🎓 毕业项目 — 完整红蓝对抗演练

📖 毕业项目概述

这是网络安全入门课程的最终项目——一个完整的红蓝对抗演练。你将同时扮演红队（攻击方）和蓝队（防御方），在可控环境中体验完整的攻防对抗。这是对前39课所有知识的综合检验。

🔴 红队：攻击阶段

Phase 1 — 侦察与信息收集

# ===== 红队侦察脚本 =====
cat > /tmp/redteam_recon.sh <<'SCRIPT'
#!/bin/bash
echo "========================================"
echo "  🔴 红队 Phase 1: 侦察"
echo "========================================"

# 目标范围
TARGET_NETWORK="172.17.0.0/24"  # Docker网络
TARGET_WEB="127.0.0.1:8080"

# 1. 主机发现
echo -e "\n[1] 主机发现"
echo "  扫描目标网络: $TARGET_NETWORK"
# Docker环境中扫描
nmap -sn $TARGET_NETWORK -oG /tmp/red_alive.gnmap 2>/dev/null | \
  grep "Up" | awk '{print $2}' || echo "  使用Docker网络替代"

# 发现Docker容器
echo -e "\n  Docker容器:"
docker ps --format "table {{.Names}}\t{{.Ports}}" 2>/dev/null || \
  echo "  Docker未运行"

# 2. 端口扫描
echo -e "\n[2] 端口扫描"
# 扫描常见端口
nmap -sS -sV -p 22,80,443,3306,8080,8443 $TARGET_NETWORK \
  --open 2>/dev/null | grep -E "PORT|open" || \
  echo "  扫描本机常见端口:"
for port in 22 80 443 3306 8080; do
  timeout 1 bash -c "echo >/dev/tcp/127.0.0.1/$port" 2>/dev/null && \
    echo "  ✅ 127.0.0.1:$port 开放" || true
done

# 3. Web指纹
echo -e "\n[3] Web应用指纹"
curl -sI http://127.0.0.1:8080 2>/dev/null | head -10 || \
  echo "  Web服务未运行"

# 4. 服务版本
echo -e "\n[4] 服务识别"
nmap -sV -p 22,80,3306,8080 127.0.0.1 2>/dev/null | \
  grep -E "PORT|open" || echo "  使用ss替代:"
ss -tlnp 2>/dev/null | head -10

# 5. DNS信息
echo -e "\n[5] DNS信息"
cat /etc/resolv.conf | grep -v "^#" | head -5

echo -e "\n========================================"
echo "  侦察完成 — 识别攻击面"
echo "========================================"
SCRIPT

chmod +x /tmp/redteam_recon.sh
bash /tmp/redteam_recon.sh

Phase 2 — 漏洞利用

# ===== 红队攻击脚本 =====
cat > /tmp/redteam_exploit.sh <<'SCRIPT'
#!/bin/bash
echo "========================================"
echo "  🔴 红队 Phase 2: 漏洞利用"
echo "========================================"

# ===== 攻击1: Web漏洞利用 =====
echo -e "\n[Attack 1] Web漏洞扫描与利用"

# 创建靶场容器
docker run -d --name capstone-target \
  -p 8080:80 nginx:alpine 2>/dev/null

sleep 2

# 检测Web安全头缺失
echo "  检测目标Web安全头:"
HEADERS=$(curl -sI http://127.0.0.1:8080 2>/dev/null)
for header in "X-Frame-Options" "X-Content-Type-Options" \
  "Content-Security-Policy" "Strict-Transport-Security"; do
  if echo "$HEADERS" | grep -qi "$header"; then
    echo "  ✅ $header: 已配置"
  else
    echo "  ❌ $header: 缺失 (可利用)"
  fi
done

# 目录扫描
echo -e "\n  敏感路径探测:"
for path in /admin /login /.git/HEAD /.env /robots.txt /server-status; do
  status=$(curl -s -o /dev/null -w "%{http_code}" "http://127.0.0.1:8080$path" 2>/dev/null)
  [ "$status" != "404" ] && echo "  ⚠️  $path → HTTP $status"
done

# ===== 攻击2: 弱口令检测 =====
echo -e "\n[Attack 2] 弱口令检测"
echo "  检查默认/弱密码..."
for user in root admin test; do
  # 模拟SSH弱口令检测（不实际尝试）
  echo "  检查用户: $user (常见弱密码: 123456, admin, password)"
done

# ===== 攻击3: 本地提权检查 =====
echo -e "\n[Attack 3] 本地提权向量"
echo "  SUID文件:"
find / -perm -4000 -type f 2>/dev/null | head -10

echo -e "\n  可写敏感目录:"
find /etc -writable -type d 2>/dev/null | head -5

echo -e "\n  sudo配置:"
sudo -l 2>/dev/null | head -5 || echo "  无sudo权限"

