2024红队实战操作虚拟机制作.docx

《2024红队实战操作虚拟机制作.docx》由会员分享，可在线阅读，更多相关《2024红队实战操作虚拟机制作.docx（7页珍藏版）》请在第壹文秘上搜索。

1、设备摘要室内存16GB:序处理器86新CDDVD(SATA)自动检测IBUSB控制器存在匚显示器自动检测设备摘要里内存16GB处理器8新CD/DVD(SATA)自动检测国USB控制器存在自动检测FD图形口加速3D图形监视器您将主机设贸用于监视器(V)O指定监视器设罡(5)：监视器数量(N)：任意监视窘的最大分辨率(M):红队实战操作虚拟机制作0x01虚拟机软件配置1 .使用当下最新版本VMWareWorkstationProe下载地址:https:WWW激活码：g。Ogle寻找2 .新建一个根据项目时间长短而定的硬件配置，例如：4核CPU、8G内存、60G硬盘,较长时间项目，可以参数加倍。将使

2、用下列设置创建虚拟机：名称：Windows1064位置：版本：Workstation17.5.x操作系统：Windows1064硬盘：120GB,拆分内存：16384MB网络适配器：无其他设备：8个CPU内核，CD/DVD,USB控制器3 .卸载虚拟机上无关设备(声卡、摄像头、蓝牙以及系统完整完毕后的CD/DVD),并关闭加速3D图形硬件连接USB兼容性(0:USB3.1口显示所有USB愉入设备(三)I与虚拟机共享蓝牙设备(B)I44 .使用9H三USB有线网卡组网。通过虚拟机-可移动设备-xxxxx,来把USB网卡加载到指定虚拟机。5 .检杳虚拟机是否关闭共享文件夹、关闭时间同步、禁用Vne

3、等选项。粘贴复制视情况而定。硬件选项设置摘要03常规Windows1064A电源(3?共享文件夹已禁用3快照5自动保护已禁用a客户机隔离访问控制未加密IFVMWareTools关闭时间同步三VNC连接已禁用ISBunity要设备视图出自动登录不可用国高级默认/默认Unity窗口效果口显示边框(B)口显示标志（八）在窗口边桩中使用自定义颜色(C)选择颜色（三）应用程序口启用应用程序菜单(E)设用摘要On常效Windows10x64A电源卬共享文件夹已禁用3快照E)自动保护已禁用客户机隔离国启用拖放(Q)画启用复制粘贴(C)共享传感器输入口方向(Q)口动作(M)环境光（八）啕客户机隔高方访问控制未

4、加密叵IVMwareTools关闭时间同步空VNe连接已禁用3Unity鳍设备视图为自动登录不可用回高级参认做认硬件选项0x02操作系统配置Win101 .镜像下载，自行选择版本，这里我选择的是：en2USWindoWSIOenterpriseItSC2021x64dvdd289cf96.isoISO:https:/massarave.dev/WindOWSItSClinks.html2 .在安装时选择：Windows10EnterpriseN1.TSC2021,原因如下：Windows10EnterpriseN1.TSC2021includesthesamefunctionalityasWi

5、ndows10Enterprise1.TSC2021,exceptthatitdoesnotincludecertainmediarelatedtechnologies(e.g.,WindowsMediaPlayer,Camera,Music,Movies&TV)ortheSkypeapp.https:WWW.oo-O&OShutUplO+(Administrator)SearchFileActionsViewHelpCurrentUser1.ocalMachineSTATESCTTIhIGRECOMMENDeDPrivacyDisableandresetAdvertisingIDandinf

6、oyesDisabletransmissionoftypinginformationyesDisablesuggestionsinthetimelineyesDisablesuggestionsinStartyesDisabletips,tricks,andsuggestionswhenusingWindowsyesDisableshowingsuggestedcontentintheSettingsappyesDisablethepossibilityofsuggestingtofinishthesetupofthedeviceyesDisableappnotificationslimite

7、dDisableaccesstolocallanguageforbrowserslimitedDisabletextsuggestionswhentypingonthesoftwarekeyboardlimitedDisablesendingUR1.sfromappstoWindowsStorenoyes(三)OSOsoftwareDisablestorageofclipboardhistoryFindnewversionsathttps:/www.oo-software.m/https:QithU1.eDraaoX/Win-Debloat-ToolsSystemTweaksWinDebloa

8、tToolsv2023-11-22CustomizeSystemFeaturesSystemDebloatToolsWindowsUpdateEnableDarkThemeApplyTweaks EnableAutomaticWindowsUpdate EnableActivityHistoryUndoTweaks EnableBackgroundAppsRemoveMicrosoftEdgeOptionalFeaturesEnableClipboardHistoryRemoveOneOriveHyper-VRemoveXboxInternetExplorerEnableClipboardSy

9、ncAcrossDeViyEnableCortanaEnableHibernateEnable1.egacyContextMenurPrintins-PrintTopoFservices-FeoturesPrlntSnSXPSServkesfeaturesWindowsMediaPlayerWindowsSandboxEnableOldVolumeControlInstallSystemAppsTaskSchedulerEnableOnlineSpeechRecognitionEnablePhone1.inkEnablePhotoViewer EnableSearchAppforUnknown

10、Ext.DolbyAudioMicrosoftEdgeOneDhvePaintPaint3D FamilySafetyFeaturesServices WindowsSearchIndexingEnableTelemetryPhoneUnkWindowsCapabilitiesQuickAssistSoundRecorderPowerShellISETaskbarWidgetsMiscellaneousFeatures6.关闭杀软WindOWSdefender,组策略ComPUterconfiguration”AdministrativetemplatesWindowsComponentsWi

11、ndowsDefenderAntivirus,将TUITloffWindowsDefenderAntivirus设置为EnabledeJ1.ocWGroupPolicy(doWeAcmmHdp*rm.Q?T.32jMDM2jMe*9ngJMircwftaccountv二22Mt(MenderMClfltlnt*rfc:D*vcControlAEidutacm二MAPS:MactoeDcfnteEtplertGuerd二MP(C尹二NctMOrtcIrapectiOASytfem二QuMMtne_ReltnePrettction一ftemedt)onKcpctftF22Sc*SeryIntcUt

12、9enceUpdatesSfrem匚)Mkrowft(MendrApplicationGuard:MicrowftXtndrExploitGuardQJMcrowftEd9uMcretoftScondMyAUtfMrCFdo二Mcrtoe二NtfMetbng2jNewsandinterests_2OnDfrrtZj0nkAsMUonSettingsCJPUfhSie“I,Re11eOnHcp$cwksnRSSfMdt0MCPe代MCndef加XMuSTumoffMkrosoft(Mc*tfebkIMpcsettingMkrMCiftDefendefAMraWusdoesnetrutK.ndwi

13、lnotunCCnllUtertformreor(4hfpclunwarnedsctwreWttan9_ClmIntWc.:De*eControl二hchMomMAPS一MacrocAOafendttExp40tGuerd:Mp(ngronSytlem二QurvXne一RMMePrctectMn二RefneMocRotM9fcn:Scurou的blthnpdkMttm3Mroc*t04mtfeArtMmtwvrun，(9改VWcbefXistilledMilmtutp*oduc1.SUteIfyou8nocorjuretNsPRySenm9WtMoATldtnMHymn9Mkrotoft(MndfAntninwWyouimuknothf*11tywspwwWtMo*4utonab4ydMbtesMkfOKft(MndrAntninn.Oth4rMc,MrosOdmdeAn