# Micro8

## Micro8

- [前言](https://micro8.gitbook.io/micro8/master.md)
- [Preface](https://micro8.gitbook.io/micro8/readme_en.md)
- [目录](https://micro8.gitbook.io/micro8/contents.md)
- [第一章：生](https://micro8.gitbook.io/micro8/contents-1.md)
- [1-10课](https://micro8.gitbook.io/micro8/contents-1/1-10.md)
- [第一课：windows提权-快速查找exp](https://micro8.gitbook.io/micro8/contents-1/1-10/1windows-ti-quan-kuai-su-cha-zhao-exp.md)
- [第二课：Linux提权-依赖exp篇](https://micro8.gitbook.io/micro8/contents-1/1-10/2linux-ti-quan-yi-lai-exp-pian.md)
- [第三课：Delphi代码审计--项目实战1](https://micro8.gitbook.io/micro8/contents-1/1-10/3delphi-dai-ma-shen-ji-xiang-mu-shi-zhan-1.md)
- [第四课：Asp代码审计--项目实战2](https://micro8.gitbook.io/micro8/contents-1/1-10/4asp-dai-ma-shen-ji-xiang-mu-shi-zhan-2.md)
- [第五课：工具介绍-Sqlmap](https://micro8.gitbook.io/micro8/contents-1/1-10/5-gong-ju-jie-shao-sqlmap.md)
- [第六课：反攻的一次溯源--项目实战3](https://micro8.gitbook.io/micro8/contents-1/1-10/6-fan-gong-de-yi-ci-su-yuan-xiang-mu-shi-zhan-3.md)
- [第七课：sql server 常用操作远程桌面语句](https://micro8.gitbook.io/micro8/contents-1/1-10/7sqlserver-chang-yong-cao-zuo-yuan-cheng-zhuo-mian-yu-ju.md)
- [第八课：模拟诉求任务攻击](https://micro8.gitbook.io/micro8/contents-1/1-10/8-mo-ni-su-qiu-ren-wu-gong-ji.md)
- [第九课：工具介绍-the-backdoor-factory](https://micro8.gitbook.io/micro8/contents-1/1-10/9-gong-ju-jie-shao-thebackdoorfactory.md)
- [第十课：msfvenom常用生成payload命令](https://micro8.gitbook.io/micro8/contents-1/1-10/10msfvenom-chang-yong-sheng-cheng-payload-ming-ling.md)
- [11-20课](https://micro8.gitbook.io/micro8/contents-1/11-20.md)
- [第十一课：工具介绍Veil-Evasion](https://micro8.gitbook.io/micro8/contents-1/11-20/11-gong-ju-jie-shao-veilevasion.md)
- [第十二课：基于UDP发现内网存活主机](https://micro8.gitbook.io/micro8/contents-1/11-20/12-ji-yu-udp-fa-xian-nei-wang-cun-huo-zhu-ji.md)
- [第十三课：基于ARP发现内网存活主机](https://micro8.gitbook.io/micro8/contents-1/11-20/13-ji-yu-arp-fa-xian-nei-wang-cun-huo-zhu-ji.md)
- [第十四课：基于第十课补充payload1](https://micro8.gitbook.io/micro8/contents-1/11-20/14-ji-yu-di-shi-ke-bu-chong-payload1.md)
- [第十五课：基于第十课补充payload2](https://micro8.gitbook.io/micro8/contents-1/11-20/15-ji-yu-di-shi-ke-bu-chong-payload2.md)
- [第十六课：红蓝对抗渗透测试1](https://micro8.gitbook.io/micro8/contents-1/11-20/16-hong-lan-dui-kang-shen-tou-ce-shi-1.md)
- [第十七课：红蓝对抗渗透测试2](https://micro8.gitbook.io/micro8/contents-1/11-20/17-hong-lan-dui-kang-shen-tou-ce-shi-2.md)
- [第十八课：红蓝对抗渗透测试3](https://micro8.gitbook.io/micro8/contents-1/11-20/18-hong-lan-dui-kang-shen-tou-ce-shi-3.md)