# ===== 攻击4: 凭据搜索 =====
echo -e "\n[Attack 4] 凭据搜索"
echo "  配置文件中的密码:"
grep -rn "password\|passwd\|secret" /etc/ 2>/dev/null | \
  grep -v "Binary\|#" | head -5

echo -e "\n========================================"
echo "  攻击利用完成 — 记录发现"
echo "========================================"

# 清理
docker rm -f capstone-target 2>/dev/null
SCRIPT

chmod +x /tmp/redteam_exploit.sh
bash /tmp/redteam_exploit.sh

🔵 蓝队：防御阶段

Phase 1 — 安全基线建立

# ===== 蓝队防御脚本 =====
cat > /tmp/blueteam_defense.sh <<'SCRIPT'
#!/bin/bash
echo "========================================"
echo "  🔵 蓝队 Phase 1: 安全基线"
echo "========================================"

# 1. 资产清单
echo -e "\n[1] 资产清单"
echo "  系统信息:"
echo "    主机名: $(hostname)"
echo "    操作系统: $(cat /etc/os-release 2>/dev/null | grep PRETTY_NAME | cut -d'"' -f2)"
echo "    内核: $(uname -r)"
echo "    开放端口:"
ss -tlnp 2>/dev/null | grep LISTEN || netstat -tlnp 2>/dev/null | grep LISTEN

# 2. 运行服务
echo -e "\n[2] 运行服务"
systemctl list-units --type=service --state=running 2>/dev/null | head -15 || \
  ps aux | head -15

# 3. 用户账户
echo -e "\n[3] 用户账户审计"
echo "  具有登录权限的用户:"
cat /etc/passwd | grep -v "nologin\|false\|sync\|halt\|shutdown" | cut -d: -f1

echo -e "\n  sudo权限用户:"
getent group sudo wheel 2>/dev/null || cat /etc/group | grep -E "sudo|wheel"

# 4. 防火墙状态
echo -e "\n[4] 防火墙状态"
iptables -L -n 2>/dev/null | head -20 || echo "  iptables不可用"
ufw status 2>/dev/null || echo "  ufw不可用"

# 5. 日志审计
echo -e "\n[5] 日志系统"
echo "  系统日志:"
ls -la /var/log/syslog /var/log/auth.log /var/log/secure 2>/dev/null | \
  awk '{print "  " $NF, $5" bytes"}'

echo -e "\n  最近的认证事件:"
last -10 2>/dev/null | head -10 || echo "  last命令不可用"

echo -e "\n  最近的失败登录:"
lastb 2>/dev/null | head -5 || echo "  无失败登录记录"

echo -e "\n========================================"
SCRIPT

chmod +x /tmp/blueteam_defense.sh
bash /tmp/blueteam_defense.sh

Phase 2 — 检测与响应

# ===== 蓝队检测响应脚本 =====
cat > /tmp/blueteam_detect.sh <<'SCRIPT'
#!/bin/bash
echo "========================================"
echo "  🔵 蓝队 Phase 2: 检测与响应"
echo "========================================"

# 1. 入侵指标(IoC)检测
echo -e "\n[1] 入侵指标检测"

# 可疑进程
echo "  可疑进程检测:"
ps aux | grep -iE "nc|ncat|socat|reverse|shell|backdoor" | \
  grep -v grep | head -5 || echo "  ✅ 无可疑进程"

# 异常网络连接
echo -e "\n  异常网络连接:"
ss -tnp 2>/dev/null | grep -v "127.0.0.1\|::1" | head -10

# 可疑定时任务
echo -e "\n  可疑定时任务:"
crontab -l 2>/dev/null | head -10 || echo "  ✅ 无用户定时任务"
ls -la /etc/cron.d/ 2>/dev/null | head -5

# 2. 文件完整性检查
echo -e "\n[2] 文件完整性检查"
echo "  关键系统文件权限:"
for file in /etc/passwd /etc/shadow /etc/ssh/sshd_config /etc/sudoers; do
  if [ -f "$file" ]; then
    perms=$(stat -c "%a %U:%G" "$file" 2>/dev/null)
    echo "  $file: $perms"
  fi
done

# 新创建的文件（24h内）
echo -e "\n  24小时内修改的敏感文件:"
find /etc /var/www /opt -mtime -1 -type f 2>/dev/null | head -10

# 3. 安全加固措施
echo -e "\n[3] 安全加固检查"
echo "  SSH配置:"
[ -f /etc/ssh/sshd_config ] && \
  grep -E "^(PermitRootLogin|PasswordAuthentication|Port)" /etc/ssh/sshd_config 2>/dev/null || \
  echo "  sshd_config不可读"

echo -e "\n  密码策略:"
grep -E "^(PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_MIN_LEN|PASS_WARN_AGE)" \
  /etc/login.defs 2>/dev/null || echo "  login.defs不可读"

