一、环境：华为matebook14s，windows11家庭版25h2，tp-link路由(tl-7dr7299)，
华为荣耀v30(harmonyos4.2)
二、工具：vmware workstation(16.2.4)，Kali-Linux-2020.2，华为手机助手，chatbox(1.12.1)，
kimi k2.7 code，nmap7.8，adb1.0.41，powershell5.1
三、目标：检查路由和手机安全问题
四、发现的问题：
1.笔记本：
PORT STATE SERVICE VERSION
23/tcp filtered telnet
79/tcp filtered finger
113/tcp filtered ident
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
555/tcp filtered dsf
666/tcp filtered doom
808/tcp filtered ccproxy-http
902/tcp filtered iss-realsecure
912/tcp filtered apex-mesh
1001/tcp filtered webpush
1011/tcp filtered unknown
1025/tcp filtered NFS-or-IIS
1029/tcp filtered ms-lsa
1033/tcp filtered netinfo
1068/tcp filtered instl_bootc
1080/tcp filtered socks
1092/tcp filtered obrpd
1234/tcp filtered hotline
1600/tcp filtered issd
1999/tcp filtered tcp-id-port
2000/tcp filtered cisco-sccp
2001/tcp filtered dc
2005/tcp filtered deslogin
3389/tcp filtered ms-wbt-server
4444/tcp filtered krb524
4899/tcp filtered radmin
5000/tcp filtered upnp
5001/tcp filtered commplex-link
5357/tcp filtered wsdapi
5800/tcp filtered vnc-http
5900/tcp filtered vnc
6129/tcp filtered unknown
6969/tcp filtered acmsoda
7000/tcp filtered afs3-fileserver
8000/tcp filtered http-alt
8011/tcp filtered unknown
8888/tcp filtered sun-answerbook
9999/tcp filtered abyss
20000/tcp filtered dnp
31337/tcp filtered Elite
65000/tcp filtered unknown2.路由器：
PORT STATE SERVICE
80/tcp filtered http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1900/tcp open upnp3.手机：
PORT STATE SERVICE
10164/tcp open unknown
35201/tcp open unknown
37643/tcp open unknown
41517/tcp open unknown
62110/tcp open unknown五、kimi解决方案：
1.笔记本：
powershell代码，网关是192.168.1.1，ip地址是192.168.1.102，按需修改：
bash
<#
.SYNOPSIS
Windows 安全加固脚本 - 针对 RPC/SMB 暴露面清理
.DESCRIPTION
本脚本用于：
1. 启用 Windows 防火墙并设置默认入站拒绝
2. 限制 RPC 动态端口范围
3. 阻断 RPC 动态端口入站
4. 禁用高风险服务
5. 清理第三方软件和媒体发现防火墙规则
6. 可选禁用 SMB/NetBIOS
每个步骤都有确认提示和回滚能力。
.NOTES
需要以管理员身份运行
#>
#Requires -RunAsAdministrator
#region 初始化
$Host.UI.RawUI.WindowTitle = "Windows 安全加固脚本"
$ErrorActionPreference = "Stop"
# 创建备份文件路径
$BackupDir = "$env:TEMP\SecurityHardening"
if (-not (Test-Path $BackupDir)) {
New-Item -ItemType Directory -Path $BackupDir -Force | Out-Null
}
$BackupFile = "$BackupDir\Backup_$(Get-Date -Format 'yyyyMMdd_HHmmss').json"
$LogFile = "$BackupDir\Log_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
# 备份存储
$Script:Backup = @{
Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
StepsExecuted = @()
FirewallProfiles = $null
RpcRegistry = $null
FirewallRules = @()
Services = @()
NetBIOS = @()
}
function Write-Log {
param(
[Parameter(Mandatory=$true)][string]$Message,
[ValidateSet("Info","Success","Warning","Error")][string]$Level = "Info"