- [第十九课：基于netbios发现内网存活主机](https://micro8.gitbook.io/micro8/contents-1/11-20/19-ji-yu-netbios-fa-xian-nei-wang-cun-huo-zhu-ji.md)
- [第二十课：基于snmp发现内网存活主机](https://micro8.gitbook.io/micro8/contents-1/11-20/20-ji-yu-snmp-fa-xian-nei-wang-cun-huo-zhu-ji.md)
- [21-30课](https://micro8.gitbook.io/micro8/contents-1/21-30.md)
- [第二十一课：基于ICMP发现内网存活主机](https://micro8.gitbook.io/micro8/contents-1/21-30/21-ji-yu-icmp-fa-xian-nei-wang-cun-huo-zhu-ji.md)
- [第二十二课：基于SMB发现内网存活主机](https://micro8.gitbook.io/micro8/contents-1/21-30/22-ji-yu-smb-fa-xian-nei-wang-cun-huo-zhu-ji.md)
- [第二十三课：基于MSF发现内网存活主机第一季](https://micro8.gitbook.io/micro8/contents-1/21-30/23-ji-yu-msf-fa-xian-nei-wang-cun-huo-zhu-ji-di-yi-ji.md)
- [第二十四课：基于MSF发现内网存活主机第二季](https://micro8.gitbook.io/micro8/contents-1/21-30/24-ji-yu-msf-fa-xian-nei-wang-cun-huo-zhu-ji-di-er-ji.md)
- [第二十五课：基于MSF发现内网存活主机第三季](https://micro8.gitbook.io/micro8/contents-1/21-30/25-ji-yu-msf-fa-xian-nei-wang-cun-huo-zhu-ji-di-san-ji.md)
- [第二十六课：基于MSF发现内网存活主机第四季](https://micro8.gitbook.io/micro8/contents-1/21-30/26-ji-yu-msf-fa-xian-nei-wang-cun-huo-zhu-ji-di-si-ji.md)
- [第二十七课：基于MSF发现内网存活主机第五季](https://micro8.gitbook.io/micro8/contents-1/21-30/27-ji-yu-msf-fa-xian-nei-wang-cun-huo-zhu-ji-di-wu-ji.md)
- [第二十八课：基于MSF发现内网存活主机第六季](https://micro8.gitbook.io/micro8/contents-1/21-30/28-ji-yu-msf-fa-xian-nei-wang-cun-huo-zhu-ji-di-liu-ji.md)
- [第二十九课：发现目标WEB程序敏感目录第一季](https://micro8.gitbook.io/micro8/contents-1/21-30/29-fa-xian-mu-biao-web-cheng-xu-min-gan-mu-lu-di-yi-ji.md)
- [第三十课：解决msfvenom命令自动补全](https://micro8.gitbook.io/micro8/contents-1/21-30/30-jie-jue-msfvenom-ming-ling-zi-dong-bu-quan.md)
- [31-40课](https://micro8.gitbook.io/micro8/contents-1/31-40.md)
- [第三十一课：msf的前生今世](https://micro8.gitbook.io/micro8/contents-1/31-40/31msf-de-qian-sheng-jin-shi.md)
- [第三十二课：配置vps上的msf](https://micro8.gitbook.io/micro8/contents-1/31-40/32-pei-zhi-vps-shang-de-msf.md)
- [第三十三课：攻击Mysql服务](https://micro8.gitbook.io/micro8/contents-1/31-40/33-gong-ji-mysql-fu-wu.md)
- [第三十四课：攻击Sql server 服务](https://micro8.gitbook.io/micro8/contents-1/31-40/34-gong-ji-sqlserver-fu-wu.md)
- [第三十五课：与Sqlmap结合攻击](https://micro8.gitbook.io/micro8/contents-1/31-40/35-yu-sqlmap-jie-he-gong-ji.md)
- [第三十六课：解决vps上ssh掉线](https://micro8.gitbook.io/micro8/contents-1/31-40/36-jie-jue-vps-shang-ssh-diao-xian.md)
- [第三十七课：vbs一句话下载payload](https://micro8.gitbook.io/micro8/contents-1/31-40/37vbs-yi-ju-hua-xia-zai-payload.md)
- [第三十八课：certutil一句话下载payload](https://micro8.gitbook.io/micro8/contents-1/31-40/38certutil-yi-ju-hua-xia-zai-payload.md)