# 4. 安全告警规则
echo -e "\n[4] 告警规则建议"
echo "  🔔 告警规则:"
echo "  1. 同一IP 5分钟内3次登录失败 → 告警"
echo "  2. 非工作时间特权命令执行 → 告警"
echo "  3. 新增SUID文件 → 告警"
echo "  4. 反向Shell连接 → 严重告警"
echo "  5. /etc/passwd修改 → 严重告警"
echo "  6. 异常大量数据外传 → 严重告警"

echo -e "\n========================================"
SCRIPT

chmod +x /tmp/blueteam_detect.sh
bash /tmp/blueteam_detect.sh

📊 对抗演练评分系统

# ===== 红蓝对抗评分 =====
cat > /tmp/capstone_score.py <<'PYEOF'
#!/usr/bin/env python3
"""毕业项目评分系统"""

print("=" * 60)
print("  🎓 网络安全入门 · 毕业项目评分")
print("=" * 60)

# 红队评分
red_team = {
    "侦察与信息收集": {
        "被动信息收集(WHOIS/DNS)": 5,
        "主动扫描(Nmap/端口)": 5,
        "服务识别与指纹": 5,
        "攻击面分析": 5,
        "得分": 20, "满分": 20
    },
    "漏洞利用": {
        "Web漏洞发现与利用": 10,
        "弱口令检测": 5,
        "本地提权向量识别": 5,
        "凭据搜索": 5,
        "得分": 25, "满分": 25
    },
    "后渗透": {
        "横向移动路径规划": 5,
        "数据收集": 5,
        "持久化技术": 5,
        "痕迹清理": 5,
        "得分": 20, "满分": 20
    },
    "报告质量": {
        "漏洞评级准确性": 5,
        "复现步骤清晰度": 5,
        "修复建议实用性": 5,
        "攻击链展示": 5,
        "得分": 20, "满分": 20
    }
}

# 蓝队评分
blue_team = {
    "防御基线": {
        "资产清单完整性": 5,
        "服务最小化": 5,
        "补丁与更新": 5,
        "防火墙配置": 5,
        "得分": 20, "满分": 20
    },
    "检测能力": {
        "入侵指标检测": 5,
        "日志监控覆盖": 5,
        "告警规则有效性": 5,
        "异常行为识别": 5,
        "得分": 20, "满分": 20
    },
    "响应能力": {
        "事件确认速度": 5,
        "遏制措施有效性": 5,
        "根因分析": 5,
        "恢复流程": 5,
        "得分": 20, "满分": 20
    },
    "持续改进": {
        "安全策略优化": 5,
        "检测规则更新": 5,
        "培训与演练": 5,
        "自动化程度": 5,
        "得分": 20, "满分": 20
    }
}

print("\n🔴 红队评分:")
print("-" * 60)
red_total = 0
for category, items in red_team.items():
    score = items["得分"]
    full = items["满分"]
    red_total += score
    print(f"  {category}: {score}/{full}")
    for item, pts in items.items():
        if item not in ("得分", "满分"):
            print(f"    ✓ {item}: {pts}分")

print(f"\n  🔴 红队总分: {red_total}/85")

print("\n🔵 蓝队评分:")
print("-" * 60)
blue_total = 0
for category, items in blue_team.items():
    score = items["得分"]
    full = items["满分"]
    blue_total += score
    print(f"  {category}: {score}/{full}")
    for item, pts in items.items():
        if item not in ("得分", "满分"):
            print(f"    ✓ {item}: {pts}分")

print(f"\n  🔵 蓝队总分: {blue_total}/80")

# 综合评分
total = red_total + blue_total
print(f"\n{'=' * 60}")
print(f"  🎓 毕业项目综合评分: {total}/165")
print(f"  红队攻击能力: {'⭐' * (red_total // 17)}")
print(f"  蓝队防御能力: {'⭐' * (blue_total // 16)}")

if total >= 150:
    grade = "🏆 优秀 (S级)"
elif total >= 130:
    grade = "🥇 良好 (A级)"
elif total >= 100:
    grade = "🥈 合格 (B级)"
else:
    grade = "🥉 需要加强 (C级)"

print(f"  综合评级: {grade}")
print(f"{'=' * 60}")
PYEOF

python3 /tmp/capstone_score.py

📚 40课知识回顾

🚀 继续学习路线

完成40课只是起点，网络安全的学习永无止境。以下是推荐的方向深化路线：

📚 推荐认证与资源

• OffSec OSCP — 渗透测试入门认证
• ISC2 CISSP — 安全管理认证
• SANS/GIAC — 防御方向认证
• Credly认证徽章
• Week in OSINT
• SANS免费资源