# 06 Intranet And Host Operations Integrated

This integrated file merges the intranet playbook references into one host and internal-operations knowledge layer.

## Use This File When

- the task moves from Internet-facing assessment into host, domain, or internal-network operations
- you need integrated material for credential access, lateral movement, privilege escalation, persistence, tunneling, AD, ADCS, Exchange, or SharePoint
- the workflow already has the access or foothold needed to evaluate internal exposure

## Topic Clusters

- movement: PsExec, WMI, WinRM, DCOM, SSH, RDP, pass-the-hash, pass-the-ticket
- stealth and evasion: AMSI bypass, ETW patching, injection, masquerading, signed binary abuse
- credential access: Mimikatz, Kerberoasting, DCSync, browser and vault extraction
- escalation and persistence: token abuse, service abuse, Potato family, cron, registry, WMI, tasks
- tunneling and proxy: FRP, Chisel, Ligolo, SOCKS, SSH forwarding, DNS and ICMP tunnels
- domain operations: BloodHound, AD attacks, ADCS abuse, Exchange and SharePoint attack paths

## Recommended Read Path

1. Start from the objective: move, steal creds, escalate, persist, tunnel, or map the domain.
2. Read the matching source block first.
3. Use the later AD, ADCS, Exchange, and SharePoint sections only when the environment scope justifies them.
4. Pair this file with `05-tools-and-operations-integrated.md` when you need supporting commands.

## Boundary Rule

This document is for authorized host and internal-network testing. If the real blocker is still initial request recovery or Internet-facing replay, return to the earlier methodology and client workflow references first.

## Included Sources

- references\intranet-playbook-01-lateral-movement.md
- references\intranet-playbook-02-evasion-and-anti-detection.md
- references\intranet-playbook-03-credential-theft.md
- references\intranet-playbook-04-privilege-escalation.md
- references\intranet-playbook-05-persistence.md
- references\intranet-playbook-06-tunneling-and-proxy.md
- references\intranet-playbook-07-information-gathering.md
- references\intranet-playbook-08-active-directory-attacks.md
- references\intranet-playbook-09-adcs-attacks.md
- references\intranet-playbook-10-exchange-attacks.md
- references\intranet-playbook-11-sharepoint-attacks.md
- references\intranet-playbook-index.md

---

## Source: 01-lateral-movement.md

Path: references\intranet-playbook-01-lateral-movement.md

# 横向移动
English: Lateral Movement
- Entry Count: 16
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## PsExec横向移动
- ID: lateral-psexec
- Difficulty: intermediate
- Subcategory: SMB
- Tags: psexec, lateral, smb, windows
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-psexec.md
Description:
使用PsExec进行横向移动
Prerequisites:
- 目标机器开放445端口
- 拥有目标机器管理员凭证
- ADMIN$共享可访问
Execution Outline:
1. 基本使用
2. 使用哈希连接
3. 执行命令
4. Windows PsExec
Analysis:
PsExec通过SMB协议在目标机器创建服务并执行命令，成功后可获得目标机器的Shell。
OPSEC:
- PsExec会在目标机器创建服务，容易被检测
- 服务名称和二进制文件可能触发告警
- 考虑使用更隐蔽的横向移动方式
## WMI横向移动
- ID: lateral-wmi
- Difficulty: intermediate
- Subcategory: WMI
- Tags: wmi, lateral, windows, remote
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-wmi.md
Description:
使用WMI进行横向移动
Prerequisites:
- 目标机器开放135端口
- 拥有目标机器管理员凭证
- WMI服务可访问
Execution Outline:
1. WMI执行命令
2. Impacket wmiexec
3. 使用哈希
4. PowerShell WMI
Analysis:
WMI横向移动不会在目标机器创建服务，相对PsExec更隐蔽。
OPSEC:
- WMI执行不会留下明显的文件痕迹
- 但WMI活动可能被监控
- 命令输出通过临时文件获取
## Pass-the-Hash攻击
- ID: pass-the-hash
- Difficulty: intermediate
- Subcategory: 认证攻击
- Tags: pth, ntlm, hash, authentication
- Original Extracted Source: original extracted intranet-security-wiki source/pass-the-hash.md
Description:
使用NTLM哈希进行身份验证
Prerequisites:
- 获取用户NTLM哈希
- 目标机器允许NTLM认证
- 目标机器开放SMB/WMI端口
Execution Outline:
1. Impacket PtH
2. CrackMapExec PtH
3. Windows PtH
4. PowerShell PtH
Analysis:
PtH成功后可以该用户身份访问目标机器，无需明文密码。
OPSEC:
- PtH不会产生登录日志中的密码验证
- 但会留下网络登录日志
- 注意时间戳和来源IP
## NTLM Relay攻击
- ID: ntlm-relay
- Difficulty: advanced
- Subcategory: 认证攻击
- Tags: ntlm, relay, smb, authentication
- Original Extracted Source: original extracted intranet-security-wiki source/ntlm-relay.md
Description:
NTLM中继攻击技术
Prerequisites:
- 目标机器开放SMB端口
- 目标机器未启用SMB签名
- 可诱导目标机器认证
Execution Outline:
1. Responder监听
2. ntlmrelayx攻击
3. 中继到LDAP
4. IPv6中继
Analysis:
NTLM Relay成功后可以获取目标机器的访问权限或提升域权限。
OPSEC:
- 需要目标机器未启用SMB签名
- 域控制器默认启用签名
- IPv6中继更隐蔽
## WinRM横向移动
- ID: lateral-winrm
- Difficulty: intermediate
- Subcategory: WinRM
- Tags: winrm, lateral, powershell
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-winrm.md
Description:
通过WinRM进行横向移动
Prerequisites:
- WinRM启用
- 有效凭证
Execution Outline:
1. PowerShell远程
2. 执行命令
3. evil-winrm
## DCOM横向移动
- ID: lateral-dcom
- Difficulty: advanced
- Subcategory: DCOM
- Tags: dcom, lateral, com
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-dcom.md
Description:
通过DCOM进行横向移动
Prerequisites:
- DCOM启用
- 有效凭证
Execution Outline:
1. MMC20.Application
2. ShellBrowserWindow
3. Excel DCOM
## SSH横向移动
- ID: lateral-ssh
- Difficulty: beginner
- Subcategory: SSH
- Tags: ssh, lateral, linux
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-ssh.md
Description:
通过SSH进行横向移动
Prerequisites:
- SSH服务
- 有效凭证
Execution Outline:
1. SSH连接
2. SSH密钥认证
3. SSH跳板
## RDP会话劫持
- ID: rdp-hijack
- Difficulty: intermediate
- Subcategory: RDP
- Tags: rdp, hijack, session
- Original Extracted Source: original extracted intranet-security-wiki source/rdp-hijack.md
Description:
劫持已存在的RDP会话
Prerequisites:
- SYSTEM权限
- 存在RDP会话
Execution Outline:
1. 列出会话
2. 劫持会话
3. 使用Mimikatz
## Overpass-the-Hash
- ID: overpass-the-hash
- Difficulty: advanced
- Subcategory: PtH
- Tags: pth, kerberos, hash
- Original Extracted Source: original extracted intranet-security-wiki source/overpass-the-hash.md
Description:
使用哈希获取Kerberos票据
Prerequisites:
- 用户NTLM哈希
- 域环境
Execution Outline:
1. Mimikatz
2. Rubeus
3. Impacket
## Pass-the-Ticket
- ID: pass-the-ticket
- Difficulty: advanced
- Subcategory: PtT
- Tags: ptt, kerberos, ticket
- Original Extracted Source: original extracted intranet-security-wiki source/pass-the-ticket.md
Description:
使用Kerberos票据进行横向移动
Prerequisites:
- 有效Kerberos票据
Execution Outline:
1. 导出票据
2. 注入票据
3. Rubeus导入
## SMBExec横向移动
- ID: lateral-smbexec
- Difficulty: intermediate
- Subcategory: SMB
- Tags: smb, lateral, exec
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-smbexec.md
Description:
通过SMB执行命令
Prerequisites:
- SMB访问权限
- 管理员权限
Execution Outline:
1. Impacket smbexec
2. 通过服务执行
## ATExec横向移动
- ID: lateral-atexec
- Difficulty: intermediate
- Subcategory: 计划任务
- Tags: at, scheduled, lateral
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-atexec.md
Description:
通过计划任务执行命令
Prerequisites:
- 计划任务权限
- 管理员权限
Execution Outline:
1. Impacket atexec
2. schtasks
## WinRS横向移动
- ID: lateral-winrs
- Difficulty: beginner
- Subcategory: WinRS
- Tags: winrs, lateral, windows
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-winrs.md
Description:
通过WinRS执行远程命令
Prerequisites:
- WinRM启用
- 有效凭证
Execution Outline:
1. 执行命令
2. 获取Shell
## Excel DCOM横向移动
- ID: lateral-dcom-excel
- Difficulty: advanced
- Subcategory: DCOM
- Tags: dcom, excel, lateral
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-dcom-excel.md
Description:
利用Excel DCOM进行横向移动
Prerequisites:
- 目标安装Excel
- DCOM权限
Execution Outline:
1. Excel DCOM激活
2. 执行命令
3. Impacket DCOM
## MMC DCOM横向移动
- ID: lateral-dcom-mmc
- Difficulty: advanced
- Subcategory: DCOM
- Tags: dcom, mmc, lateral
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-dcom-mmc.md
Description:
利用MMC DCOM进行横向移动
Prerequisites:
- 目标安装MMC
- DCOM权限
Execution Outline:
1. MMC20.Application
2. Impacket执行
## RDP Relay攻击
- ID: rdp-relay
- Difficulty: advanced
- Subcategory: RDP
- Tags: rdp, relay, lateral
- Original Extracted Source: original extracted intranet-security-wiki source/rdp-relay.md
Description:
RDP中继攻击技术
Prerequisites:
- RDP服务可访问
- 存在NTLM认证
Execution Outline:
1. 设置中继
2. 诱导连接
3. PetitPotam组合