- [第三十九课：vbs一句话下载payload补充](https://micro8.gitbook.io/micro8/contents-1/31-40/39vbs-yi-ju-hua-xia-zai-payload-bu-chong.md)
- [第四十课：ftp一句话下载payload](https://micro8.gitbook.io/micro8/contents-1/31-40/40ftp-yi-ju-hua-xia-zai-payload.md)
- [41-50课](https://micro8.gitbook.io/micro8/contents-1/41-50.md)
- [第四十一课：bitsadmin一句话下载payload](https://micro8.gitbook.io/micro8/contents-1/41-50/41bitsadmin-yi-ju-hua-xia-zai-payload.md)
- [第四十二课：攻击FTP服务](https://micro8.gitbook.io/micro8/contents-1/41-50/42-gong-ji-ftp-fu-wu.md)
- [第四十三课：js一句话下载payload](https://micro8.gitbook.io/micro8/contents-1/41-50/43js-yi-ju-hua-xia-zai-payload.md)
- [第四十四课：ertutil一句话下载payload补充](https://micro8.gitbook.io/micro8/contents-1/41-50/44ertutil-yi-ju-hua-xia-zai-payload-bu-chong.md)
- [第四十五课：解决bat一句话下载payload黑窗](https://micro8.gitbook.io/micro8/contents-1/41-50/45-jie-jue-bat-yi-ju-hua-xia-zai-payload-hei-chuang.md)
- [第四十六课：powershell一句话下载payload](https://micro8.gitbook.io/micro8/contents-1/41-50/46powershell-yi-ju-hua-xia-zai-payload.md)
- [第四十七课：payload分离免杀思路](https://micro8.gitbook.io/micro8/contents-1/41-50/47payload-fen-li-mian-sha-si-lu.md)
- [第四十八课：payload分离免杀思路第二季](https://micro8.gitbook.io/micro8/contents-1/41-50/48payload-fen-li-mian-sha-si-lu-di-er-ji.md)
- [第四十九课：关于Powershell对抗安全软件](https://micro8.gitbook.io/micro8/contents-1/41-50/49-guan-yu-powershell-dui-kang-an-quan-ruan-jian.md)
- [第五十课：基于SqlDataSourceEnumerator发现内网存活主机](https://micro8.gitbook.io/micro8/contents-1/41-50/50-ji-yu-sqldatasourceenumerator-fa-xian-nei-wang-cun-huo-zhu-ji.md)
- [51-60课](https://micro8.gitbook.io/micro8/contents-1/51-60.md)
- [第五十一课：项目回忆：体系的本质是知识点串联](https://micro8.gitbook.io/micro8/contents-1/51-60/51-xiang-mu-hui-yi-ti-xi-de-ben-zhi-shi-zhi-shi-dian-chuan-lian.md)
- [第五十二课：渗透的本质是信息搜集](https://micro8.gitbook.io/micro8/contents-1/51-60/52-shen-tou-de-ben-zhi-shi-xin-xi-sou-ji.md)
- [第五十三课：内网渗透中的文件传输](https://micro8.gitbook.io/micro8/contents-1/51-60/53-nei-wang-shen-tou-zhong-de-wen-jian-chuan-shu.md)
- [第五十四课：基于Powershell做Socks 4-5代理](https://micro8.gitbook.io/micro8/contents-1/51-60/54-ji-yu-powershell-zuo-socks45-dai-li.md)
- [第五十五课：与Smbmap结合攻击](https://micro8.gitbook.io/micro8/contents-1/51-60/55-yu-smbmap-jie-he-gong-ji.md)
- [第五十六课：离线提取目标机hash](https://micro8.gitbook.io/micro8/contents-1/51-60/56-li-xian-ti-qu-mu-biao-ji-hash.md)
- [第五十七课：高级持续渗透-第一季关于后门](https://micro8.gitbook.io/micro8/contents-1/51-60/57-gao-ji-chi-xu-shen-tou-di-yi-ji-guan-yu-hou-men.md)
- [第五十八课：高级持续渗透-第二季关于后门补充一](https://micro8.gitbook.io/micro8/contents-1/51-60/58-gao-ji-chi-xu-shen-tou-di-er-ji-guan-yu-hou-men-bu-chong-yi.md)
