2026-10-22 00:42:59 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

cover_image

攻防技战术动态一周更新 - 20260622

原创

红蓝对抗技术
红蓝对抗技术

红蓝对抗技战术

2026年6月27日 21:25
北京

在小说阅读器读本章

去阅读

漏洞相关

1、

红队技术

1、Fantastic clear-text passwords and where to collect them (Part 1 - Linux)

https://dfir.ch/posts/fantastic\_passwords\_linux/

2、PAC 签名无效引发的域信任降级攻击

https://blog.ghostwolflab.com/redteam/786/

3、DCOM Explained: How Attackers Turn a Windows Feature into a Lateral Movement Tool

https://detect.fyi/dcom-explained-how-attackers-turn-a-windows-feature-into-a-lateral-movement-tool-f3c07ce94866

4、Malware analysis: part 9. AI-assisted deo bfuscation: control flow flattening. Simple C example.

https://cocomelonc.github.io/malware/2026/06/21/malware-analysis-9.html

5、2026\_06\_x33fcon\_Bring\_Your\_Own\_Everything

https://github.com/Print3M/MyTalks/blob/main/2026\06\_x33fcon\_Bring\_Your\_Own\_Everything\-\_The\_Final\_Approach.pdf

6、Defender AV Real-Time Protection Impact on EDR Telemetry

https://academy.bluraven.io/blog/defender-av-real-time-protection-impact-on-edr-telemetry

7、x33fcon\_The\_Art\_of\_Evasion

https://github.com/S3cur3Th1sSh1t/Creds/blob/master/Presentations/x33fcon\_The\_Art\_of\_Evasion.pdf

8、Handle Permission Elevation via BYOVD

https://medium.com/@s12deff/handle-permission-elevation-via-byovd-df99e908e780

9、IDT Table Hijacking under VBS/HVCI/kCET in Windows 11

https://www.exploitpack.com/blogs/news/idt-table-hijacking-under-vbs-hvci-kcet-in-windows-11

10、heavener: This is what happens when you can't afford EDR licenses

https://blog.otterpwn.com/projects/heavener

11、An Introduction to Modern Malware Development for Red Teams

https://anteiku.fun/papers/an-introduction-to-modern-malware-development-for-red-teams/00\_an\_introduction\_to\_malware\_development\_for\_red\_teams/

12、Bypass Windows Defender antivirus in 2026: Evasion Techniques Using Direct Syscalls and XOR encryption – Part 2

https://www.hackmosphere.fr/bypass-windows-defender-antivirus-2025-part-2/

13、Red Team Tactics: Utilizing Syscalls in C# - Writing The Code

https://jhalon.github.io/utilizing-syscalls-in-csharp-2/

14、One Bool. Six Shells. AMSI's Design Problem.

https://bl4ckarch.github.io/posts/One-Bool.-Six-Shells.-AMSI's-Design-Problem/

15、Nim 的 C-FFI 隐身衣

https://blog.ghostwolflab.com/redteam/808/

16、Kerberos Explained

https://thattotallyrealmyth.gitbook.io/kerberos-explained

蓝队技术

1、How attackers built a RAT on a Windows machine using its own .NET compiler

https://heimdalsecurity.com/blog/how-attackers-built-rat-windows-machine-net-compiler/

工具类

1、LoadReload

https://github.com/0xRoam/LoadReload

Shellcode Loader for Master Thesis, designed for Sliver-Shellcode (smaller than 25MB....).

2、Onelogon: Taking over Active Directory Accounts via Netlogon

https://github.com/rub-softsec/onelogon

3、crystal-kit-sliver

https://github.com/licitrasimone/CrystalSliver

Crystal Palace Evasion kit for Sliver

4、CredsHunter

https://github.com/NeCr00/Credential-Hunting

Credential Hunting - Windows and Linux Scripts

5、DuplexSpy

https://github.com/iss4cf0ng/DuplexSpyCS

An open-source, C#-based remote administration tool (RAT), enabling complete control of a remote Windows machine, designed for legitimate remote administration and security testing of Windows systems.

6、Alien

https://github.com/iss4cf0ng/Alien

A C#-based webshell management tool for penetration testing.

7、FileHost - Adaptix C2 Service Extender

https://github.com/MaorSabag/SiteManagementAx

File hosting and scripted web delivery service extender for AdaptixC2. Host files over HTTP/HTTPS, generate one-liner payloads across 17 delivery methods, and manage active sites - all from the Adaptix operator UI.

8、Donut-CustomHost

https://github.com/Zuigetzu/Donut-CustomHost

Advanced OPSEC fork of Donut. Features a Custom in-memory CLR Host, Tail-Jump ETW bypasses, and zero-patch AMSI evasion for stealthy shellcode generation.