---

## Source: 02-evasion-and-anti-detection.md

Path: references\intranet-playbook-02-evasion-and-anti-detection.md

# 免杀与规避
English: Evasion & Anti-Detection
- Entry Count: 14
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## PowerShell免杀
- ID: evasion-powershell
- Difficulty: intermediate
- Subcategory: PowerShell
- Tags: powershell, evasion, obfuscation
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-powershell.md
Description:
PowerShell脚本免杀技术
Prerequisites:
- 目标机器访问权限
- Windows系统
Execution Outline:
1. 编码执行
2. 远程加载
3. 混淆变量名
4. 无文件执行
Analysis:
PowerShell免杀可以绕过杀毒软件检测执行恶意脚本。
OPSEC:
- PowerShell日志可能记录命令
- 考虑禁用日志
- 使用混淆技术
## AMSI绕过
- ID: amsi-bypass
- Difficulty: advanced
- Subcategory: AMSI绕过
- Tags: amsi, bypass, evasion
- Original Extracted Source: original extracted intranet-security-wiki source/amsi-bypass.md
Description:
绕过反恶意软件扫描接口
Prerequisites:
- PowerShell环境
- AMSI启用
Execution Outline:
1. 反射绕过
2. 内存修补
3. DLL劫持
4. 使用工具
## ETW Patch绕过
- ID: etw-patch
- Difficulty: advanced
- Subcategory: ETW
- Tags: etw, bypass, evasion
- Original Extracted Source: original extracted intranet-security-wiki source/etw-patch.md
Description:
禁用ETW监控
Prerequisites:
- 代码执行权限
Execution Outline:
1. PowerShell禁用ETW
2. C#禁用ETW
3. 修补ntdll
## API Unhooking
- ID: api-unhooking
- Difficulty: expert
- Subcategory: Unhooking
- Tags: unhooking, hook, evasion
- Original Extracted Source: original extracted intranet-security-wiki source/api-unhooking.md
Description:
移除EDR的API Hook
Prerequisites:
- 代码执行权限
Execution Outline:
1. 从磁盘还原
2. 从KnownDlls还原
3. Hell's Gate
## 进程注入
- ID: process-injection
- Difficulty: advanced
- Subcategory: 进程注入
- Tags: injection, process, evasion
- Original Extracted Source: original extracted intranet-security-wiki source/process-injection.md
Description:
将代码注入到其他进程
Prerequisites:
- 代码执行权限
Execution Outline:
1. 经典DLL注入
2. Process Hollowing
3. APC注入
## AppLocker绕过
- ID: applocker-bypass
- Difficulty: intermediate
- Subcategory: AppLocker
- Tags: applocker, bypass, evasion
- Original Extracted Source: original extracted intranet-security-wiki source/applocker-bypass.md
Description:
绕过AppLocker应用程序限制
Prerequisites:
- AppLocker限制环境
Execution Outline:
1. 使用白名单路径
2. LOLBAS利用
3. InstallUtil
4. MSBuild
## BlockDLLs技术
- ID: evasion-blockdlls
- Difficulty: advanced
- Subcategory: BlockDLLs
- Tags: evasion, blockdlls, edr
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-blockdlls.md
Description:
阻止非微软DLL加载
Prerequisites:
- Windows系统
- Cobalt Strike或其他工具
Execution Outline:
1. Cobalt Strike BlockDLLs
2. 进程创建时启用
3. C#实现
## Shellcode加密
- ID: evasion-shellcode-encrypt
- Difficulty: intermediate
- Subcategory: Shellcode加密
- Tags: evasion, shellcode, encrypt
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-shellcode-encrypt.md
Description:
加密Shellcode绕过静态检测
Prerequisites:
- Shellcode
- 加密工具
Execution Outline:
1. AES加密Shellcode
2. XOR加密
3. RC4加密
4. 多态加密
## 进程伪装
- ID: evasion-process-masq
- Difficulty: intermediate
- Subcategory: 进程伪装
- Tags: evasion, process, masquerade
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-process-masq.md
Description:
伪装进程名称和路径
Prerequisites:
- Windows系统
Execution Outline:
1. PPID欺骗
2. 进程参数欺骗
3. 进程镂空
## PPID欺骗
- ID: evasion-ppid-spoof
- Difficulty: intermediate
- Subcategory: PPID欺骗
- Tags: evasion, ppid, spoofing
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-ppid-spoof.md
Description:
伪造父进程ID
Prerequisites:
- Windows系统
- 父进程句柄
Execution Outline:
1. PowerShell实现
2. C#实现
3. Cobalt Strike
## DLL侧加载
- ID: evasion-dll-sideloading
- Difficulty: intermediate
- Subcategory: DLL侧加载
- Tags: evasion, dll, sideloading
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-dll-sideloading.md
Description:
利用DLL搜索顺序加载恶意DLL
Prerequisites:
- Windows系统
- 可执行文件
Execution Outline:
1. DLL劫持
2. DLL转发
3. 常见目标
## 参数欺骗
- ID: evasion-arg-spoofing
- Difficulty: advanced
- Subcategory: 参数欺骗
- Tags: evasion, argument, spoofing
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-arg-spoofing.md
Description:
欺骗进程参数显示
Prerequisites:
- Windows系统
Execution Outline:
1. 命令行欺骗
2. 环境变量欺骗
3. PEB修改
## 签名二进制利用
- ID: evasion-signed-binary
- Difficulty: intermediate
- Subcategory: 签名二进制
- Tags: evasion, signed, lolbin
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-signed-binary.md
Description:
利用微软签名二进制执行代码
Prerequisites:
- Windows系统
Execution Outline:
1. MSBuild
2. InstallUtil
3. Regsvcs/Regasm
4. Rundll32
## CLR注入
- ID: evasion-clr-injection
- Difficulty: advanced
- Subcategory: CLR注入
- Tags: evasion, clr, injection
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-clr-injection.md
Description:
CLR内存注入技术
Prerequisites:
- Windows系统
- .NET环境
Execution Outline:
1. CLR内存加载
2. C#实现
3. Cobalt Strike