)
$timestamp = Get-Date -Format "HH:mm:ss"
$colorMap = @{
"Info" = "White"
"Success" = "Green"
"Warning" = "Yellow"
"Error" = "Red"
}
$line = "[$timestamp] [$Level] $Message"
Write-Host $line -ForegroundColor $colorMap[$Level]
Add-Content -Path $LogFile -Value $line -ErrorAction SilentlyContinue
}
function Show-Banner {
Clear-Host
Write-Host "========================================" -ForegroundColor Cyan
Write-Host " Windows 安全加固脚本" -ForegroundColor Cyan
Write-Host "========================================" -ForegroundColor Cyan
Write-Host ""
Write-Host "本脚本将执行以下安全加固操作：" -ForegroundColor White
Write-Host " 1. 启用 Windows 防火墙并设置默认入站拒绝" -ForegroundColor White
Write-Host " 2. 限制 RPC 动态端口范围" -ForegroundColor White
Write-Host " 3. 创建 RPC 动态端口入站阻断规则" -ForegroundColor White
Write-Host " 4. 禁用高风险服务（Print Spooler、远程访问等）" -ForegroundColor White
Write-Host " 5. 禁用华为分布式服务" -ForegroundColor White
Write-Host " 6. 清理第三方软件和媒体发现防火墙规则" -ForegroundColor White
Write-Host " 7. 可选：禁用 SMB 文件共享和 NetBIOS" -ForegroundColor White
Write-Host ""
Write-Host "所有修改都会自动备份，便于回滚。" -ForegroundColor Yellow
Write-Host "备份文件将保存到: $BackupFile" -ForegroundColor Yellow
Write-Host ""
}
function Request-Confirmation {
param(
[Parameter(Mandatory=$true)][string]$Title,
[Parameter(Mandatory=$true)][string]$Description,
[string]$Risk = "中"
)
Write-Host ""
Write-Host "----------------------------------------" -ForegroundColor Cyan
Write-Host "步骤: $Title" -ForegroundColor Cyan
Write-Host "风险等级: $Risk" -ForegroundColor $(if($Risk -eq "高"){"Red"}elseif($Risk -eq "高"){"Yellow"}else{"Green"})
Write-Host ""
Write-Host $Description -ForegroundColor White
Write-Host ""
$choice = Read-Host "是否执行此步骤? [Y]是 [N]否 [A]全部执行 [R]立即回滚并退出 [Q]退出"
return $choice
}
function Save-Backup {
$Script:Backup | ConvertTo-Json -Depth 10 | Out-File -FilePath $BackupFile -Encoding UTF8
Write-Log "备份已保存到: $BackupFile" -Level "Info"
}
#endregion
#region 步骤定义
$Steps = @(
@{
Id = 1
Title = "启用 Windows 防火墙并设置默认入站拒绝"
Risk = "中"
Description = @"
将执行：
- 启用 Domain/Private/Public 所有配置文件的防火墙
- 设置默认入站策略为 Block（阻止）
- 出站保持默认允许
影响：
- 所有未明确允许的入站连接将被阻止
- 某些依赖入站连接的应用可能需要重新配置
"@
Execute = {
Write-Log "正在备份防火墙配置文件状态..." -Level "Info"
$Script:Backup.FirewallProfiles = Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction
Write-Log "正在启用防火墙并设置默认入站拒绝..." -Level "Info"
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True -DefaultInboundAction Block
$result = Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction
Write-Log "防火墙配置完成：" -Level "Success"
$result | ForEach-Object { Write-Log " $($_.Name): Enabled=$($_.Enabled), Inbound=$($_.DefaultInboundAction)" -Level "Success" }
}
Rollback = {
