F31 是一个 bash 脚本，用于加固你的 Kali Linux 并帮助你在网络中最小化噪声。对于渗透测试人员或红队操作员来说非常有用，因为在基础设施中保持最小影响以避免网络性能问题至关重要。
该工具并不能保证你完全规避 SOC，因为网络基础设施各不相同，每个安全分析案例都是独一无二的。F31 的主要目标是最小化网络中的噪声。
本文和工具属于入门性质，旨在供在合同下进行测试的安全专业人员使用。传播恶意软件、破坏系统以及侵犯通信保密将受到法律追究。作者对本工具造成的任何损害不承担责任。
该脚本执行以下操作：
非常简单，克隆仓库，给 bash 脚本赋予执行权限。
caster@kali:~$ git clone https://github.com/wearecaster/F31
caster@kali:~$ cd F31/
caster@kali:~/F31$ chmod +x F31.sh reset.sh
F31 需要 root 权限才能运行
caster@kali:~$ sudo bash F31.sh
███████ ██████ ██
██ ██ ███
█████ █████ ██
██ ██ ██
██ ██████ ██
F31: Tool for hiding Kali Linux on the network
Author: Caster, @wearecaster, <[email protected]>
Version: 1.0.0
For instructions and an example of how to use it, visit: https://github.com/wearecaster/F31
Usage: F31.sh --interface <interface> --new-hostname <hostname> [--noise-reduction]
Options:
--interface Specify the network interface to hide
--new-hostname Specify the new hostname for the system
--noise-reduction Enable traffic shaping for noise reduction (optional)
该工具每次输入需要两个参数。分别是系统接口和 Kali 用户想要的新主机名。
负责激活流量整形的参数是可选的。攻击者可能并不总是需要它。而且流量整形会影响后续下载文件的速度等。请明智地使用噪声削减功能。
caster@kali:~/F31$ sudo bash F31.sh --interface eth0 --new-hostname ubuntu --noise-reduction
███████ ██████ ██
██ ██ ███
█████ █████ ██
██ ██ ██
██ ██████ ██
F31: Tool for hiding Kali Linux on the network
Author: Caster, @wearecaster, <[email protected]>
Version: 1.0.0
For instructions and an example of how to use it, visit: https://github.com/wearecaster/F31
[+] Tools are already installed.
[+] Changing hostname
[*] Hostname changed to ubuntu successfully.
[+] Enabling hostname transfer via DHCP
[*] Hostname through DHCP disabled successfully.
[+] Disabling NTP client
[*] NTP client shut down successfully.
[+] Increasing and shifting TTL (TTL=80)
[*] TTL values adjusted successfully.
[+] Configuring firewall
[*] Allowing established and chained connections, blocking invalid connections, restricting ICMP traffic, blocking unexpected TCP MSS values
[*] Firewall configuration successfully.
[+] Disabling ICMP Redirect
[*] ICMP Redirects disabled successfully.
[+] Changing MAC
[*] Randomize MAC configured successfully.
[+] Limit data rate to 30 kbit/s and latency 600ms to minimize noise in L2/L3 scanning.
[+] WARNING: This change will severely affect the speed of file downloads. Use this shaping exactly before scanning
[+] If necessary, adjust this value yourself
[*] Traffic shaping configured successfully.
[*] Script executed successfully.
我准备了一个特殊的脚本来回滚所有已做的设置。
caster@kali:~/F31$ sudo bash reset.sh --interface eth0 --old-hostname kali
███████ ██████ ██
██ ██ ███
█████ █████ ██
██ ██ ██
██ ██████ ██
F31: Tool for hiding Kali Linux on the network (Reset script)
Author: Caster, @wearecaster, <[email protected]>
Version: 1.0.0
For instructions and an example of how to use it, visit: https://github.com/wearecaster/F31
[+] Restoring MAC
[+] Enabling ICMP Redirect
[+] Disabling NTP client
[*] NTP client disabled successfully.
[+] Restoring firewall configuration
[+] Enabling hostname transfer via DHCP
[+] Resetting TTL (TTL=64)
[+] Restoring hostname
[+] Removing traffic shaping (noise reduction)
[+] Traffic shaping removed
[*] Reset script executed successfully
这个工具并非万能药，你必须了解你在基础设施中正在做什么，并尽可能避免风险。