Skip to content

Commit c86cefb

Browse files
Randark-JMTRandark-JMT
committed
update
1 parent c6c8644 commit c86cefb

File tree

4 files changed

+342
-4
lines changed

4 files changed

+342
-4
lines changed

‎docs/Attack-Defense/Jamming-Countermeasure/Cobalt-Strike.md‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,20 @@
22

33
对抗 Cobaltstrike 中的手段：
44

5-
- 伪造流量批量上线（欺骗防御）
6-
- 利用漏洞（CVE-2022-39197），反制攻击者，获取 aggressor 端的相关信息和相关权限
5+
- 伪造流量批量上线 (欺骗防御)
6+
- 利用漏洞 (CVE-2022-39197)，反制攻击者，获取 aggressor 端的相关信息和相关权限
77
- 反制 server，爆破密码，获取 server 信息
88
- 旁路反制
99

10-
## 伪造流量批量上线（欺骗防御）
10+
## 伪造流量批量上线 (欺骗防御)
1111

12+
在这里有两种思路，一个是直接伪造流量欺骗新增 beacon
1213

14+
还有一种就是不断伪造会话，有两种途径：直接沙盒运行原始的样本，还有就是对样本中的连接配置进行解包，然后植入自己的 beacon 或者 SSH Session 中再大量执行，以造成堵塞的效果。
1315