if ($Script:Backup.FirewallProfiles) {
Write-Log "正在回滚防火墙配置..." -Level "Warning"
foreach ($profile in $Script:Backup.FirewallProfiles) {
Set-NetFirewallProfile -Name $profile.Name `
-Enabled $profile.Enabled `
-DefaultInboundAction $profile.DefaultInboundAction `
-DefaultOutboundAction $profile.DefaultOutboundAction
}
Write-Log "防火墙配置已回滚" -Level "Success"
}
}
},
@{
Id = 2
Title = "限制 RPC 动态端口范围"
Risk = "中"
Description = @"
将执行：
- 设置 RPC 动态端口范围为 50000-50020
- 修改注册表：HKLM\Software\Microsoft\Rpc\Internet
影响：
- Windows RPC 将只使用 50000-50020 范围内的端口
- 需要重启后才能完全生效
- 如果业务需要大量 RPC 连接，可能需要调整范围
"@
Execute = {
Write-Log "正在备份 RPC 注册表配置..." -Level "Info"
$rpcPath = "HKLM:\Software\Microsoft\Rpc\Internet"
$Script:Backup.RpcRegistry = @{
Path = $rpcPath
Exists = Test-Path $rpcPath
}
if ($Script:Backup.RpcRegistry.Exists) {
$props = Get-ItemProperty -Path $rpcPath -ErrorAction SilentlyContinue
$Script:Backup.RpcRegistry.Ports = $props.Ports
$Script:Backup.RpcRegistry.PortsInternetAvailable = $props.PortsInternetAvailable
$Script:Backup.RpcRegistry.UseInternetPorts = $props.UseInternetPorts
}
Write-Log "正在设置 RPC 动态端口范围为 50000-50020..." -Level "Info"
New-Item -Path $rpcPath -Force | Out-Null
Set-ItemProperty -Path $rpcPath -Name "Ports" -Value "50000-50020" -Type MultiString
Set-ItemProperty -Path $rpcPath -Name "PortsInternetAvailable" -Value "Y" -Type String
Set-ItemProperty -Path $rpcPath -Name "UseInternetPorts" -Value "Y" -Type String
$result = Get-ItemProperty -Path $rpcPath
Write-Log "RPC 端口范围已设置：" -Level "Success"
Write-Log " Ports = $($result.Ports)" -Level "Success"
Write-Log " PortsInternetAvailable = $($result.PortsInternetAvailable)" -Level "Success"
Write-Log " UseInternetPorts = $($result.UseInternetPorts)" -Level "Success"
Write-Log "注意：重启后生效" -Level "Warning"
}
Rollback = {
Write-Log "正在回滚 RPC 注册表配置..." -Level "Warning"
$rpcPath = "HKLM:\Software\Microsoft\Rpc\Internet"
if (-not $Script:Backup.RpcRegistry.Exists) {
Remove-Item -Path $rpcPath -Recurse -Force -ErrorAction SilentlyContinue
Write-Log "RPC 注册表项已删除" -Level "Success"
} else {
$props = $Script:Backup.RpcRegistry
if ($props.Ports) {
Set-ItemProperty -Path $rpcPath -Name "Ports" -Value $props.Ports -Type MultiString
} else {
Remove-ItemProperty -Path $rpcPath -Name "Ports" -ErrorAction SilentlyContinue
}
if ($props.PortsInternetAvailable) {
Set-ItemProperty -Path $rpcPath -Name "PortsInternetAvailable" -Value $props.PortsInternetAvailable -Type String
} else {
Remove-ItemProperty -Path $rpcPath -Name "PortsInternetAvailable" -ErrorAction SilentlyContinue
}
if ($props.UseInternetPorts) {
Set-ItemProperty -Path $rpcPath -Name "UseInternetPorts" -Value $props.UseInternetPorts -Type String