---

## Source: 03-credential-theft.md

Path: references\intranet-playbook-03-credential-theft.md

# 凭证窃取
English: Credential Theft
- Entry Count: 20
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## Mimikatz凭证抓取
- ID: mimikatz-creds
- Difficulty: intermediate
- Subcategory: Mimikatz
- Tags: mimikatz, credentials, windows, lsass
- Original Extracted Source: original extracted intranet-security-wiki source/mimikatz-creds.md
Description:
使用Mimikatz抓取Windows系统凭证
Prerequisites:
- 需要管理员权限
- 需要绕过杀毒软件
- Windows系统
Execution Outline:
1. 抓取所有凭证
2. 导出LSASS
3. Pass-the-Hash
4. DCSync攻击
Analysis:
成功执行后可获取明文密码、NTLM哈希、Kerberos票据等凭证信息。
OPSEC:
- Mimikatz会被大多数杀软检测
- 使用混淆或内存加载绕过检测
- 优先考虑使用其他更隐蔽的工具
- 操作LSASS会触发EDR告警
## Kerberoasting攻击
- ID: kerberoasting
- Difficulty: intermediate
- Subcategory: Kerberos
- Tags: kerberoasting, kerberos, active-directory, spn
- Original Extracted Source: original extracted intranet-security-wiki source/kerberoasting.md
Description:
Kerberoasting攻击获取服务账户哈希
Prerequisites:
- 域环境
- 任意域用户凭证
- 域内存在SPN账户
Execution Outline:
1. 发现SPN
2. 请求服务票据
3. 导出票据
4. Rubeus请求
Analysis:
Kerberoasting可以获取服务账户的Kerberos票据，离线破解后得到明文密码。
OPSEC:
- Kerberoasting不需要高权限
- 只需要任意域用户凭证
- 建议使用RC4加密避免检测
## AS-REP Roasting
- ID: asreproasting
- Difficulty: intermediate
- Subcategory: Kerberos
- Tags: asreproasting, kerberos, active-directory
- Original Extracted Source: original extracted intranet-security-wiki source/asreproasting.md
Description:
AS-REP Roasting攻击获取用户哈希
Prerequisites:
- 域环境
- 域中存在禁用Pre-auth的用户
Execution Outline:
1. Rubeus攻击
2. Impacket攻击
3. 查找禁用Pre-auth用户
4. 破解哈希
Analysis:
AS-REP Roasting可以获取禁用Pre-auth用户的哈希，离线破解后得到明文密码。
OPSEC:
- 不需要任何凭证
- 只需要用户名
- 禁用Pre-auth是错误配置
## LaZagne凭证抓取
- ID: lazagne-creds
- Difficulty: beginner
- Subcategory: 工具
- Tags: lazagne, credentials, browsers, applications
- Original Extracted Source: original extracted intranet-security-wiki source/lazagne-creds.md
Description:
使用LaZagne抓取各种应用程序凭证
Prerequisites:
- 目标机器访问权限
- LaZagne工具
Execution Outline:
1. 抓取所有凭证
2. 浏览器凭证
3. WiFi凭证
4. 邮件客户端
Analysis:
LaZagne可以从浏览器、邮件客户端、数据库客户端等多种应用程序中提取保存的凭证。
OPSEC:
- LaZagne会被杀软检测
- 考虑使用混淆或内存加载
- 可以只运行特定模块
## SAM数据库导出
- ID: sam-dump
- Difficulty: intermediate
- Subcategory: SAM
- Tags: sam, hash, windows, local
- Original Extracted Source: original extracted intranet-security-wiki source/sam-dump.md
Description:
导出Windows SAM数据库获取本地账户哈希
Prerequisites:
- 管理员权限
- Windows系统
Execution Outline:
1. reg导出
2. Impacket解析
3. Mimikatz导出
4. Volume Shadow Copy
Analysis:
SAM数据库包含本地账户的NTLM哈希，可以用于破解或Pass-the-Hash。
OPSEC:
- 需要管理员权限
- 操作注册表可能触发告警
- 卷影副本方法更隐蔽
## NTDS.dit导出
- ID: ntds-dump
- Difficulty: advanced
- Subcategory: NTDS
- Tags: ntds, active-directory, hash, domain
- Original Extracted Source: original extracted intranet-security-wiki source/ntds-dump.md
Description:
导出Active Directory数据库获取所有域用户哈希
Prerequisites:
- 域管理员权限
- 域控制器访问权限
Execution Outline:
1. ntdsutil快照
2. Volume Shadow Copy
3. Impacket解析
4. Impacket远程转储
Analysis:
NTDS.dit包含域内所有用户的哈希，可以用于破解或Pass-the-Hash。
OPSEC:
- 需要域管理员权限
- DCSync方法更隐蔽
- 操作可能触发大量告警
## GPP密码提取
- ID: gpp-password
- Difficulty: beginner
- Subcategory: GPP
- Tags: gpp, group-policy, password, xml
- Original Extracted Source: original extracted intranet-security-wiki source/gpp-password.md
Description:
提取组策略首选项中的密码
Prerequisites:
- 域环境
- 任意域用户凭证
Execution Outline:
1. 查找GPP文件
2. PowerShell查找
3. PowerView提取
4. gpp-decrypt
Analysis:
GPP密码使用公开的密钥加密，可以被解密获取明文密码。
OPSEC:
- GPP密码是常见的信息泄露点
- 只需要普通域用户权限
- MS14-025修复后新密码不会被存储
## Mimikatz高级技巧
- ID: mimikatz-advanced
- Difficulty: expert
- Subcategory: Mimikatz
- Tags: mimikatz, credentials, advanced
- Original Extracted Source: original extracted intranet-security-wiki source/mimikatz-advanced.md
Description:
Mimikatz高级凭证提取和利用技术
Prerequisites:
- 管理员权限
- Mimikatz工具
Execution Outline:
1. DCSync攻击
2. 黄金票据生成
3. 白银票据生成
4. Skeleton Key植入
## 浏览器凭证提取
- ID: browser-creds
- Difficulty: intermediate
- Subcategory: 浏览器
- Tags: browser, credentials, chrome, firefox
- Original Extracted Source: original extracted intranet-security-wiki source/browser-creds.md
Description:
从浏览器中提取保存的密码和Cookie
Prerequisites:
- 用户权限
- 浏览器已保存密码
Execution Outline:
1. Chrome密码提取
2. Chrome Cookie提取
3. 使用SharpWeb
4. 使用HackBrowserData
## DPAPI凭证提取
- ID: dpapi-creds
- Difficulty: advanced
- Subcategory: DPAPI
- Tags: dpapi, credentials, windows
- Original Extracted Source: original extracted intranet-security-wiki source/dpapi-creds.md
Description:
从DPAPI保护存储中提取凭证
Prerequisites:
- 用户权限
- DPAPI master key
Execution Outline:
1. 枚举DPAPI凭据
2. 使用Mimikatz解密
3. 获取Master Key
## RDP凭证提取
- ID: rdp-creds
- Difficulty: intermediate
- Subcategory: RDP
- Tags: rdp, credentials, windows
- Original Extracted Source: original extracted intranet-security-wiki source/rdp-creds.md
Description:
提取保存的RDP连接密码
Prerequisites:
- 用户权限
- 已保存RDP密码
Execution Outline:
1. 查找RDP文件
2. 提取RDP密码
3. 使用Mimikatz
## WiFi凭证提取
- ID: wifi-creds
- Difficulty: beginner
- Subcategory: WiFi
- Tags: wifi, credentials, windows
- Original Extracted Source: original extracted intranet-security-wiki source/wifi-creds.md
Description:
提取保存的WiFi密码
Prerequisites:
- 管理员权限
- 已连接WiFi
Execution Outline:
1. 列出WiFi配置文件
2. 提取WiFi密码
## Windows Vault凭证
- ID: vault-creds
- Difficulty: intermediate
- Subcategory: Vault
- Tags: vault, credentials, windows
- Original Extracted Source: original extracted intranet-security-wiki source/vault-creds.md
Description:
从Windows凭据管理器提取凭证
Prerequisites:
- 用户权限
- 已保存凭据
Execution Outline:
1. 列出Vault凭据
2. 导出Vault凭据
3. 使用Mimikatz
## KeePass凭证提取
- ID: keepass-dump
- Difficulty: advanced
- Subcategory: KeePass
- Tags: keepass, credentials, password-manager
- Original Extracted Source: original extracted intranet-security-wiki source/keepass-dump.md
Description:
从KeePass数据库提取密码
Prerequisites:
- KeePass数据库文件
- 主密码或内存转储
Execution Outline:
1. 查找KeePass数据库
2. 内存提取主密码
3. 使用KeeThief
## LSA Secrets提取
- ID: lsa-secrets
- Difficulty: advanced
- Subcategory: LSA
- Tags: lsa, secrets, windows
- Original Extracted Source: original extracted intranet-security-wiki source/lsa-secrets.md
Description:
从LSA Secrets提取敏感数据
Prerequisites:
- SYSTEM权限
Execution Outline:
1. 使用Mimikatz
2. 使用reg save
3. 使用Impacket
## 缓存凭证提取
- ID: cached-creds
- Difficulty: advanced
- Subcategory: 缓存
- Tags: cached, credentials, domain
- Original Extracted Source: original extracted intranet-security-wiki source/cached-creds.md
Description:
提取域缓存凭证
Prerequisites:
- SYSTEM权限
- 域环境
Execution Outline:
1. 使用Mimikatz
2. 使用reg save
3. 离线破解
## DCSync攻击
- ID: dcsync-attack
- Difficulty: expert
- Subcategory: 域渗透
- Tags: dcsync, domain-controller, mimikatz
- Original Extracted Source: original extracted intranet-security-wiki source/dcsync-attack.md
Description:
模拟域控制器同步获取凭证
Prerequisites:
- 域管理员权限或特定权限
Execution Outline:
1. 使用Mimikatz
2. 使用impacket
3. 导出所有哈希
4. 权限要求
## 黄金票据攻击
- ID: golden-ticket
- Difficulty: expert
- Subcategory: 域持久化
- Tags: golden-ticket, krbtgt, kerberos
- Original Extracted Source: original extracted intranet-security-wiki source/golden-ticket.md
Description:
使用krbtgt哈希生成黄金票据
Prerequisites:
- krbtgt账户哈希
- 域SID
Execution Outline:
1. 获取krbtgt哈希
2. 获取域SID
3. 生成黄金票据
4. 验证票据
## 白银票据攻击
- ID: silver-ticket
- Difficulty: advanced
- Subcategory: 域持久化
- Tags: silver-ticket, kerberos, service
- Original Extracted Source: original extracted intranet-security-wiki source/silver-ticket.md
Description:
使用服务账户哈希生成白银票据
Prerequisites:
- 服务账户哈希
- 域SID
Execution Outline:
1. 获取服务哈希
2. 生成白银票据
3. 常见服务类型
## 无人值守安装凭证提取
- ID: unattended-creds
- Difficulty: beginner
- Subcategory: 文件凭证
- Tags: credentials, unattend, sysprep, privilege-escalation, windows
- Original Extracted Source: original extracted intranet-security-wiki source/unattended-creds.md
Description:
从Windows无人值守安装文件(Unattend.xml/Sysprep)中提取明文或Base64编码的管理员凭证
Prerequisites:
- 本地文件系统读取权限
- 目标使用过无人值守部署
Execution Outline:
1. 搜索无人值守安装文件
2. 全盘搜索Unattend文件
3. 提取明文密码
4. 解码Base64密码
Analysis:
无人值守安装文件是Windows大规模部署的产物。这些XML文件中的<UserAccounts>/<AutoLogon>节点可能包含本地管理员或域管理员的明文/编码凭证。该漏洞在企业环境中极为常见，因为IT部门经常忽略部署后清理这些文件。
OPSEC:
- 读取文件操作通常不会触发警报，但大量文件搜索(dir /s)可能被EDR检测。建议直接检查已知路径而非全盘搜索。
External References:
- https://attack.mitre.org/techniques/T1552/001/

