https://x7peeps.com/%E5%AE%89%E5%85%A8/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/05-%E5%90%8E%E6%B8%97%E9%80%8F%E5%88%A9%E7%94%A8/1-%E5%86%85%E7%BD%91%E6%B8%97%E9%80%8F%E4%B8%8E%E5%9F%9F%E6%8E%A7%E5%AE%89%E5%85%A8/5-%E9%AB%98%E7%BA%A7%E5%A7%94%E6%B4%BE%E4%B8%8E%E5%87%AD%E8%AF%81%E5%88%A9%E7%94%A8/index.html5-高级委派与凭证利用 本章重点探讨基于活动目录（AD）高级特性（如基于资源的约束委派 RBCD、Shadow Credentials）的权限利用机制及检测方法。Hugozh-CNMon, 15 Jun 2026 16:22:45 +0000https://x7peeps.com/%E5%AE%89%E5%85%A8/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/05-%E5%90%8E%E6%B8%97%E9%80%8F%E5%88%A9%E7%94%A8/1-%E5%86%85%E7%BD%91%E6%B8%97%E9%80%8F%E4%B8%8E%E5%9F%9F%E6%8E%A7%E5%AE%89%E5%85%A8/5-%E9%AB%98%E7%BA%A7%E5%A7%94%E6%B4%BE%E4%B8%8E%E5%87%AD%E8%AF%81%E5%88%A9%E7%94%A8/%E8%B5%84%E6%BA%90%E5%9F%BA%E7%A1%80%E7%BA%A6%E6%9D%9F%E5%A7%94%E6%B4%BERBCD%E5%88%A9%E7%94%A8%E4%B8%8E%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 16:22:45 +0000https://x7peeps.com/%E5%AE%89%E5%85%A8/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/05-%E5%90%8E%E6%B8%97%E9%80%8F%E5%88%A9%E7%94%A8/1-%E5%86%85%E7%BD%91%E6%B8%97%E9%80%8F%E4%B8%8E%E5%9F%9F%E6%8E%A7%E5%AE%89%E5%85%A8/5-%E9%AB%98%E7%BA%A7%E5%A7%94%E6%B4%BE%E4%B8%8E%E5%87%AD%E8%AF%81%E5%88%A9%E7%94%A8/%E8%B5%84%E6%BA%90%E5%9F%BA%E7%A1%80%E7%BA%A6%E6%9D%9F%E5%A7%94%E6%B4%BERBCD%E5%88%A9%E7%94%A8%E4%B8%8E%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.html资源基础约束委派(RBCD)攻击链与检测处置 Resource-Based Constrained Delegation，即 RBCD，是 Active Directory 后渗透阶段最稳定的横向移动技术之一。它的本质不是“爆破域管密码”，而是把对象控制权转化为 Kerberos 代理能力。只要攻击者能够让目标计算机对象信任自己控制的服务主体，就可以代表任意用户向目标服务申请合法票据，并以该用户权限访问目标主机。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/05-%E5%90%8E%E6%B8%97%E9%80%8F%E5%88%A9%E7%94%A8/1-%E5%86%85%E7%BD%91%E6%B8%97%E9%80%8F%E4%B8%8E%E5%9F%9F%E6%8E%A7%E5%AE%89%E5%85%A8/5-%E9%AB%98%E7%BA%A7%E5%A7%94%E6%B4%BE%E4%B8%8E%E5%87%AD%E8%AF%81%E5%88%A9%E7%94%A8/Shadow_Credentials_msDS-KeyCredentialLink_%E6%94%BB%E5%87%BB%E4%B8%8E%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 16:22:45 +0000https://x7peeps.com/%E5%AE%89%E5%85%A8/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/05-%E5%90%8E%E6%B8%97%E9%80%8F%E5%88%A9%E7%94%A8/1-%E5%86%85%E7%BD%91%E6%B8%97%E9%80%8F%E4%B8%8E%E5%9F%9F%E6%8E%A7%E5%AE%89%E5%85%A8/5-%E9%AB%98%E7%BA%A7%E5%A7%94%E6%B4%BE%E4%B8%8E%E5%87%AD%E8%AF%81%E5%88%A9%E7%94%A8/Shadow_Credentials_msDS-KeyCredentialLink_%E6%94%BB%E5%87%BB%E4%B8%8E%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.htmlShadow Credentials(msDS-KeyCredentialLink)攻击与检测分析 Shadow Credentials 是 Active Directory 中极具实战价值的账户接管与持久化技术。它的核心不是修改目标用户密码，也不是直接窃取 NTLM 哈希，而是向目标对象的 msDS-KeyCredentialLink 属性写入攻击者控制的公钥材料，使攻击者能够通过 PKINIT 以目标身份向域控申请 TGT，随后进一步恢复票据、提取哈希或直接横向访问。