https://souljian.cn/tags/%E6%9C%8D%E5%8A%A1/Recent content in 服务 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088174/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088174/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>Windows 提权只在授权测试环境进行。</p> <h2 id="一windows-提权决策树">一、Windows 提权决策树 </h2><img src="https://souljian.cn/img/windows-privilege-escalation.svg" alt="Windows 提权决策树" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">普通用户 → SYSTEM 的 5 条路径： </span></span><span class="line"><span class="cl">① 内核漏洞 → ② 服务配置错误 → ③ 计划任务 → ④ AlwaysInstallElevated → ⑤ Token 操纵 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二常用工具">二、常用工具 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># winPEAS</span> </span></span><span class="line"><span class="cl">winPEAS.bat → 自动检测所有提权路径 </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># PowerUp</span> </span></span><span class="line"><span class="cl">Get-ServiceUnquoted · Get-ModifiableServiceFile </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">及时打补丁 · 最小权限原则 </span></span><span class="line"><span class="cl">禁止 AlwaysInstallElevated </span></span><span class="line"><span class="cl">审计服务配置 · 监控异常操作 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>Windows 提权的核心是<strong>发现配置错误</strong>。winPEAS + PowerUp 自动检测可覆盖 90% 的提权路径。</p>https://souljian.cn/p/751088240/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088240/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>本文讲端口知识，不涉及攻击。</p> <h2 id="一常见端口">一、常见端口 </h2><img src="https://souljian.cn/img/osi-tcp-model.svg" alt="常见端口" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">22=SSH · 80=HTTP · 443=HTTPS · 21=FTP · 23=Telnet </span></span><span class="line"><span class="cl">25=SMTP · 53=DNS · 110=POP3 · 143=IMAP · 3306=MySQL </span></span><span class="line"><span class="cl">3389=RDP · 445=SMB · 5432=PostgreSQL · 6379=Redis · 8080=Tomcat </span></span><span class="line"><span class="cl">1433=MSSQL · 1521=Oracle · 27017=MongoDB · 8443=HTTPS-alt </span></span></code></pre></td></tr></table> </div> </div><h2 id="二小结">二、小结 </h2><p>端口是网络服务的入口。<strong>熟知常见端口对应服务</strong>是端口扫描分析的基础。</p>