---

## Source: 04-privilege-escalation.md

Path: references\intranet-playbook-04-privilege-escalation.md

# 权限提升
English: Privilege Escalation
- Entry Count: 15
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## 令牌窃取与模拟
- ID: privilege-token
- Difficulty: advanced
- Subcategory: 令牌操作
- Tags: token, privilege, impersonation, windows
- Original Extracted Source: original extracted intranet-security-wiki source/privilege-token.md
Description:
窃取和模拟Windows访问令牌
Prerequisites:
- 已获得目标机器权限
- SeImpersonatePrivilege权限
- Windows系统
Execution Outline:
1. 列出令牌
2. 窃取令牌
3. JuicyPotato攻击
4. PrintSpoofer
Analysis:
令牌窃取成功后可以模拟高权限用户身份执行操作。
OPSEC:
- Potato系列工具利用DCOM机制
- 需要SeImpersonatePrivilege权限
- 不同Windows版本需要不同的CLSID
## Windows权限提升
- ID: windows-privesc
- Difficulty: intermediate
- Subcategory: Windows
- Tags: privesc, windows, privilege
- Original Extracted Source: original extracted intranet-security-wiki source/windows-privesc.md
Description:
Windows系统提权技术
Prerequisites:
- 普通用户权限
- 系统漏洞
Execution Outline:
1. 检查提权向量
2. 使用WinPEAS
3. 检查服务权限
4. 检查未引用服务路径
## Linux权限提升
- ID: linux-privesc
- Difficulty: intermediate
- Subcategory: Linux
- Tags: privesc, linux, privilege
- Original Extracted Source: original extracted intranet-security-wiki source/linux-privesc.md
Description:
Linux系统提权技术
Prerequisites:
- 普通用户权限
- 系统漏洞
Execution Outline:
1. 检查SUID
2. 检查Sudo
3. 检查Cron
4. 使用LinPEAS
## UAC绕过
- ID: uac-bypass
- Difficulty: intermediate
- Subcategory: UAC
- Tags: uac, bypass, windows
- Original Extracted Source: original extracted intranet-security-wiki source/uac-bypass.md
Description:
绕过Windows用户账户控制
Prerequisites:
- 管理员组成员
- UAC启用
Execution Outline:
1. Fodhelper
2. Eventvwr
3. 使用UACME
## DLL劫持
- ID: dll-hijack
- Difficulty: intermediate
- Subcategory: DLL
- Tags: dll, hijack, privesc
- Original Extracted Source: original extracted intranet-security-wiki source/dll-hijack.md
Description:
通过DLL劫持提权
Prerequisites:
- 可写目录
- DLL搜索顺序
Execution Outline:
1. 查找DLL劫持
2. 创建恶意DLL
3. 放置DLL
## 服务提权
- ID: service-exploit
- Difficulty: intermediate
- Subcategory: 服务
- Tags: service, privesc, windows
- Original Extracted Source: original extracted intranet-security-wiki source/service-exploit.md
Description:
通过服务漏洞提权
Prerequisites:
- 服务修改权限
- 可写服务路径
Execution Outline:
1. 检查服务权限
2. 修改服务路径
3. 重启服务
## AlwaysInstallElevated提权
- ID: always-install
- Difficulty: intermediate
- Subcategory: MSI
- Tags: msi, alwaysinstall, privesc
- Original Extracted Source: original extracted intranet-security-wiki source/always-install.md
Description:
利用AlwaysInstallElevated提权
Prerequisites:
- AlwaysInstallElevated启用
Execution Outline:
1. 检查设置
2. 创建MSI
3. 安装MSI
## Juicy Potato提权
- ID: juicy-potato
- Difficulty: advanced
- Subcategory: Potato
- Tags: juicy-potato, com, privesc
- Original Extracted Source: original extracted intranet-security-wiki source/juicy-potato.md
Description:
利用COM对象和SeImpersonatePrivilege提权
Prerequisites:
- SeImpersonatePrivilege
- Windows < 2019
Execution Outline:
1. 检查权限
2. 执行JuicyPotato
## PrintSpoofer提权
- ID: printspoofer
- Difficulty: advanced
- Subcategory: PrintSpoofer
- Tags: printspoofer, privesc, windows
- Original Extracted Source: original extracted intranet-security-wiki source/printspoofer.md
Description:
利用打印机服务提权
Prerequisites:
- SeImpersonatePrivilege
Execution Outline:
1. 执行PrintSpoofer
2. 指定命令
## GodPotato提权
- ID: godpotato
- Difficulty: advanced
- Subcategory: GodPotato
- Tags: godpotato, privesc, windows
- Original Extracted Source: original extracted intranet-security-wiki source/godpotato.md
Description:
GodPotato提权工具
Prerequisites:
- SeImpersonatePrivilege
Execution Outline:
1. 执行GodPotato
2. 反向Shell
## SUID提权
- ID: suid-exploit
- Difficulty: intermediate
- Subcategory: SUID
- Tags: suid, privesc, linux
- Original Extracted Source: original extracted intranet-security-wiki source/suid-exploit.md
Description:
利用SUID文件提权
Prerequisites:
- 存在SUID文件
- 可利用程序
Execution Outline:
1. 查找SUID
2. 常见可利用程序
3. GTFOBins
## Sudo提权
- ID: sudo-exploit
- Difficulty: intermediate
- Subcategory: Sudo
- Tags: sudo, privesc, linux
- Original Extracted Source: original extracted intranet-security-wiki source/sudo-exploit.md
Description:
利用Sudo配置提权
Prerequisites:
- Sudo权限配置不当
Execution Outline:
1. 检查Sudo权限
2. 常见利用
3. CVE-2021-3156
## Cron提权
- ID: cron-exploit
- Difficulty: intermediate
- Subcategory: Cron
- Tags: cron, privesc, linux
- Original Extracted Source: original extracted intranet-security-wiki source/cron-exploit.md
Description:
利用Cron任务提权
Prerequisites:
- 可写Cron脚本
- 通配符注入
Execution Outline:
1. 检查Cron任务
2. 检查脚本权限
3. 通配符注入
## 内核漏洞提权
- ID: kernel-exploit
- Difficulty: advanced
- Subcategory: 内核
- Tags: kernel, privesc, exploit
- Original Extracted Source: original extracted intranet-security-wiki source/kernel-exploit.md
Description:
利用内核漏洞提权
Prerequisites:
- 存在内核漏洞
- 可编译/执行exploit
Execution Outline:
1. 检查内核版本
2. 搜索exploit
3. 常见内核漏洞
## Potato系列提权攻击
- ID: potato-attack
- Difficulty: intermediate
- Subcategory: Potato提权
- Tags: privilege-escalation, potato, token-impersonation, ntlm-relay, windows
- Original Extracted Source: original extracted intranet-security-wiki source/potato-attack.md
Description:
利用Windows令牌模拟和NTLM中继机制从服务账户(SeImpersonatePrivilege/SeAssignPrimaryTokenPrivilege)提权到SYSTEM
Prerequisites:
- 拥有SeImpersonatePrivilege或SeAssignPrimaryTokenPrivilege权限
- 常见于IIS AppPool、SQL Server、各类服务账户
Execution Outline:
1. 检查当前权限
2. JuicyPotato (Windows Server 2016/2019)
3. PrintSpoofer (Windows 10/Server 2019+)
4. Sweet Potato (多技术集成)
Analysis:
Potato系列攻击利用Windows的令牌模拟机制——拥有SeImpersonatePrivilege的服务账户可以模拟向其认证的任何用户令牌。攻击者通过欺骗SYSTEM账户向本地COM服务器/命名管道认证，获取SYSTEM令牌后创建高权限进程。这是Web服务器(IIS)和数据库(SQL Server)提权最常见的方式之一。
OPSEC:
- 1) Potato工具的二进制文件特征明显，建议内存加载 2) 创建的命名管道名称可能被监控 3) 成功后立即清理工具和临时文件 4) 避免使用net user等敏感命令，改用更隐蔽的后渗透方式
External References:
- https://attack.mitre.org/techniques/T1134/001/
- https://github.com/BeichenDream/GodPotato