} else {
Remove-ItemProperty -Path $rpcPath -Name "UseInternetPorts" -ErrorAction SilentlyContinue
}
Write-Log "RPC 注册表配置已回滚" -Level "Success"
}
}
},
@{
Id = 3
Title = "创建 RPC 动态端口入站阻断规则"
Risk = "低"
Description = @"
将执行：
- 删除所有现有的 RPC 相关入站规则
- 创建新的 Block 规则，阻止 50000-50020 入站
- 应用于 Domain/Private/Public 所有配置文件
影响：
- 外部网络无法访问 RPC 动态端口
- 本地 RPC 通信不受影响
"@
Execute = {
Write-Log "正在备份现有 RPC 防火墙规则..." -Level "Info"
$existingRules = Get-NetFirewallRule | Where-Object {
$_.DisplayName -like "*RPC*" -and $_.Direction -eq "Inbound"
}
foreach ($rule in $existingRules) {
$portFilter = $rule | Get-NetFirewallPortFilter
$Script:Backup.FirewallRules += @{
Name = $rule.Name
DisplayName = $rule.DisplayName
Direction = $rule.Direction
Action = $rule.Action
Enabled = $rule.Enabled
Profile = $rule.Profile
Protocol = $portFilter.Protocol
LocalPort = $portFilter.LocalPort
RemoteAddress = $portFilter.RemoteAddress
Exists = $true
}
}
Write-Log "正在删除旧 RPC 规则..." -Level "Info"
$existingRules | Remove-NetFirewallRule
Write-Log "正在创建 RPC 阻断规则..." -Level "Info"
New-NetFirewallRule `
-DisplayName "Block_RPC_Dynamic_Ports_Inbound" `
-Name "Block_RPC_Dynamic_Ports_Inbound" `
-Direction Inbound `
-Protocol TCP `
-LocalPort 50000-50020 `
-RemoteAddress Any `
-Action Block `
-Profile Domain,Public,Private | Out-Null
Write-Log "RPC 入站阻断规则已创建" -Level "Success"
}
Rollback = {
Write-Log "正在回滚 RPC 防火墙规则..." -Level "Warning"
# 删除新创建的规则
Get-NetFirewallRule -Name "Block_RPC_Dynamic_Ports_Inbound" -ErrorAction SilentlyContinue | Remove-NetFirewallRule
# 恢复旧规则
foreach ($rule in $Script:Backup.FirewallRules) {
if ($rule.Exists) {
New-NetFirewallRule `
-Name $rule.Name `
-DisplayName $rule.DisplayName `
-Direction $rule.Direction `
-Action $rule.Action `
-Enabled $rule.Enabled `
-Profile $rule.Profile `
-Protocol $rule.Protocol `
-LocalPort $rule.LocalPort `
-RemoteAddress $rule.RemoteAddress | Out-Null
}
}
Write-Log "RPC 防火墙规则已回滚" -Level "Success"
}
},
@{
Id = 4
Title = "禁用高风险服务"
Risk = "中"
Description = @"
将执行：
- 停止并禁用 Print Spooler（打印服务）
- 停止并禁用 RemoteAccess（路由和远程访问）
- 停止并禁用 RemoteRegistry（远程注册表）
- 停止并禁用 WinRM（Windows 远程管理）
- 停止并禁用 VMAuthdService（VMware 远程认证，如存在）
影响：
- 本地打印功能将不可用
- 远程管理功能将不可用
- VMware 远程连接功能将不可用
"@
Execute = {
$services = @("Spooler", "RemoteAccess", "RemoteRegistry", "WinRM", "VMAuthdService")
foreach ($svcName in $services) {
$svc = Get-Service -Name $svcName -ErrorAction SilentlyContinue
if ($svc) {
$Script:Backup.Services += @{
Name = $svc.Name
OriginalStatus = $svc.Status
OriginalStartType = $svc.StartType
}
Write-Log "正在停止并禁用服务: $svcName" -Level "Info"
Stop-Service -Name $svcName -Force -ErrorAction SilentlyContinue