- [第五十九课：高级持续渗透-第三季关于后门补充二](https://micro8.gitbook.io/micro8/contents-1/51-60/59-gao-ji-chi-xu-shen-tou-di-san-ji-guan-yu-hou-men-bu-chong-er.md)
- [第六十课：高级持续渗透-第四季关于后门](https://micro8.gitbook.io/micro8/contents-1/51-60/60-gao-ji-chi-xu-shen-tou-di-si-ji-guan-yu-hou-men.md)
- [61-70课](https://micro8.gitbook.io/micro8/contents-1/61-70.md)
- [第六十一课：高级持续渗透-第五季关于后门](https://micro8.gitbook.io/micro8/contents-1/61-70/61-gao-ji-chi-xu-shen-tou-di-wu-ji-guan-yu-hou-men.md)
- [第六十二课：高级持续渗透-第六季关于后门](https://micro8.gitbook.io/micro8/contents-1/61-70/62-gao-ji-chi-xu-shen-tou-di-liu-ji-guan-yu-hou-men.md)
- [第六十三课：高级持续渗透-第七季demo的成长](https://micro8.gitbook.io/micro8/contents-1/61-70/63-gao-ji-chi-xu-shen-tou-di-qi-ji-demo-de-cheng-chang.md)
- [第六十四课：高级持续渗透-第八季demo便是远控](https://micro8.gitbook.io/micro8/contents-1/61-70/64-gao-ji-chi-xu-shen-tou-di-ba-ji-demo-bian-shi-yuan-kong.md)
- [第六十五课：离线提取目标机hash补充](https://micro8.gitbook.io/micro8/contents-1/61-70/65-li-xian-ti-qu-mu-biao-ji-hash-bu-chong.md)
- [第六十六课：借助aspx对payload进行分离免杀](https://micro8.gitbook.io/micro8/contents-1/61-70/66-jie-zhu-aspx-dui-payload-jin-hang-fen-li-mian-sha.md)
- [第六十七课：meterpreter下的irb操作第一季](https://micro8.gitbook.io/micro8/contents-1/61-70/67meterpreter-xia-de-irb-cao-zuo-di-yi-ji.md)
- [第六十八课：基于Ruby内存加载shellcode第一季](https://micro8.gitbook.io/micro8/contents-1/61-70/68-ji-yu-ruby-nei-cun-jia-zai-shellcode-di-yi-ji.md)
- [第六十九课：渗透，持续渗透，后渗透的本质](https://micro8.gitbook.io/micro8/contents-1/61-70/69-shen-tou-chi-xu-shen-tou-hou-shen-tou-de-ben-zhi.md)
- [第七十课：ftp一句话下载payload补充](https://micro8.gitbook.io/micro8/contents-1/61-70/70ftp-yi-ju-hua-xia-zai-payload-bu-chong.md)
- [71-80课](https://micro8.gitbook.io/micro8/contents-1/71-80.md)
- [第七十一课：基于白名单Msbuild.exe执行payload第一季](https://micro8.gitbook.io/micro8/contents-1/71-80/71-ji-yu-bai-ming-dan-msbuild.exe-zhi-hang-payload-di-yi-ji.md)
- [第七十二课：基于白名单Installutil.exe执行payload第二季](https://micro8.gitbook.io/micro8/contents-1/71-80/72-ji-yu-bai-ming-dan-installutil.exe-zhi-hang-payload-di-er-ji.md)
- [第七十三课：基于白名单Regasm.exe执行payload第三季](https://micro8.gitbook.io/micro8/contents-1/71-80/73-ji-yu-bai-ming-dan-regasm.exe-zhi-hang-payload-di-san-ji.md)
- [第七十四课：基于白名单Regsvcs.exe执行payload第四季](https://micro8.gitbook.io/micro8/contents-1/71-80/74-ji-yu-bai-ming-dan-regsvcs.exe-zhi-hang-payload-di-si-ji.md)
- [第七十五课：基于白名单Mshta.exe执行payload第五季](https://micro8.gitbook.io/micro8/contents-1/71-80/75-ji-yu-bai-ming-dan-mshta.exe-zhi-hang-payload-di-wu-ji.md)