---

## Source: 05-persistence.md

Path: references\intranet-playbook-05-persistence.md

# 权限维持
English: Persistence
- Entry Count: 12
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## 注册表持久化
- ID: persistence-registry
- Difficulty: intermediate
- Subcategory: 注册表
- Tags: persistence, registry, windows, autorun
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-registry.md
Description:
通过注册表实现权限维持
Prerequisites:
- 已获得目标机器权限
- 管理员权限
- Windows系统
Execution Outline:
1. Run键持久化
2. RunOnce键
3. Winlogon Helper
4. 服务持久化
Analysis:
注册表持久化会在系统启动或用户登录时执行恶意程序。
OPSEC:
- Run键是最常见的持久化方式，容易被检测
- 考虑使用更隐蔽的方式
- 定期检查注册表异常项
## WMI持久化
- ID: persistence-wmi
- Difficulty: advanced
- Subcategory: WMI
- Tags: wmi, persistence, windows
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-wmi.md
Description:
通过WMI事件订阅实现持久化
Prerequisites:
- 管理员权限
Execution Outline:
1. 创建事件过滤器
2. 创建事件消费者
3. 绑定过滤器和消费者
## 启动文件夹持久化
- ID: persistence-startup
- Difficulty: beginner
- Subcategory: 启动文件夹
- Tags: startup, persistence, windows
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-startup.md
Description:
通过启动文件夹实现持久化
Prerequisites:
- 写入权限
Execution Outline:
1. 当前用户启动文件夹
2. 所有用户启动文件夹
## 服务持久化
- ID: persistence-service
- Difficulty: intermediate
- Subcategory: 服务
- Tags: service, persistence, windows
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-service.md
Description:
通过创建服务实现持久化
Prerequisites:
- 管理员权限
Execution Outline:
1. 创建服务
2. 启动服务
## DLL注入持久化
- ID: persistence-dll-injection
- Difficulty: advanced
- Subcategory: DLL注入
- Tags: dll, injection, persistence
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-dll-injection.md
Description:
通过DLL注入实现持久化
Prerequisites:
- 代码执行权限
- 目标进程
Execution Outline:
1. 创建恶意DLL
2. 注入DLL
3. AppInit_DLLs
## 后门用户
- ID: persistence-backdoor-user
- Difficulty: beginner
- Subcategory: 用户
- Tags: user, backdoor, persistence
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-backdoor-user.md
Description:
创建后门用户账户
Prerequisites:
- 管理员权限
Execution Outline:
1. 创建用户
2. 隐藏用户
3. 修改注册表隐藏
## 隐藏用户
- ID: persistence-hidden-user
- Difficulty: intermediate
- Subcategory: 隐藏用户
- Tags: hidden, user, persistence
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-hidden-user.md
Description:
创建隐藏的管理员用户
Prerequisites:
- SYSTEM权限
Execution Outline:
1. 创建用户
2. 添加到管理员组
3. 注册表隐藏
## 计划任务持久化
- ID: persistence-scheduled
- Difficulty: beginner
- Subcategory: 计划任务
- Tags: persistence, scheduled, task
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-scheduled.md
Description:
通过计划任务实现持久化
Prerequisites:
- 创建任务权限
Execution Outline:
1. 创建登录任务
2. 创建定时任务
3. PowerShell创建
4. Linux Cron
## Skeleton Key后门
- ID: skeleton-key
- Difficulty: advanced
- Subcategory: 域后门
- Tags: skeleton-key, backdoor, domain
- Original Extracted Source: original extracted intranet-security-wiki source/skeleton-key.md
Description:
在域控制器植入万能密码
Prerequisites:
- 域管理员权限
- 访问域控制器
Execution Outline:
1. 植入Skeleton Key
2. 使用万能密码
3. 检测方法
## DSRM后门
- ID: dsrm-backdoor
- Difficulty: expert
- Subcategory: 域后门
- Tags: dsrm, backdoor, domain
- Original Extracted Source: original extracted intranet-security-wiki source/dsrm-backdoor.md
Description:
利用DSRM账户建立后门
Prerequisites:
- 域管理员权限
- 访问域控制器
Execution Outline:
1. 获取DSRM密码
2. 同步DSRM密码
3. 启用DSRM账户
4. 使用DSRM登录
## SID History后门
- ID: sid-history
- Difficulty: advanced
- Subcategory: 域后门
- Tags: sid-history, backdoor, domain
- Original Extracted Source: original extracted intranet-security-wiki source/sid-history.md
Description:
利用SID History建立后门
Prerequisites:
- 域管理员权限
Execution Outline:
1. 添加SID History
2. 验证SID History
3. 使用后门
## 进程镂空持久化
- ID: persistence-process-hollowing
- Difficulty: expert
- Subcategory: 进程注入
- Tags: process-hollowing, persistence, injection
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-process-hollowing.md
Description:
利用进程镂空技术实现持久化
Prerequisites:
- 代码执行权限
Execution Outline:
1. 进程镂空原理
2. C#实现
3. 检测方法

