https://souljian.cn/tags/%E5%B7%A5%E5%85%B7%E7%B1%BB/Recent content in 工具类 on SoulJian小站Hugo -- gohugo.ioen-usSat, 29 Aug 2026 20:10:00 +0800https://souljian.cn/p/751088078/Sat, 29 Aug 2026 20:10:00 +0800https://souljian.cn/p/751088078/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>Vshell 是后渗透/红队工具，仅用于授权测试。对非授权目标上线 Agent 可能触犯法律。</p> <h2 id="一工具定位">一、工具定位 </h2><p>Vshell 是国内轻量级后渗透管理平台，定位类似简化版 Cobalt Strike：<strong>一台服务端，管理多台目标主机</strong>。</p> <p>核心能力：</p> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">服务端 + Agent 架构 </span></span><span class="line"><span class="cl">生成 Windows/Linux payload 上线 </span></span><span class="line"><span class="cl">命令执行、文件管理 </span></span><span class="line"><span class="cl">端口转发 / Socks 隧道 </span></span><span class="line"><span class="cl">横向移动辅助 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二影响与危害">二、影响与危害 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">批量管理失陷主机 </span></span><span class="line"><span class="cl">穿透网络做横向 </span></span><span class="line"><span class="cl">配合提权/抓凭据扩大战果 </span></span></code></pre></td></tr></table> </div> </div><p>风险等级：作为工具无风险，被滥用即“远程控制”级别的危害。</p> <h2 id="三使用--复现">三、使用 / 复现 </h2><h3 id="1-启动服务端">1. 启动服务端 </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Linux 上运行服务端并设置连接密码</span> </span></span><span class="line"><span class="cl">./Vshell_linux_amd64 -token YourToken </span></span></code></pre></td></tr></table> </div> </div><h3 id="2-生成-agentpayload">2. 生成 Agent（payload） </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">服务端 Web 界面/命令行生成 </span></span><span class="line"><span class="cl">选择目标系统（Windows/Linux） </span></span><span class="line"><span class="cl">生成可执行文件/脚本 </span></span></code></pre></td></tr></table> </div> </div><h3 id="3-目标执行上线">3. 目标执行上线 </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">把 Agent 投递到目标执行 </span></span><span class="line"><span class="cl">服务端出现上线主机列表 </span></span></code></pre></td></tr></table> </div> </div><h3 id="4-控制与后渗透">4. 控制与后渗透 </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">命令执行 </span></span><span class="line"><span class="cl">文件上传下载 </span></span><span class="line"><span class="cl">进程/端口查看 </span></span><span class="line"><span class="cl">Socks / 端口转发进内网 </span></span><span class="line"><span class="cl">配合 mimikatz 等抓凭据横向 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四检测对立面">四、检测（对立面） </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">Agent 有固定流量特征与回连结构 </span></span><span class="line"><span class="cl">异常外联、非常规端口 </span></span><span class="line"><span class="cl">进程/文件特征可被 EDR 识别 </span></span><span class="line"><span class="cl">服务端 IP/端口作为 IOC 封禁 </span></span></code></pre></td></tr></table> </div> </div><h2 id="五防御">五、防御 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">EDR 监控异常 Agent 上线与外联 </span></span><span class="line"><span class="cl">出站最小化，阻断回连 </span></span><span class="line"><span class="cl">异常端口/进程告警 </span></span><span class="line"><span class="cl">发现后先取证再清理 </span></span></code></pre></td></tr></table> </div> </div><h2 id="修复">修复 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">对已受影响目标：取证、清理、修复漏洞 </span></span><span class="line"><span class="cl">封禁工具回连地址与端口 </span></span><span class="line"><span class="cl">升级安全设备规则，补特征库 </span></span><span class="line"><span class="cl">复测：异常流量与特征消失 </span></span></code></pre></td></tr></table> </div> </div><h2 id="六小结">六、小结 </h2><p>Vshell 这类轻量 C2 让“单点失陷”迅速变成“集群控制”。红队用它做权限维持与横向，蓝队要抓<strong>异常外联 + Agent 特征 + EDR 告警</strong>。授权使用、注意流量特征，两件事都要记住。</p>