文章总结： 该文档为2026年9月14日攻防技战术动态周报，汇总漏洞相关、红队技术、蓝队技术及工具类最新进展。核心内容包括Windows内核提权漏洞CVE-2026-42980的POC、反射加载器替代LoadLibrary实现热插拔模块、钓鱼攻击与流氓RMM持久化、VSS本地凭据转储、组策略渗透测试基础及NetNTLMv1攻击技术。蓝队方面推出EvidenceForge用于生成合成安全日志以支持威胁狩猎训练。工具类涵盖内核态进程终止工具0xM0nCrush、RingKiller、匿名AD枚举工具adnullenum、go-responder、Windows认证令牌提取工具SpecterBroker、DLLsideload生成工具LazyDLLSideload及跨平台网络执行工具包Atlas等。建议红队关注BYOVD驱动利用与NTLM攻击技术演进，蓝队应加强端点检测与日志分析能力。
综合评分： 78
文章分类： 红队,渗透测试,漏洞分析,安全工具,蓝队
攻防技战术动态一周更新 – 20260914
原创
红蓝对抗技术
红蓝对抗技术
红蓝对抗技战术
2026年9月19日 21:04
北京
在小说阅读器读本章
去阅读
在公众号小说中沉浸阅读
漏洞相关
1、NT OS Kernel Elevation of Privilege Vulnerability
https://github.com/G4sp4rCS/CVE-2026-42980-POC
红队技术
1、A First Look Inside the Windows Endpoint Security Platform
https://jonny-jhnson.dev/blog/a-first-look-inside-the-windows-endpoint-security-platform/
2、Using Reflective Loaders to Replace LoadLibrary for Hot Swappable Modules in C++
https://racoten.gitbook.io/red-team-developments-and-operations
https://github.com/racoten/ReflectivePluginLoader
3、Phishing Attacks Serve Browser-in-t he-Browser Pages, Rogue RMM Persistence
https://www.huntress.com/blog/phishing-bitb-rmm-attacks?utm_source=twitter&utm_medium=social&utm_campaign=cy26-09-camp-multi-global-broad-all-x-phish-social_eng-phishing_bitb_rmm_attacks&hnt=aacqslhwi3op&utm_content=Text
4、Dump Local Credentials with VSS
https://medium.com/@s12deff/dump-local-credentials-with-vss-97b3cd867165
5、Pentesting: Group Policy for Hackers – Basics
https://hackers-arise.com/pentesting-group-policy-for-hackers-basics/
6、NetNTLMv1 Is Dead. Long Live NetNTLMv1.
蓝队技术
1、EvidenceForge
https://github.com/Cisco-Talos/EvidenceForge
Generate realistic synthetic security logs for cybersecurity threat hunting training and research
工具类
1、0xM0nCrush
https://github.com/DeathShotXD/0xM0nCrush
Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.
2、RingKiller
https://github.com/security-attack/RingKiller
RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminateProcess. EDR/AV termination primitive. Lab only.
3、adnullenum
https://github.com/crypt0p3g/adnullenum
One-pass anonymous Active Directory enumeration over SAMR and LSARPC — null session, no credentials, with structured reusable output.
4、go-responder
https://github.com/bl4ckarch/go-responder
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
5、SpecterBroker
https://github.com/R3alM0m1X82/SpecterBroker
Advanced Windows authentication token extraction and decryption tool for red team operations and security research
6、IAT Camouflage
https://medium.com/@s12deff/iat-camouflage-42b7dda15ea8
7、ntlmscout
https://github.com/boydhacks/ntlmscout
One tool to squeeze every drop of information out of internet-exposed NTLM endpoints.
8、LazyDLLSideload
https://github.com/Whitecat18/LazyDLLSideload
Generate DLL proxy/sideload projects. Automatically parses PE export tables and generates ready-to-compile project for red team engagements.
9、Atlas
https://github.com/portbuster1337/Atlas
Cross-platform network execution toolkit (SMB/Kerberos/WMI/LDAP/DCSync) built on TrustedSec’s Titanis – NetExec-style workflow in C#
其他类
1、How to Run a Windows Service Inside Svchost.exe
https://trainsec.net/library/malware-analysis/how-to-run-a-windows-service-inside-svchostexe-service-dll-walkthrough/
2、Retiring NTLM: Frequently asked questions
https://techcommunity.microsoft.com/blog/windows-itpro-blog/retiring-ntlm-frequently-asked-questions/4550522
免责声明：
本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。
任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。
本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。
本文转载自：红蓝对抗技战术 红蓝对抗技术
红蓝对抗技术《攻防技战术动态一周更新 – 20260914》