---

## Source: 06-tunneling-and-proxy.md

Path: references\intranet-playbook-06-tunneling-and-proxy.md

# 隧道代理
English: Tunneling & Proxy
- Entry Count: 13
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## FRP内网穿透
- ID: tunnel-frp
- Difficulty: beginner
- Subcategory: TCP隧道
- Tags: frp, tunnel, proxy, nat
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-frp.md
Description:
使用FRP建立内网穿透隧道
Prerequisites:
- 公网服务器
- 内网机器可访问公网
- FRP工具
Execution Outline:
1. 服务端配置
2. 客户端配置
3. 启动服务端
4. 启动客户端
Analysis:
FRP可以建立TCP隧道，将内网服务映射到公网。
OPSEC:
- FRP流量可能被检测
- 考虑使用加密传输
- 注意隐藏进程
## Chisel内网穿透
- ID: tunnel-chisel
- Difficulty: beginner
- Subcategory: HTTP隧道
- Tags: chisel, tunnel, proxy, http
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-chisel.md
Description:
使用Chisel建立内网穿透隧道
Prerequisites:
- 公网服务器
- 内网机器可访问公网
- Chisel工具
Execution Outline:
1. 服务端
2. 反向SOCKS
3. 端口转发
Analysis:
Chisel可以建立HTTP隧道，穿透防火墙。
OPSEC:
- Chisel使用HTTP协议
- 可以绑定域名伪装
- 流量加密
## ReGeorg隧道
- ID: tunnel-regeorg
- Difficulty: intermediate
- Subcategory: ReGeorg
- Tags: tunnel, regeorg, proxy
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-regeorg.md
Description:
通过Web Shell建立隧道
Prerequisites:
- Web Shell上传
- 支持脚本语言
Execution Outline:
1. 上传隧道脚本
2. 建立隧道
3. 配置代理
## SSH本地转发
- ID: tunnel-ssh-local
- Difficulty: beginner
- Subcategory: SSH
- Tags: ssh, tunnel, local
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-ssh-local.md
Description:
SSH本地端口转发
Prerequisites:
- SSH访问权限
Execution Outline:
1. 本地转发
## SSH远程转发
- ID: tunnel-ssh-remote
- Difficulty: intermediate
- Subcategory: SSH
- Tags: ssh, tunnel, remote
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-ssh-remote.md
Description:
SSH远程端口转发
Prerequisites:
- SSH访问权限
Execution Outline:
1. 远程转发
## SSH动态转发
- ID: tunnel-ssh-dynamic
- Difficulty: intermediate
- Subcategory: SSH
- Tags: ssh, tunnel, socks
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-ssh-dynamic.md
Description:
SSH动态SOCKS代理
Prerequisites:
- SSH访问权限
Execution Outline:
1. 动态转发
2. 使用代理
## DNS隧道
- ID: tunnel-dns
- Difficulty: advanced
- Subcategory: DNS
- Tags: dns, tunnel, covert
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-dns.md
Description:
通过DNS协议建立隧道
Prerequisites:
- DNS解析权限
- 可控域名
Execution Outline:
1. 使用dnscat2
2. 客户端连接
3. 建立隧道
## ICMP隧道
- ID: tunnel-icmp
- Difficulty: advanced
- Subcategory: ICMP
- Tags: icmp, tunnel, covert
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-icmp.md
Description:
通过ICMP协议建立隧道
Prerequisites:
- ICMP允许通过
- 管理员权限
Execution Outline:
1. 使用icmptunnel
2. 客户端连接
## Ligolo隧道
- ID: tunnel-ligolo
- Difficulty: intermediate
- Subcategory: Ligolo
- Tags: ligolo, tunnel, proxy
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-ligolo.md
Description:
Ligolo内网穿透工具
Prerequisites:
- 可执行代理程序
Execution Outline:
1. 启动服务端
2. 运行代理
3. 创建隧道
## SOCKS代理
- ID: socks-proxy
- Difficulty: intermediate
- Subcategory: SOCKS
- Tags: socks, proxy, tunnel
- Original Extracted Source: original extracted intranet-security-wiki source/socks-proxy.md
Description:
建立SOCKS代理访问内网
Prerequisites:
- 已有内网访问点
Execution Outline:
1. SSH SOCKS代理
2. ProxyChains配置
3. Cobalt Strike SOCKS
4. Metasploit SOCKS
## Ngrok内网穿透
- ID: tunnel-ngrok
- Difficulty: beginner
- Subcategory: Ngrok
- Tags: ngrok, tunnel, penetration
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-ngrok.md
Description:
使用Ngrok建立内网穿透
Prerequisites:
- Ngrok账号
- 可访问外网
Execution Outline:
1. 安装Ngrok
2. HTTP隧道
3. TCP隧道
4. 自定义域名
## EW内网穿透
- ID: tunnel-ew
- Difficulty: intermediate
- Subcategory: EW
- Tags: ew, tunnel, socks
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-ew.md
Description:
使用EW建立内网穿透
Prerequisites:
- 已有内网访问点
Execution Outline:
1. 正向代理
2. 反向代理
3. 多级级联
## Venom内网穿透
- ID: tunnel-venom
- Difficulty: intermediate
- Subcategory: Venom
- Tags: venom, tunnel, socks
- Original Extracted Source: original extracted intranet-security-wiki source/tunnel-venom.md
Description:
使用Venom建立内网穿透
Prerequisites:
- 已有内网访问点
Execution Outline:
1. 启动服务端
2. 连接客户端
3. 建立SOCKS
4. 端口转发

---

## Source: 07-information-gathering.md

Path: references\intranet-playbook-07-information-gathering.md

# 信息收集
English: Information Gathering
- Entry Count: 12
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## BloodHound域分析
- ID: bloodhound-enumeration
- Difficulty: intermediate
- Subcategory: 域分析
- Tags: bloodhound, active-directory, enumeration, neo4j
- Original Extracted Source: original extracted intranet-security-wiki source/bloodhound-enumeration.md
Description:
使用BloodHound分析Active Directory攻击路径
Prerequisites:
- 域环境
- 域用户凭证
- BloodHound工具
Execution Outline:
1. SharpHound采集
2. PowerShell采集
3. bloodhound-python
4. 指定域控制器
Analysis:
BloodHound可发现域内的攻击路径，如权限提升路径、会话信息、组关系等。
OPSEC:
- BloodHound采集会产生大量LDAP查询
- 可能触发域控制器告警
- 建议在非工作时间执行
## SPN扫描
- ID: spn-scan
- Difficulty: beginner
- Subcategory: SPN
- Tags: spn, kerberos, enumeration
- Original Extracted Source: original extracted intranet-security-wiki source/spn-scan.md
Description:
扫描域内服务主体名称
Prerequisites:
- 域环境
- 任意域用户凭证
Execution Outline:
1. 查询所有SPN
2. PowerShell查询
3. Impacket查询
4. 查询特定服务
Analysis:
SPN扫描可以发现域内运行的服务账户，为Kerberoasting攻击做准备。
OPSEC:
- SPN查询是正常的域操作
- 不会触发明显告警
- 可用于后续Kerberoasting攻击
## 内网端口扫描
- ID: port-scan
- Difficulty: beginner
- Subcategory: 端口扫描
- Tags: nmap, port-scan, enumeration
- Original Extracted Source: original extracted intranet-security-wiki source/port-scan.md
Description:
内网端口扫描与服务识别
Prerequisites:
- 内网访问权限
- 扫描工具
Execution Outline:
1. 快速扫描
2. 全端口扫描
3. 服务识别
4. 内网存活探测
Analysis:
端口扫描可以发现内网中开放的服务，识别潜在的攻击目标。
OPSEC:
- 高速扫描可能触发IDS告警
- 建议使用较低速率
- 分时段进行扫描
## 域信息收集
- ID: domain-recon
- Difficulty: beginner
- Subcategory: 域信息
- Tags: active-directory, domain, enumeration
- Original Extracted Source: original extracted intranet-security-wiki source/domain-recon.md
Description:
Active Directory域环境信息收集
Prerequisites:
- 域环境
- 任意域用户凭证
Execution Outline:
1. 域信息
2. 域控制器
3. 域用户
4. 域管理员
Analysis:
域信息收集是内网渗透的基础，可以了解域结构、用户、组等信息。
OPSEC:
- 域信息收集是正常操作
- 不会触发明显告警
- 为后续攻击做准备
## 网络信息收集
- ID: network-recon
- Difficulty: beginner
- Subcategory: 网络信息
- Tags: network, enumeration, topology
- Original Extracted Source: original extracted intranet-security-wiki source/network-recon.md
Description:
内网网络拓扑和配置信息收集
Prerequisites:
- 内网访问权限
Execution Outline:
1. 网络配置
2. 路由表
3. ARP缓存
4. 网络连接
Analysis:
网络信息收集可以了解内网拓扑、网段划分、网关等信息。
OPSEC:
- 这些是正常的网络管理命令
- 不会触发告警
- 为后续横向移动做准备
## 共享枚举
- ID: share-enum
- Difficulty: beginner
- Subcategory: 共享
- Tags: smb, share, enumeration
- Original Extracted Source: original extracted intranet-security-wiki source/share-enum.md
Description:
枚举网络共享资源
Prerequisites:
- 内网访问权限
Execution Outline:
1. 枚举共享
2. 查看远程共享
3. SMBMap枚举
4. CrackMapExec枚举
Analysis:
共享枚举可以发现敏感文件、配置文件、备份文件等有价值的信息。
OPSEC:
- 共享枚举是正常操作
- 可能发现敏感文件
- 注意文件访问日志
## 用户枚举
- ID: user-enum
- Difficulty: beginner
- Subcategory: 用户
- Tags: user, enumeration, active-directory
- Original Extracted Source: original extracted intranet-security-wiki source/user-enum.md
Description:
枚举域内用户信息
Prerequisites:
- 域环境
- 任意域用户凭证
Execution Outline:
1. 列出域用户
2. 用户详细信息
3. PowerView枚举
4. 查找管理员
Analysis:
用户枚举可以发现高价值目标、活跃用户、服务账户等。
OPSEC:
- 用户枚举是正常操作
- 为后续攻击选择目标
- 注意识别蜜罐账户
## 组枚举
- ID: group-enum
- Difficulty: beginner
- Subcategory: 组
- Tags: group, enumeration, active-directory
- Original Extracted Source: original extracted intranet-security-wiki source/group-enum.md
Description:
枚举域内组信息
Prerequisites:
- 域环境
- 任意域用户凭证
Execution Outline:
1. 列出域组
2. 组成员
3. PowerView枚举
4. 查找高权限组
Analysis:
组枚举可以发现高权限组、组成员关系、嵌套组等。
OPSEC:
- 组枚举是正常操作
- 重点关注高权限组
- 注意嵌套组关系
## GPO枚举
- ID: gpo-enum
- Difficulty: intermediate
- Subcategory: GPO
- Tags: gpo, group-policy, enumeration
- Original Extracted Source: original extracted intranet-security-wiki source/gpo-enum.md
Description:
枚举组策略对象
Prerequisites:
- 域环境
- 任意域用户凭证
Execution Outline:
1. 列出GPO
2. PowerView枚举
3. GPO权限
4. GPP密码
Analysis:
GPO枚举可以发现组策略配置、GPP密码、受限组等信息。
OPSEC:
- GPP密码是常见的信息泄露点
- GPO可能包含敏感配置
- 注意GPO修改权限
## ACL枚举
- ID: acl-enum
- Difficulty: advanced
- Subcategory: ACL
- Tags: acl, access-control, enumeration
- Original Extracted Source: original extracted intranet-security-wiki source/acl-enum.md
Description:
枚举访问控制列表
Prerequisites:
- 域环境
- 任意域用户凭证
Execution Outline:
1. PowerView ACL枚举
2. 查找危险权限
3. 查找WriteDACL
4. 查找GenericAll
Analysis:
ACL枚举可以发现权限配置错误，如WriteDACL、GenericAll等危险权限。
OPSEC:
- ACL错误配置是常见的提权路径
- 重点关注高价值目标
- BloodHound可可视化ACL关系
## 信任关系枚举
- ID: trust-enum
- Difficulty: intermediate
- Subcategory: 信任关系
- Tags: trust, enumeration, active-directory
- Original Extracted Source: original extracted intranet-security-wiki source/trust-enum.md
Description:
枚举域信任关系
Prerequisites:
- 域环境
- 任意域用户凭证
Execution Outline:
1. 域信任关系
2. PowerView枚举
3. 森林信任
4. 信任详细信息
Analysis:
信任关系枚举可以发现跨域/跨森林攻击路径。
OPSEC:
- 信任关系可能提供跨域攻击路径
- 关注双向信任
- 注意SID历史问题
## 计算机枚举
- ID: computer-enum
- Difficulty: beginner
- Subcategory: 计算机
- Tags: computer, enumeration, active-directory
- Original Extracted Source: original extracted intranet-security-wiki source/computer-enum.md
Description:
枚举域内计算机
Prerequisites:
- 域环境
- 任意域用户凭证
Execution Outline:
1. 列出域计算机
2. PowerView枚举
3. 查找域控制器
4. 查找特定系统
Analysis:
计算机枚举可以发现域内所有计算机，识别高价值目标。
OPSEC:
- 计算机枚举是正常操作
- 重点关注域控制器和服务器
- 查找管理员会话