- [第七十六课：基于白名单Compiler.exe执行payload第六季](https://micro8.gitbook.io/micro8/contents-1/71-80/76-ji-yu-bai-ming-dan-compiler.exe-zhi-hang-payload-di-liu-ji.md)
- [第七十七课：基于白名单Csc.exe执行payload第七季](https://micro8.gitbook.io/micro8/contents-1/71-80/77-ji-yu-bai-ming-dan-csc.exe-zhi-hang-payload-di-qi-ji.md)
- [第七十八课：基于白名单Msiexec执行payload第八季](https://micro8.gitbook.io/micro8/contents-1/71-80/78-ji-yu-bai-ming-dan-msiexec-zhi-hang-payload-di-ba-ji.md)
- [第七十九课：基于白名单Regsvr32执行payload第九季](https://micro8.gitbook.io/micro8/contents-1/71-80/79-ji-yu-bai-ming-dan-regsvr32-zhi-hang-payload-di-jiu-ji.md)
- [第八十课：基于白名单Wmic执行payload第十季](https://micro8.gitbook.io/micro8/contents-1/71-80/80-ji-yu-bai-ming-dan-wmic-zhi-hang-payload-di-shi-ji.md)
- [81-90课](https://micro8.gitbook.io/micro8/contents-1/81-90.md)
- [第八十一课：基于白名单Rundll32.exe执行payload第十一季](https://micro8.gitbook.io/micro8/contents-1/81-90/81-ji-yu-bai-ming-dan-rundll32.exe-zhi-hang-payload-di-shi-yi-ji.md)
- [第八十二课：基于白名单Odbcconf执行payload第十二季](https://micro8.gitbook.io/micro8/contents-1/81-90/82-ji-yu-bai-ming-dan-odbcconf-zhi-hang-payload-di-shi-er-ji.md)
- [第八十三课：基于白名单PsExec执行payload第十三季](https://micro8.gitbook.io/micro8/contents-1/81-90/83-ji-yu-bai-ming-dan-psexec-zhi-hang-payload-di-shi-san-ji.md)
- [第八十四课：基于白名单Forfiles执行payload第十四季](https://micro8.gitbook.io/micro8/contents-1/81-90/84-ji-yu-bai-ming-dan-forfiles-zhi-hang-payload-di-shi-si-ji.md)
- [第八十五课：基于白名单Pcalua执行payload第十五季](https://micro8.gitbook.io/micro8/contents-1/81-90/85-ji-yu-bai-ming-dan-pcalua-zhi-hang-payload-di-shi-wu-ji.md)
- [第八十六课：基于白名单Msiexec执行payload第八季补充](https://micro8.gitbook.io/micro8/contents-1/81-90/86-ji-yu-bai-ming-dan-msiexec-zhi-hang-payload-di-ba-ji-bu-chong.md)
- [第八十七课：基于白名单Cmstp.exe执行payload第十六季](https://micro8.gitbook.io/micro8/contents-1/81-90/87-ji-yu-bai-ming-dan-cmstp.exe-zhi-hang-payload-di-shi-liu-ji.md)
- [第八十八课：基于白名单Ftp.exe执行payload第十九季](https://micro8.gitbook.io/micro8/contents-1/81-90/88-ji-yu-bai-ming-dan-ftp.exe-zhi-hang-payload-di-shi-jiu-ji.md)
- [第八十九课：基于白名单Url.dll执行payload第十七季](https://micro8.gitbook.io/micro8/contents-1/81-90/89-ji-yu-bai-ming-dan-url.dll-zhi-hang-payload-di-shi-qi-ji.md)
- [第九十课：基于白名单zipfldr.dll执行payload第十八季](https://micro8.gitbook.io/micro8/contents-1/81-90/90-ji-yu-bai-ming-dan-zipfldr.dll-zhi-hang-payload-di-shi-ba-ji.md)
- [91-100课](https://micro8.gitbook.io/micro8/contents-1/91-100.md)
- [第九十一课：从目标文件中做信息搜集第一季](https://micro8.gitbook.io/micro8/contents-1/91-100/91-cong-mu-biao-wen-jian-zhong-zuo-xin-xi-sou-ji-di-yi-ji.md)