1416
## 通过 CVE-2022-39197 反制攻击
1517

16-
## 对server端进行攻击反制
18+
## 对 server 端进行攻击反制
1719

1820
## 旁路反制
1921

‎docs/CheatSheet/Windows_post-exploitation.md‎

Lines changed: 324 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,324 @@
1+
# Windows 后渗透
2+
3+
## 文件挖掘回传
4+
5+
```powershell
6+
Get-ChildItem -Path E:\ -Filter Web.Config -Recurse -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
7+
8+
Compress-Archive -Path (Get-ChildItem -Path "E:\" -Filter "Web.Config" -Recurse -ErrorAction SilentlyContinue).FullName -DestinationPath "C:\Windows\Temp\webconfigs.zip"
9+
10+
Get-ChildItem -Path "E:\" -Filter "web.config" -Recurse -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName.Substring(3) } | Set-Content "C:\Windows\Temp\webconfigs.txt" -Encoding utf8
11+
# 切换为 cmd
12+
C:\Windows\Temp\7zr.exe a -t7z "C:\Windows\Temp\webconfigs.7z" -scsUTF-8 @"C:\Windows\Temp\webconfigs.txt"
13+
```
14+
15+
## Internet Information Services (IIS)
16+
17+
### 列出网站目录
18+
19+
```bash
20+
c:\windows\system32\inetsrv\appcmd list vdir
21+
```
22+
23+
## Microsoft Defender
24+
25+
### 查询排除项
26+
27+
```powershell
28+
Get-MpPreference | Select-Object -Property ExclusionPath, ExclusionProcess, ExclusionExtension
29+
```
30+
31+
添加排除项
32+
33+
```powershell
34+
Add-MpPreference -ExclusionPath "D:\MySafeFolder"
35+
Add-MpPreference -ExclusionPath "C:\Windows\Temp"
36+
Add-MpPreference -ExclusionPath "C:\Windows\System32"
37+
Add-MpPreference -ExclusionPath "C:\Users\Public\Libraries"
38+
```
39+
40+
取消排除项
41+
42+
```powershell
43+
Remove-MpPreference -ExclusionPath "C:\Windows\Temp"
44+
```
45+
46+
查询情报
47+
48+
```powershell
49+
Get-MpThreatDetection
50+
```
51+
52+
删除情报
53+
54+
```bash
55+
"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDynamicSignature
56+
57+
# Powershell
58+
Remove-Item "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\*" -Recurse -Force
59+
```
60+
61+
## Vmware Workstation
62+
63+
```bash
64+
"C:\Program Files (x86)\VMware\VMware Player\vmrun.exe"
65+
"C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe"
66+
```
67+
68+
收集所有在运行的虚拟机
69+
70+
需要注意的是，这里运行命令进行查询的权限需要与运行虚拟机的用户权限一致，过高或者过低都会导致查询不到虚拟机
71+
72+
```bash
73+
"C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe" list
74+
```
75+
76+
收集所有的虚拟机网卡
77+
78+
```bash
79+
"C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe" listHostNetworks
80+
```
81+
82+
获取虚拟机网卡地址
83+
84+
```bash
85+
"C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe" -T ws getGuestIPAddress "E:\WIN11E TS - TPE NEW GRM 09\WIN11E TS - TPE.vmx" -wait
86+
```
87+
88+
制作快照
89+
90+
```bash
91+
"C:\Program Files (x86)\VMware\VMware Player\vmrun.exe" -T ws snapshot "C:\VM\WinServer_2012R2\Windows Server 2012.vmx" 2025-07-11
92+
```
93+
94+
## 工具参考
95+
96+
### vmrun
97+
98+
```bash
99+
vmrun version 1.17.0 build-20800274
100+
101+
Usage: vmrun [AUTHENTICATION-FLAGS] COMMAND [PARAMETERS]
102+
103+
104+
105+
AUTHENTICATION-FLAGS
106+
--------------------
107+
These must appear before the command and any command parameters.
108+
109+
-T <hostType> (ws|fusion||player)
110+
-vp <password for encrypted virtual machine>
111+
-gu <userName in guest OS>
112+
-gp <password in guest OS>
113+
114+
115+
116+
POWER COMMANDS PARAMETERS DESCRIPTION
117+
-------------- ---------- -----------
118+
start Path to vmx file Start a VM or Team
119+
[gui|nogui]
120+
121+
stop Path to vmx file Stop a VM or Team
122+
[hard|soft]
123+
124+
reset Path to vmx file Reset a VM or Team
125+
[hard|soft]
126+
127+
suspend Path to vmx file Suspend a VM or Team
128+
[hard|soft]
129+
130+
pause Path to vmx file Pause a VM
131+
132+
unpause Path to vmx file Unpause a VM
133+
134+
135+
136+
SNAPSHOT COMMANDS PARAMETERS DESCRIPTION
137+
----------------- ---------- -----------
138+
listSnapshots Path to vmx file List all snapshots in a VM
139+
[showTree]
140+
141+
snapshot Path to vmx file Create a snapshot of a VM
142+
Snapshot name
143+
144+
deleteSnapshot Path to vmx file Remove a snapshot from a VM
145+
Snapshot name
146+
[andDeleteChildren]
147+
148+
revertToSnapshot Path to vmx file Set VM state to a snapshot
149+
Snapshot name
150+
151+
152+
153+
HOST NETWORK COMMANDS PARAMETERS DESCRIPTION
154+
--------------------- ---------- -----------
155+
listHostNetworks List all networks in the host
156+
157+
listPortForwardings Host network name List all available port forwardings on a host network
158+
159+
160+
setPortForwarding Host network name Add or update a port forwarding on a host network
161+
Protocol
162+
Host port
163+
Guest ip
164+
Guest port
165+
[Description]
166+
167+
deletePortForwarding Host network name Delete a port forwarding on a host network
168+
Protocol
169+
Host port
170+
171+
172+
173+
174+
GUEST OS COMMANDS PARAMETERS DESCRIPTION
175+
----------------- ---------- -----------
176+
runProgramInGuest Path to vmx file Run a program in Guest OS
177+
[-noWait]
178+
[-activeWindow]
179+
[-interactive]
180+
Complete-Path-To-Program
181+
[Program arguments]
182+
183+
fileExistsInGuest Path to vmx file Check if a file exists in Guest OS