---

## Source: 08-active-directory-attacks.md

Path: references\intranet-playbook-08-active-directory-attacks.md

# 域渗透攻击
English: Active Directory Attacks
- Entry Count: 14
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## 域内权限提升路径
- ID: domain-privilege-escalation
- Difficulty: advanced
- Subcategory: 权限提升
- Tags: acl, privilege, active-directory, escalation
- Original Extracted Source: original extracted intranet-security-wiki source/domain-privilege-escalation.md
Description:
利用ACL错误配置进行域权限提升
Prerequisites:
- 域环境
- 普通域用户凭证
- BloodHound分析结果
Execution Outline:
1. BloodHound分析
2. 查找WriteDACL
3. 利用WriteDACL
4. 执行DCSync
Analysis:
域内ACL错误配置是常见的权限提升路径，可以通过BloodHound发现。
OPSEC:
- ACL修改会产生日志
- 优先使用隐蔽的权限
- BloodHound可以发现攻击路径
## 跨域信任攻击
- ID: domain-cross-trust
- Difficulty: advanced
- Subcategory: 跨域攻击
- Tags: trust, cross-domain, active-directory, forest
- Original Extracted Source: original extracted intranet-security-wiki source/domain-cross-trust.md
Description:
利用域信任关系进行跨域攻击
Prerequisites:
- 已获取源域权限
- 存在域信任关系
- 目标域信息
Execution Outline:
1. 枚举信任关系
2. 枚举森林信任
3. 跨域用户枚举
4. 跨域组枚举
Analysis:
跨域信任攻击可以利用信任关系从低安全域向高安全域移动。
OPSEC:
- 跨域攻击会产生日志
- SID History需要特殊权限
- 森林信任更安全
## Zerologon攻击
- ID: zerologon
- Difficulty: advanced
- Subcategory: Zerologon
- Tags: zerologon, cve-2020-1472, domain
- Original Extracted Source: original extracted intranet-security-wiki source/zerologon.md
Description:
CVE-2020-1472 Netlogon提权
Prerequisites:
- 可访问域控制器RPC
Execution Outline:
1. 检测漏洞
2. 利用漏洞
3. 导出哈希
4. 恢复密码
## PrintNightmare攻击
- ID: printnightmare
- Difficulty: advanced
- Subcategory: PrintNightmare
- Tags: printnightmare, cve-2021-34527, rce
- Original Extracted Source: original extracted intranet-security-wiki source/printnightmare.md
Description:
CVE-2021-34527 打印服务漏洞
Prerequisites:
- 可访问打印服务RPC
Execution Outline:
1. 检测漏洞
2. 利用漏洞
3. Impacket利用
## PetitPotam攻击
- ID: petitpotam
- Difficulty: advanced
- Subcategory: PetitPotam
- Tags: petitpotam, cve-2021-36942, relay
- Original Extracted Source: original extracted intranet-security-wiki source/petitpotam.md
Description:
CVE-2021-36942 强制认证攻击
Prerequisites:
- 可访问EFSRPC接口
Execution Outline:
1. 启动中继
2. 触发认证
3. 获取证书
## noPac/SAMAccountName攻击
- ID: samaccountname
- Difficulty: advanced
- Subcategory: noPac
- Tags: nopac, cve-2021-42278, privesc
- Original Extracted Source: original extracted intranet-security-wiki source/samaccountname.md
Description:
CVE-2021-42278/CVE-2021-42287 域提权
Prerequisites:
- 普通域用户权限
Execution Outline:
1. 检测漏洞
2. 利用漏洞
3. 攻击原理
## ADCS滥用攻击
- ID: adcs-abuse
- Difficulty: advanced
- Subcategory: ADCS
- Tags: adcs, certificate, domain
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-abuse.md
Description:
Active Directory证书服务滥用
Prerequisites:
- ADCS服务可访问
Execution Outline:
1. 枚举ADCS
2. 请求用户证书
3. Pass-the-Cert
4. Rubeus请求
## ADCS ESC1漏洞
- ID: adcs-esc1
- Difficulty: advanced
- Subcategory: ADCS
- Tags: adcs, esc1, certificate
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc1.md
Description:
证书模板ESC1滥用
Prerequisites:
- 存在ESC1配置的模板
Execution Outline:
1. 识别ESC1
2. 利用ESC1
3. 认证为域管
## 约束委派攻击
- ID: constrained-delegation
- Difficulty: advanced
- Subcategory: 委派攻击
- Tags: delegation, constrained, kerberos
- Original Extracted Source: original extracted intranet-security-wiki source/constrained-delegation.md
Description:
利用约束委派进行横向移动
Prerequisites:
- 存在约束委派配置的账户
Execution Outline:
1. 查找约束委派
2. 获取服务票据
3. 使用票据
## 基于资源的约束委派
- ID: resource-delegation
- Difficulty: expert
- Subcategory: 委派攻击
- Tags: rbcd, delegation, kerberos
- Original Extracted Source: original extracted intranet-security-wiki source/resource-delegation.md
Description:
利用RBCD进行权限提升
Prerequisites:
- 对目标对象有WriteDACL权限
Execution Outline:
1. 创建机器账户
2. 配置RBCD
3. 利用RBCD
## DCShadow攻击
- ID: dcshadow-attack
- Difficulty: expert
- Subcategory: DCShadow
- Tags: dcshadow, domain, injection
- Original Extracted Source: original extracted intranet-security-wiki source/dcshadow-attack.md
Description:
伪造域控制器注入数据
Prerequisites:
- 域管理员权限
- 可注册新DC
Execution Outline:
1. 注册伪造DC
2. 推送更改
3. 常见利用
## 组策略滥用
- ID: group-policy-abuse
- Difficulty: advanced
- Subcategory: 组策略
- Tags: gpo, group-policy, domain
- Original Extracted Source: original extracted intranet-security-wiki source/group-policy-abuse.md
Description:
滥用组策略进行横向移动
Prerequisites:
- GPO编辑权限
Execution Outline:
1. 查找可编辑GPO
2. 添加计划任务
3. 添加注册表项
## SAM The Admin攻击
- ID: sam-the-admin
- Difficulty: advanced
- Subcategory: SAM The Admin
- Tags: ad, cve-2021-42278, privilege
- Original Extracted Source: original extracted intranet-security-wiki source/sam-the-admin.md
Description:
CVE-2021-42278/CVE-2021-42287域提权
Prerequisites:
- 域用户权限
- 域控制器存在漏洞
Execution Outline:
1. 检测漏洞
2. 利用漏洞
3. 执行命令
## NoAuth攻击
- ID: noauth
- Difficulty: advanced
- Subcategory: NoAuth
- Tags: ad, cve-2022-33679, kerberos
- Original Extracted Source: original extracted intranet-security-wiki source/noauth.md
Description:
CVE-2022-33679 Kerberos认证绕过
Prerequisites:
- 域用户权限
- 目标账户有RC4密钥
Execution Outline:
1. 检测漏洞
2. 利用漏洞
3. 使用TGT

