intranet-pentest-advanced

name	intranet-pentest-advanced
description	内网渗透高级 — 横向移动、凭据窃取、提权、持久化、隧道代理、AD攻击、ADCS滥用、Exchange/SharePoint攻击
routing	{"target_types":["intranet","network","host"],"phases":["post_exploitation","exploitation"],"task_types":["pentest"],"vulnerability_classes":["lateral_movement","privilege_escalation","credential_theft"],"protocols":["smb","ldap","kerberos","rdp"],"tooling":["bloodhound","impacket","crackmapexec","mimikatz","chisel","ligolo","frp"]}

内网渗透高级 Skill

当任务从互联网评估转入主机、域或内网操作时使用本 Skill。需要已获得初始访问权限或立足点。

前置条件：如果尚未获得初始访问，先完成外网渗透获取立足点。

场景路由

目标类型	首选参考
横向移动（PsExec/WMI/WinRM/DCOM/SSH/RDP/PTH/PTT）	references/intranet-playbook-01-lateral-movement.md
规避与反检测（AMSI绕过/ETW/注入/伪装/签名二进制滥用）	references/intranet-playbook-02-evasion-and-anti-detection.md
凭据窃取（Mimikatz/Kerberoasting/DCSync/浏览器Vault）	references/intranet-playbook-03-credential-theft.md
提权与持久化（Token/Service/Potato/Cron/Registry/WMI）	references/intranet-playbook-04-privilege-escalation.md + 05-persistence.md
隧道与代理（FRP/Chisel/Ligolo/SOCKS/SSH/DNS/ICMP）	references/intranet-playbook-06-tunneling-and-proxy.md
信息收集	references/intranet-playbook-07-information-gathering.md
AD 攻击（BloodHound/AS-REP/Kerberoasting/Golden/Silver）