- [第九十二课：实战中的Payload应用](https://micro8.gitbook.io/micro8/contents-1/91-100/92-shi-zhan-zhong-de-payload-ying-yong.md)
- [第九十三课：与CrackMapExec结合攻击](https://micro8.gitbook.io/micro8/contents-1/91-100/93-yu-crackmapexec-jie-he-gong-ji.md)
- [第九十四课：基于实战中的small payload](https://micro8.gitbook.io/micro8/contents-1/91-100/94-ji-yu-shi-zhan-zhong-de-smallpayload.md)
- [第九十五课：基于Portfwd端口转发](https://micro8.gitbook.io/micro8/contents-1/91-100/95-ji-yu-portfwd-duan-kou-zhuan-fa.md)
- [第九十六课：HTTP隧道ABPTTS第一季](https://micro8.gitbook.io/micro8/contents-1/91-100/96http-sui-dao-abptts-di-yi-ji.md)
- [第九十七课：MSF配置自定义Payload控制目标主机权限](https://micro8.gitbook.io/micro8/contents-1/91-100/97msf-pei-zhi-zi-ding-yi-payload-kong-zhi-mu-biao-zhu-ji-quan-xian.md)
- [第九十八课：HTTP隧道reGeorg第二季](https://micro8.gitbook.io/micro8/contents-1/91-100/98http-sui-dao-regeorg-di-er-ji.md)
- [第九十九课：HTTP隧道Tunna第三季](https://micro8.gitbook.io/micro8/contents-1/91-100/99http-sui-dao-tunna-di-san-ji.md)
- [第一百课：HTTP隧道reDuh第四季](https://micro8.gitbook.io/micro8/contents-1/91-100/100http-sui-dao-reduh-di-si-ji.md)
- [第二章：老（待更新...）](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-....md)
- [第一百零一课：基于SCF做目标内网信息搜集第二季](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-ling-yi-ke-ji-yu-scf-zuo-mu-biao-nei-wang-xin-xi-sou-ji-di-er-ji.md)
- [第一百零二课：对抗权限长期把控-伪造无效签名第一季](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-ling-er-ke-dui-kang-quan-xian-chang-qi-ba-kong-wei-zao-wu-xiao-qian-ming-di-yi-ji.md)
- [第一百零三课：Http加密隧道下的横向渗透尝试---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-ling-san-ke-http-jia-mi-sui-dao-xia-de-heng-xiang-shen-tou-chang-shi-klion.md)
- [第一百零四课：Windows Smb 欺骗重放攻击利用---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-ling-si-ke-windows-smb-qi-pian-zhong-fang-gong-ji-li-yong-klion.md)
- [第一百零五课：windows 单机免杀抓明文或hash \[通过dump lsass进程数据\]---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-ling-wu-ke-windows-dan-ji-mian-sha-zhua-ming-wen-huo-hash-tong-guo-dump-lsass-jin-cheng-sh.md)
- [第一百零六课：windows 单机免杀抓明文或hash \[通过简单混淆编码绕过常规静态检测\]---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-ling-liu-ke-windows-dan-ji-mian-sha-zhua-ming-wen-huo-hash-tong-guo-jian-dan-hun-xiao-bian.md)
- [第一百零七课：跨平台横向移动 \[ windows计划任务利用 \]---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-ling-qi-ke-kua-ping-tai-heng-xiang-yi-dong-windows-ji-hua-ren-wu-li-yong-klion.md)
- [第一百零八课：跨平台横向移动 \[wmi利用\]---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-ling-ba-ke-kua-ping-tai-heng-xiang-yi-dong-wmi-li-yong-klion.md)