Set-Service -Name $svcName -StartupType Disabled
} else {
Write-Log "服务不存在，跳过: $svcName" -Level "Warning"
}
}
Write-Log "高风险服务已处理" -Level "Success"
}
Rollback = {
Write-Log "正在回滚服务配置..." -Level "Warning"
foreach ($svcBackup in $Script:Backup.Services) {
$svcName = $svcBackup.Name
Write-Log "恢复服务: $svcName" -Level "Info"
Set-Service -Name $svcName -StartupType $svcBackup.OriginalStartType
if ($svcBackup.OriginalStatus -eq "Running") {
Start-Service -Name $svcName -ErrorAction SilentlyContinue
}
}
Write-Log "服务配置已回滚" -Level "Success"
}
},
@{
Id = 5
Title = "禁用华为分布式服务"
Risk = "中"
Description = @"
将执行：
- 停止并禁用 HwDistributedMainService
- 停止并禁用 HiConnectivityService
- 停止并禁用 MBAMainService
- 结束华为电脑管家相关进程
影响：
- 华为手机/平板多屏协同功能将失效
- 一碰传、Huawei Share 功能将失效
- 华为设备互联相关功能将失效
"@
Execute = {
$huaweiServices = @("HwDistributedMainService", "HiConnectivityService", "MBAMainService")
foreach ($svcName in $huaweiServices) {
$svc = Get-Service -Name $svcName -ErrorAction SilentlyContinue
if ($svc) {
$Script:Backup.Services += @{
Name = $svc.Name
OriginalStatus = $svc.Status
OriginalStartType = $svc.StartType
Category = "Huawei"
}
Write-Log "正在停止并禁用华为服务: $svcName" -Level "Info"
sc.exe stop $svcName | Out-Null
sc.exe config $svcName start= disabled | Out-Null
} else {
Write-Log "华为服务不存在，跳过: $svcName" -Level "Warning"
}
}
Write-Log "正在结束华为相关进程..." -Level "Info"
$huaweiProcs = @("*Huawei*", "*Hw*", "*HiConnect*", "*PCManager*")
Get-Process | Where-Object {
$proc = $_
$matched = $false
foreach ($p in $huaweiProcs) {
if ($proc.ProcessName -like $p) { $matched = $true; break }
}
$matched
} | ForEach-Object {
Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue
Write-Log "已结束进程: $($_.ProcessName)" -Level "Info"
}
Write-Log "华为分布式服务已禁用" -Level "Success"
}
Rollback = {
Write-Log "正在回滚华为服务配置..." -Level "Warning"
foreach ($svcBackup in $Script:Backup.Services | Where-Object { $_.Category -eq "Huawei" }) {
$svcName = $svcBackup.Name
sc.exe config $svcName start= $svcBackup.OriginalStartType | Out-Null
if ($svcBackup.OriginalStatus -eq "Running") {
sc.exe start $svcName | Out-Null
}
Write-Log "已恢复华为服务: $svcName" -Level "Success"
}
}
},
@{
Id = 6
Title = "清理第三方软件和媒体发现防火墙规则"
Risk = "低"
Description = @"
将执行：
- 禁用华为相关入站防火墙规则
- 禁用 WeMeet/微信/飞书等第三方软件规则
- 禁用 mDNS/UPnP/无线显示/播放到设备/AllJoyn 等媒体发现规则
- 禁用 VMware 入站规则（如存在）
影响：
- 相关软件的网络发现功能可能受限
- 不影响软件正常使用（仅阻止主动入站）
"@
Execute = {
Write-Log "正在备份将被禁用的第三方防火墙规则..." -Level "Info"
$patterns = @(
"*Hw*", "*HWMIRROR*", "*HWEXSCREEN*", "*HMDFSSERVICE*", "*DISTRIBUTEDFILESERVICE*",
"*HwMdcCenter*", "*MB Assistant*", "*华为*", "*Huawei*",
"*WeMeet*", "*Weixin*", "*微信开发者工具*", "*feishu*", "*WeLook*",
"*JdReader*", "*qihu_se*", "*nat_detect_client*", "*guluplugin*", "*APlayer*",