184+
Path to file in guest
185+
186+
directoryExistsInGuest Path to vmx file Check if a directory exists in Guest OS
187+
Path to directory in guest
188+
189+
setSharedFolderState Path to vmx file Modify a Host-Guest shared folder
190+
Share name
191+
Host path
192+
writable | readonly
193+
194+
addSharedFolder Path to vmx file Add a Host-Guest shared folder
195+
Share name
196+
New host path
197+
198+
removeSharedFolder Path to vmx file Remove a Host-Guest shared folder
199+
Share name
200+
201+
enableSharedFolders Path to vmx file Enable shared folders in Guest
202+
[runtime]
203+
204+
disableSharedFolders Path to vmx file Disable shared folders in Guest
205+
[runtime]
206+
207+
listProcessesInGuest Path to vmx file List running processes in Guest OS
208+
209+
killProcessInGuest Path to vmx file Kill a process in Guest OS
210+
process id
211+
212+
runScriptInGuest Path to vmx file Run a script in Guest OS
213+
[-noWait]
214+
[-activeWindow]
215+
[-interactive]
216+
Interpreter path
217+
Script text
218+
219+
deleteFileInGuest Path to vmx file Delete a file in Guest OS
220+
Path in guest
221+
222+
createDirectoryInGuest Path to vmx file Create a directory in Guest OS
223+
Directory path in guest
224+
225+
deleteDirectoryInGuest Path to vmx file Delete a directory in Guest OS
226+
Directory path in guest
227+
228+
CreateTempfileInGuest Path to vmx file Create a temporary file in Guest OS
229+
230+
listDirectoryInGuest Path to vmx file List a directory in Guest OS
231+
Directory path in guest
232+
233+
CopyFileFromHostToGuest Path to vmx file Copy a file from host OS to guest OS
234+
Path on host
235+
Path in guest
236+
237+
CopyFileFromGuestToHost Path to vmx file Copy a file from guest OS to host OS
238+
Path in guest
239+
Path on host
240+
241+
renameFileInGuest Path to vmx file Rename a file in Guest OS
242+
Original name
243+
New name
244+
245+
typeKeystrokesInGuest Path to vmx file Type Keystrokes in Guest OS
246+
keystroke string
247+
248+
connectNamedDevice Path to vmx file Connect the named device in the Guest OS
249+
device name
250+
251+
disconnectNamedDevice Path to vmx file Disconnect the named device in the Guest OS
252+
device name
253+
254+
captureScreen Path to vmx file Capture the screen of the VM to a local file
255+
Path on host
256+
257+
writeVariable Path to vmx file Write a variable in the VM state
258+
[runtimeConfig|guestEnv|guestVar]
259+
variable name
260+
variable value
261+
262+
readVariable Path to vmx file Read a variable in the VM state
263+
[runtimeConfig|guestEnv|guestVar]
264+
variable name
265+
266+
getGuestIPAddress Path to vmx file Gets the IP address of the guest
267+
[-wait]
268+
269+
270+
271+
GENERAL COMMANDS PARAMETERS DESCRIPTION
272+
---------------- ---------- -----------
273+
list List all running VMs
274+
275+
upgradevm Path to vmx file Upgrade VM file format, virtual hw
276+
277+
installTools Path to vmx file Install Tools in Guest
278+
279+
checkToolsState Path to vmx file Check the current Tools state
280+
281+
deleteVM Path to vmx file Delete a VM
282+
283+
clone Path to vmx file Create a copy of the VM
284+
Path to destination vmx file
285+
full|linked
286+
[-snapshot=Snapshot Name]
287+
[-cloneName=Name]
288+
289+
290+
291+
Template VM COMMANDS PARAMETERS DESCRIPTION
292+
--------------------- ---------- -----------
293+
downloadPhotonVM Path for new VM Download Photon VM
294+
295+
296+
297+
298+
299+
Examples:
300+
301+
302+
Starting a virtual machine with Workstation on a Windows host
303+
vmrun -T ws start "c:\my VMs\myVM.vmx"
304+
305+
306+
Running a program in a virtual machine with Workstation on a Windows host with Windows guest
307+
vmrun -T ws -gu guestUser -gp guestPassword runProgramInGuest "c:\my VMs\myVM.vmx" "c:\Program Files\myProgram.exe"
308+
309+
310+
Creating a snapshot of a virtual machine with Workstation on a Windows host
311+
vmrun -T ws snapshot "c:\my VMs\myVM.vmx" mySnapshot
312+
313+
314+
Reverting to a snapshot with Workstation on a Windows host
315+
vmrun -T ws revertToSnapshot "c:\my VMs\myVM.vmx" mySnapshot
316+
317+
318+
Deleting a snapshot with Workstation on a Windows host
319+
vmrun -T ws deleteSnapshot "c:\my VMs\myVM.vmx" mySnapshot
320+
321+
322+
Enabling Shared Folders with Workstation on a Windows host
323+
vmrun -T ws enableSharedFolders "c:\my VMs\myVM.vmx"
324+
```

‎docusaurus.config.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,12 @@ const config = {
105105
position: 'left',
106106
label: '证书',
107107
},
108+
{
109+
type: 'docSidebar',
110+
sidebarId: 'CheatSheet_Sidebar',
111+
position: 'left',
112+
label: 'CheatSheet',
113+
},
108114
{
109115
type: 'docSidebar',
110116
sidebarId: 'CTF_Sidebar',

‎sidebars.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,12 @@ const sidebars = {
5757
dirName: 'Certificate'
5858
}
5959
],
60+
CheatSheet_Sidebar: [
61+
{
62+
type: 'autogenerated',
63+
dirName: 'CheatSheet'
64+
}
65+
],
6066
};
6167

6268
module.exports = sidebars;

0 commit comments

Comments
 (0)