- [第一百零九课：依托 metasploit 尽可能多的发现目标内网下的各类高价值存活主机---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-ling-jiu-ke-yi-tuo-metasploit-jin-ke-neng-duo-de-fa-xian-mu-biao-nei-wang-xia-de-ge-lei-ga.md)
- [第一百一十课：窃取,伪造模拟各种windows访问令牌\[token利用\]---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-yi-shi-ke-qie-qu-wei-zao-mo-ni-ge-zhong-windows-fang-wen-ling-pai-token-li-yong-klion.md)
- [第一百一十一课：内网mssql完整利用流程 \[ 基础篇 \]---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-yi-shi-yi-ke-nei-wang-mssql-wan-zheng-li-yong-liu-cheng-ji-chu-pian-klion.md)
- [第一百一十二课：利用Dropbox中转C2流量---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-yi-shi-er-ke-li-yong-dropbox-zhong-zhuan-c2-liu-liang-klion.md)
- [第一百一十三课：COM Hijacking---倾旋](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-yi-shi-san-ke-com-hijacking-qing-xuan.md)
- [第一百一十四课：渗透沉思录](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-yi-shi-si-ke-shen-tou-chen-si-lu.md)
- [第一百一十五课：使用CrackMapExec 进行 NTLM Hash传递攻击---倾旋](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-yi-shi-wu-ke-shi-yong-crackmapexec-jin-hang-ntlm-hash-chuan-di-gong-ji-qing-xuan.md)
- [第一百一十六课：Windows域渗透 - 用户密码枚举---倾旋](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-yi-shi-liu-ke-windows-yu-shen-tou-yong-hu-mi-ma-mei-ju-qing-xuan.md)
- [第一百一十七课：Windows 本地特权提升技巧---倾旋](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-yi-shi-qi-ke-windows-ben-di-te-quan-ti-sheng-ji-qiao-qing-xuan.md)
- [第一百一十八课：CVE-2017-11882钓鱼攻击---倾旋](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-yi-shi-ba-ke-cve201711882-diao-yu-gong-ji-qing-xuan.md)
- [第一百一十九课：全平台高性能加密隧道 ssf---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-yi-shi-jiu-ke-quan-ping-tai-gao-xing-neng-jia-mi-sui-dao-ssfklion.md)
- [第一百二十课：win自带的高级网络配置管理工具深度应用 \[ netsh \]---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-er-shi-ke-win-zi-dai-de-gao-ji-wang-luo-pei-zhi-guan-li-gong-ju-shen-du-ying-yong-netsh-kl.md)
- [第一百二十一课：http加密代理深度应用 \[ abptts \]---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-er-shi-yi-ke-http-jia-mi-dai-li-shen-du-ying-yong-abptts-klion.md)
- [第一百二十二课：利用 ssh隧道实现内网断网机meterpreter反向上线---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-er-shi-er-ke-li-yong-ssh-sui-dao-shi-xian-nei-wang-duan-wang-ji-meterpreter-fan-xiang-shan.md)
- [第一百二十三课：利用ssh隧道将公网meterpreter弹至本地的msf中---klion](https://micro8.gitbook.io/micro8/di-er-zhang-lao-dai-geng-xin-.../di-yi-bai-er-shi-san-ke-li-yong-ssh-sui-dao-jiang-gong-wang-meterpreter-dan-zhi-ben-di-de-msf-zhong.md)
- [第三章：病（待更新...）](https://micro8.gitbook.io/micro8/di-san-zhang-bing-dai-geng-xin-....md)