0647\u200c\u0648\u06cc\u0698\u0647 remote registry \u0648 file share) \u0628\u0631\u0627\u06cc \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc\u06cc \u0628\u0627 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u067e\u0627\u06cc\u06cc\u0646.<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 LSA\u060c SAM \u06cc\u0627 hive\u0647\u0627\u06cc \u0631\u062c\u06cc\u0633\u062a\u0631\u06cc \u0627\u0632 \u0637\u0631\u06cc\u0642 SMB<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 auto-login \u0648 \u062d\u0630\u0641 session\u0647\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 \u062f\u0631 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627.<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u06a9\u0627\u0647\u0634 \u0639\u0636\u0648\u06cc\u062a \u062f\u0631 \u06af\u0631\u0648\u0647\u200c\u0647\u0627\u06cc Backup Operator \u0648 gMSA<\/span><\/li>\n<li><span style=\"font-size: 10pt\">\u0628\u0631\u0631\u0633\u06cc \u0627\u0644\u06af\u0648\u0647\u0627\u06cc \u063a\u06cc\u0631\u0637\u0628\u06cc\u0639\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 config\u0647\u0627\u06cc WinSCP\u060c PuTTY\u060c VNC \u0648 \u0645\u0634\u0627\u0628\u0647.<\/span><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u062f\u0631 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0645\u062f\u0631\u0646\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a Active Directory \u0627\u0631\u0632\u0634\u0645\u0646\u062f\u062a\u0631\u06cc\u0646 \u0647\u062f\u0641 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u0686\u0647 \u06cc\u06a9 Red Teamer \u0628\u0627\u0634\u06cc\u062f\u060c \u0686\u0647 \u06cc\u06a9 \u0645\u062a\u062e\u0635\u0635 \u062a\u0633\u062a\u200c\u0646\u0641\u0648\u0630 \u06cc\u0627 \u06cc\u06a9 \u0645\u062a\u062e\u0635\u0635 \u0634\u0628\u06cc\u0647\u200c\u0633\u0627\u0632\u06cc \u062d\u0645\u0644\u0627\u062a \u060c \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0631\u0627\u06cc \u00a0Privilege Escalation \u00a0(\u0628\u0627\u0644\u0627 \u0628\u0631\u062f\u0646 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc)\u060c Lateral Movement (\u062d\u0631\u06a9\u0627\u062a \u062c\u0627\u0646\u0628\u06cc) \u0648 Persistence (\u067e\u0627\u06cc\u062f\u0627\u0631\u06cc) \u0636\u0631\u0648\u0631\u06cc \u0627\u0633\u062a. \u0627\u0645\u0627 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u062f\u0631 \u0633\u0646\u0627\u0631\u06cc\u0648\u0647\u0627\u06cc &hellip;<\/p>\n","protected":false},"author":14,"featured_media":20945,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[258,4,349],"tags":[],"class_list":["post-20924","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teaching","category-network-pentest","category-slides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.5 (Yoast SEO v27.6) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc) - \u0628\u0644\u0627\u06af \u06af\u0631\u0648\u0647 \u0644\u06cc\u0627\u0646<\/title>\n<meta name=\"description\" content=\"\u062f\u0631 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0645\u062f\u0631\u0646\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a Active Directory \u0627\u0631\u0632\u0634\u0645\u0646\u062f\u062a\u0631\u06cc\u0646 \u0647\u062f\u0641 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/\" \/>\n<meta property=\"og:locale\" content=\"fa_IR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc)\" \/>\n<meta property=\"og:description\" content=\"\u062f\u0631 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0645\u062f\u0631\u0646\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a Active Directory \u0627\u0631\u0632\u0634\u0645\u0646\u062f\u062a\u0631\u06cc\u0646 \u0647\u062f\u0641 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/\" \/>\n<meta property=\"og:site_name\" content=\"\u0628\u0644\u0627\u06af \u06af\u0631\u0648\u0647 \u0644\u06cc\u0627\u0646\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-15T12:20:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/aa4d3089-0244-45f2-bfa6-ec8d8c60e5bf.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"\u0633\u062c\u0627\u062f \u062a\u06cc\u0645\u0648\u0631\u06cc\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@liansecurity\" \/>\n<meta name=\"twitter:site\" content=\"@liansecurity\" \/>\n<meta name=\"twitter:label1\" content=\"\u0646\u0648\u0634\u062a\u0647\u200c\u0634\u062f\u0647 \u0628\u062f\u0633\u062a\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u0633\u062c\u0627\u062f \u062a\u06cc\u0645\u0648\u0631\u06cc\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u0632\u0645\u0627\u0646 \u062a\u0642\u0631\u06cc\u0628\u06cc \u0628\u0631\u0627\u06cc \u062e\u0648\u0627\u0646\u062f\u0646\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 \u062f\u0642\u06cc\u0642\u0647\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/\"},\"author\":{\"name\":\"\u0633\u062c\u0627\u062f \u062a\u06cc\u0645\u0648\u0631\u06cc\",\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/#\\\/schema\\\/person\\\/e328f67a35a843fd3accc4666b5eab0a\"},\"headline\":\"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc)\",\"datePublished\":\"2025-11-15T12:20:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/\"},\"wordCount\":588,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/aa4d3089-0244-45f2-bfa6-ec8d8c60e5bf.png\",\"articleSection\":[\"\u0622\u0645\u0648\u0632\u0634\u200c\u0647\u0627\u06cc \u0644\u06cc\u0627\u0646\",\"\u062a\u0633\u062a \u0646\u0641\u0648\u0630 \u0634\u0628\u06a9\u0647\",\"\u06cc\u06cc\u06cc\u06cc \u0627\u0633\u0644\u0627\u06cc\u062f\"],\"inLanguage\":\"fa-IR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/\",\"url\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/\",\"name\":\"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc) - \u0628\u0644\u0627\u06af \u06af\u0631\u0648\u0647 \u0644\u06cc\u0627\u0646\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/aa4d3089-0244-45f2-bfa6-ec8d8c60e5bf.png\",\"datePublished\":\"2025-11-15T12:20:43+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/#\\\/schema\\\/person\\\/e328f67a35a843fd3accc4666b5eab0a\"},\"description\":\"\u062f\u0631 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0645\u062f\u0631\u0646\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a Active Directory \u0627\u0631\u0632\u0634\u0645\u0646\u062f\u062a\u0631\u06cc\u0646 \u0647\u062f\u0641 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/#breadcrumb\"},\"inLanguage\":\"fa-IR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fa-IR\",\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/#primaryimage\",\"url\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/aa4d3089-0244-45f2-bfa6-ec8d8c60e5bf.png\",\"contentUrl\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/aa4d3089-0244-45f2-bfa6-ec8d8c60e5bf.png\",\"width\":1280,\"height\":600,\"caption\":\"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc)\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/credential-dumping-with-netexec-nxc\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u062e\u0627\u0646\u0647\",\"item\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/\",\"name\":\"\u0628\u0644\u0627\u06af \u06af\u0631\u0648\u0647 \u0644\u06cc\u0627\u0646\",\"description\":\"\u0622\u062e\u0631\u06cc\u0646 \u0627\u062e\u0628\u0627\u0631\u060c\u0645\u0642\u0627\u0644\u0627\u062a \u0648 \u0622\u0645\u0648\u0632\u0634\u200c\u0647\u0627\u06cc \u062d\u0648\u0632\u0647 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fa-IR\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/#\\\/schema\\\/person\\\/e328f67a35a843fd3accc4666b5eab0a\",\"name\":\"\u0633\u062c\u0627\u062f \u062a\u06cc\u0645\u0648\u0631\u06cc\",\"sameAs\":[\"https:\\\/\\\/liangroup.net\"],\"url\":\"https:\\\/\\\/liangroup.net\\\/blog\\\/author\\\/s-teymouri\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc) - \u0628\u0644\u0627\u06af \u06af\u0631\u0648\u0647 \u0644\u06cc\u0627\u0646","description":"\u062f\u0631 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0645\u062f\u0631\u0646\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a Active Directory \u0627\u0631\u0632\u0634\u0645\u0646\u062f\u062a\u0631\u06cc\u0646 \u0647\u062f\u0641 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/","og_locale":"fa_IR","og_type":"article","og_title":"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc)","og_description":"\u062f\u0631 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0645\u062f\u0631\u0646\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a Active Directory \u0627\u0631\u0632\u0634\u0645\u0646\u062f\u062a\u0631\u06cc\u0646 \u0647\u062f\u0641 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.","og_url":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/","og_site_name":"\u0628\u0644\u0627\u06af \u06af\u0631\u0648\u0647 \u0644\u06cc\u0627\u0646","article_published_time":"2025-11-15T12:20:43+00:00","og_image":[{"width":1280,"height":600,"url":"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/aa4d3089-0244-45f2-bfa6-ec8d8c60e5bf.png","type":"image\/png"}],"author":"\u0633\u062c\u0627\u062f \u062a\u06cc\u0645\u0648\u0631\u06cc","twitter_card":"summary_large_image","twitter_creator":"@liansecurity","twitter_site":"@liansecurity","twitter_misc":{"\u0646\u0648\u0634\u062a\u0647\u200c\u0634\u062f\u0647 \u0628\u062f\u0633\u062a":"\u0633\u062c\u0627\u062f \u062a\u06cc\u0645\u0648\u0631\u06cc","\u0632\u0645\u0627\u0646 \u062a\u0642\u0631\u06cc\u0628\u06cc \u0628\u0631\u0627\u06cc \u062e\u0648\u0627\u0646\u062f\u0646":"19 \u062f\u0642\u06cc\u0642\u0647"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/#article","isPartOf":{"@id":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/"},"author":{"name":"\u0633\u062c\u0627\u062f \u062a\u06cc\u0645\u0648\u0631\u06cc","@id":"https:\/\/liangroup.net\/blog\/#\/schema\/person\/e328f67a35a843fd3accc4666b5eab0a"},"headline":"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc)","datePublished":"2025-11-15T12:20:43+00:00","mainEntityOfPage":{"@id":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/"},"wordCount":588,"commentCount":0,"image":{"@id":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/#primaryimage"},"thumbnailUrl":"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/aa4d3089-0244-45f2-bfa6-ec8d8c60e5bf.png","articleSection":["\u0622\u0645\u0648\u0632\u0634\u200c\u0647\u0627\u06cc \u0644\u06cc\u0627\u0646","\u062a\u0633\u062a \u0646\u0641\u0648\u0630 \u0634\u0628\u06a9\u0647","\u06cc\u06cc\u06cc\u06cc \u0627\u0633\u0644\u0627\u06cc\u062f"],"inLanguage":"fa-IR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/","url":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/","name":"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc) - \u0628\u0644\u0627\u06af \u06af\u0631\u0648\u0647 \u0644\u06cc\u0627\u0646","isPartOf":{"@id":"https:\/\/liangroup.net\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/#primaryimage"},"image":{"@id":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/#primaryimage"},"thumbnailUrl":"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/aa4d3089-0244-45f2-bfa6-ec8d8c60e5bf.png","datePublished":"2025-11-15T12:20:43+00:00","author":{"@id":"https:\/\/liangroup.net\/blog\/#\/schema\/person\/e328f67a35a843fd3accc4666b5eab0a"},"description":"\u062f\u0631 \u0645\u062d\u06cc\u0637\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0645\u062f\u0631\u0646\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a Active Directory \u0627\u0631\u0632\u0634\u0645\u0646\u062f\u062a\u0631\u06cc\u0646 \u0647\u062f\u0641 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.","breadcrumb":{"@id":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/#breadcrumb"},"inLanguage":"fa-IR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/"]}]},{"@type":"ImageObject","inLanguage":"fa-IR","@id":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/#primaryimage","url":"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/aa4d3089-0244-45f2-bfa6-ec8d8c60e5bf.png","contentUrl":"https:\/\/liangroup.net\/blog\/wp-content\/uploads\/2025\/11\/aa4d3089-0244-45f2-bfa6-ec8d8c60e5bf.png","width":1280,"height":600,"caption":"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc)"},{"@type":"BreadcrumbList","@id":"https:\/\/liangroup.net\/blog\/credential-dumping-with-netexec-nxc\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u062e\u0627\u0646\u0647","item":"https:\/\/liangroup.net\/blog\/"},{"@type":"ListItem","position":2,"name":"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 NetExec \u200f(nxc)"}]},{"@type":"WebSite","@id":"https:\/\/liangroup.net\/blog\/#website","url":"https:\/\/liangroup.net\/blog\/","name":"\u0628\u0644\u0627\u06af \u06af\u0631\u0648\u0647 \u0644\u06cc\u0627\u0646","description":"\u0622\u062e\u0631\u06cc\u0646 \u0627\u062e\u0628\u0627\u0631\u060c\u0645\u0642\u0627\u0644\u0627\u062a \u0648 \u0622\u0645\u0648\u0632\u0634\u200c\u0647\u0627\u06cc \u062d\u0648\u0632\u0647 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/liangroup.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fa-IR"},{"@type":"Person","@id":"https:\/\/liangroup.net\/blog\/#\/schema\/person\/e328f67a35a843fd3accc4666b5eab0a","name":"\u0633\u062c\u0627\u062f \u062a\u06cc\u0645\u0648\u0631\u06cc","sameAs":["https:\/\/liangroup.net"],"url":"https:\/\/liangroup.net\/blog\/author\/s-teymouri\/"}]}},"_links":{"self":[{"href":"https:\/\/liangroup.net\/blog\/wp-json\/wp\/v2\/posts\/20924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/liangroup.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/liangroup.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/liangroup.net\/blog\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/liangroup.net\/blog\/wp-json\/wp\/v2\/comments?post=20924"}],"version-history":[{"count":0,"href":"https:\/\/liangroup.net\/blog\/wp-json\/wp\/v2\/posts\/20924\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/liangroup.net\/blog\/wp-json\/wp\/v2\/media\/20945"}],"wp:attachment":[{"href":"https:\/\/liangroup.net\/blog\/wp-json\/wp\/v2\/media?parent=20924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/liangroup.net\/blog\/wp-json\/wp\/v2\/categories?post=20924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/liangroup.net\/blog\/wp-json\/wp\/v2\/tags?post=20924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}