---

## Source: 09-adcs-attacks.md

Path: references\intranet-playbook-09-adcs-attacks.md

# ADCS攻击
English: ADCS Attacks
- Entry Count: 5
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## ADCS ESC2攻击
- ID: adcs-esc2
- Difficulty: advanced
- Subcategory: ESC2
- Tags: adcs, esc2, certificate
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc2.md
Description:
利用ESC2模板配置错误
Prerequisites:
- 域环境
- ADCS服务
- 存在ESC2模板
Execution Outline:
1. 探测ESC2模板
2. 请求证书
3. 使用证书认证
## ADCS ESC3攻击
- ID: adcs-esc3
- Difficulty: advanced
- Subcategory: ESC3
- Tags: adcs, esc3, certificate
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc3.md
Description:
利用ESC3注册代理配置错误
Prerequisites:
- 域环境
- ADCS服务
- 存在ESC3配置
Execution Outline:
1. 探测ESC3
2. 获取注册代理证书
3. 代表其他用户请求证书
## ADCS ESC4攻击
- ID: adcs-esc4
- Difficulty: advanced
- Subcategory: ESC4
- Tags: adcs, esc4, certificate
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc4.md
Description:
利用ESC4模板权限配置错误
Prerequisites:
- 域环境
- ADCS服务
- 对模板有写权限
Execution Outline:
1. 探测ESC4
2. 修改模板配置
3. 请求证书
4. 恢复模板配置
## ADCS ESC6攻击
- ID: adcs-esc6
- Difficulty: advanced
- Subcategory: ESC6
- Tags: adcs, esc6, certificate
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc6.md
Description:
利用ESC6编辑标志配置错误
Prerequisites:
- 域环境
- ADCS服务
- CA启用EDITF_ATTRIBUTESUBJECTALTNAME2
Execution Outline:
1. 探测ESC6
2. 请求证书
3. 使用证书认证
## ADCS ESC8攻击
- ID: adcs-esc8
- Difficulty: advanced
- Subcategory: ESC8
- Tags: adcs, esc8, ntlm-relay
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc8.md
Description:
利用ESC8 HTTP端点进行NTLM中继
Prerequisites:
- 域环境
- ADCS HTTP端点
- 可触发NTLM认证
Execution Outline:
1. 探测ESC8
2. 设置NTLM中继
3. 触发认证

---

## Source: 10-exchange-attacks.md

Path: references\intranet-playbook-10-exchange-attacks.md

# Exchange攻击
English: Exchange Attacks
- Entry Count: 5
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## ProxyLogon攻击
- ID: proxylogon
- Difficulty: advanced
- Subcategory: ProxyLogon
- Tags: exchange, proxylogon, cve-2021-26855
- Original Extracted Source: original extracted intranet-security-wiki source/proxylogon.md
Description:
CVE-2021-26855 Exchange SSRF
Prerequisites:
- Exchange可访问
Execution Outline:
1. 探测漏洞
2. 利用脚本
3. 手动利用
## ProxyShell攻击
- ID: proxyshell
- Difficulty: advanced
- Subcategory: ProxyShell
- Tags: exchange, proxyshell, cve-2021-34473
- Original Extracted Source: original extracted intranet-security-wiki source/proxyshell.md
Description:
CVE-2021-34473 Exchange RCE
Prerequisites:
- Exchange可访问
Execution Outline:
1. 探测漏洞
2. 利用脚本
3. 获取邮件
## Exchange枚举
- ID: exchange-enum
- Difficulty: beginner
- Subcategory: 枚举
- Tags: exchange, enum, recon
- Original Extracted Source: original extracted intranet-security-wiki source/exchange-enum.md
Description:
枚举Exchange服务和配置
Prerequisites:
- Exchange可访问
Execution Outline:
1. 版本探测
2. Autodiscover
3. 邮箱枚举
4. NTLM泄露
## ProxyToken攻击
- ID: exchange-proxytoken
- Difficulty: advanced
- Subcategory: ProxyToken
- Tags: exchange, proxytoken, bypass
- Original Extracted Source: original extracted intranet-security-wiki source/exchange-proxytoken.md
Description:
利用Exchange ProxyToken绕过认证
Prerequisites:
- Exchange服务器
- 存在漏洞
Execution Outline:
1. 检测漏洞
2. 利用漏洞
3. 访问邮箱
## Exchange邮箱访问
- ID: exchange-mailbox-access
- Difficulty: beginner
- Subcategory: 邮箱访问
- Tags: exchange, mailbox, access
- Original Extracted Source: original extracted intranet-security-wiki source/exchange-mailbox-access.md
Description:
通过各种方式访问Exchange邮箱
Prerequisites:
- Exchange凭证或漏洞
Execution Outline:
1. OWA访问
2. EWS访问
3. Outlook MAPI
4. 导出邮箱

---

## Source: 11-sharepoint-attacks.md

Path: references\intranet-playbook-11-sharepoint-attacks.md

# SharePoint攻击
English: SharePoint Attacks
- Entry Count: 2
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## SharePoint枚举
- ID: sharepoint-enum
- Difficulty: intermediate
- Subcategory: 枚举
- Tags: sharepoint, enum, recon
- Original Extracted Source: original extracted intranet-security-wiki source/sharepoint-enum.md
Description:
枚举SharePoint站点和文件
Prerequisites:
- SharePoint可访问
Execution Outline:
1. 站点枚举
2. 用户枚举
3. 文件枚举
4. 搜索文件
## SharePoint文件访问
- ID: sharepoint-file-access
- Difficulty: beginner
- Subcategory: 文件访问
- Tags: sharepoint, file, access
- Original Extracted Source: original extracted intranet-security-wiki source/sharepoint-file-access.md
Description:
访问SharePoint文档库中的文件
Prerequisites:
- SharePoint凭证或漏洞
Execution Outline:
1. Web界面访问
2. REST API访问
3. CSOM访问
4. OneDrive同步

---

## Source: index.md

Path: references\intranet-playbook-index.md

# Intranet Category Index

- 横向移动 (16): 01-lateral-movement.md
- 免杀与规避 (14): 02-evasion-and-anti-detection.md
- 凭证窃取 (20): 03-credential-theft.md
- 权限提升 (15): 04-privilege-escalation.md
- 权限维持 (12): 05-persistence.md
- 隧道代理 (13): 06-tunneling-and-proxy.md
- 信息收集 (12): 07-information-gathering.md
- 域渗透攻击 (14): 08-active-directory-attacks.md
- ADCS攻击 (5): 09-adcs-attacks.md
- Exchange攻击 (5): 10-exchange-attacks.md
- SharePoint攻击 (2): 11-sharepoint-attacks.md