"*DownloadSDKServer*", "*Node.js*", "*Java*", "*Redis*",
"*mDNS*", "*DIAL*", "*AllJoyn*", "*Wi-Fi Direct*", "*无线显示*",
"*播放到设备*", "*无线显示器*", "*邻近感应*", "*连接设备平台*",
"*VMware*"
)
$rulesToDisable = Get-NetFirewallRule | Where-Object {
$rule = $_
$matched = $false
foreach ($p in $patterns) {
if ($rule.DisplayName -like $p) { $matched = $true; break }
}
$matched -and $_.Direction -eq "Inbound" -and $_.Enabled -eq "True"
}
foreach ($rule in $rulesToDisable) {
$Script:Backup.FirewallRules += @{
Name = $rule.Name
DisplayName = $rule.DisplayName
WasEnabled = $true
Category = "ThirdParty"
}
Disable-NetFirewallRule -Name $rule.Name
Write-Log "已禁用防火墙规则: $($rule.DisplayName)" -Level "Info"
}
Write-Log "第三方和媒体发现规则已清理" -Level "Success"
}
Rollback = {
Write-Log "正在回滚第三方防火墙规则..." -Level "Warning"
foreach ($ruleBackup in $Script:Backup.FirewallRules | Where-Object { $_.Category -eq "ThirdParty" }) {
Enable-NetFirewallRule -Name $ruleBackup.Name
Write-Log "已启用防火墙规则: $($ruleBackup.DisplayName)" -Level "Success"
}
}
},
@{
Id = 7
Title = "可选：禁用 SMB 文件共享和 NetBIOS"
Risk = "高"
Description = @"
将执行：
- 停止并禁用 LanmanServer 服务（SMB 服务器）
- 在所有网络适配器上禁用 NetBIOS over TCP/IP
影响：
- 本机将无法作为文件/打印机共享服务器
- 无法被其他计算机访问共享文件夹
- 无法通过 \\计算机名 访问本机
- 域环境计算机请谨慎操作
警告：此步骤风险较高，仅当确认不需要共享功能时执行！
"@
Execute = {
$confirm2 = Read-Host "此步骤风险较高，确定要禁用 SMB/NetBIOS 吗？输入 YES 确认"
if ($confirm2 -ne "YES") {
Write-Log "用户取消了 SMB/NetBIOS 禁用操作" -Level "Warning"
return
}
# 备份 LanmanServer
$svc = Get-Service -Name LanmanServer -ErrorAction SilentlyContinue
if ($svc) {
$Script:Backup.Services += @{
Name = $svc.Name
OriginalStatus = $svc.Status
OriginalStartType = $svc.StartType
Category = "SMB"
}
Write-Log "正在停止并禁用 LanmanServer 服务..." -Level "Info"
Stop-Service -Name LanmanServer -Force
Set-Service -Name LanmanServer -StartupType Disabled
}
# 备份并禁用 NetBIOS
Write-Log "正在备份并禁用 NetBIOS over TCP/IP..." -Level "Info"
$adapters = Get-WmiObject Win32_NetworkAdapterConfiguration -Filter "IPEnabled='True'"
foreach ($adapter in $adapters) {
$Script:Backup.NetBIOS += @{
SettingID = $adapter.SettingID
OriginalValue = $adapter.TcpipNetbiosOptions
}
$adapter.SetTcpipNetbios(2) | Out-Null
Write-Log "已禁用 NetBIOS: $($adapter.Description)" -Level "Info"
}
Write-Log "SMB/NetBIOS 已禁用" -Level "Success"
}
Rollback = {
Write-Log "正在回滚 SMB/NetBIOS 配置..." -Level "Warning"
# 恢复 LanmanServer
$svcBackup = $Script:Backup.Services | Where-Object { $_.Category -eq "SMB" } | Select-Object -First 1
if ($svcBackup) {
Set-Service -Name $svcBackup.Name -StartupType $svcBackup.OriginalStartType
if ($svcBackup.OriginalStatus -eq "Running") {
Start-Service -Name $svcBackup.Name -ErrorAction SilentlyContinue
}
}
# 恢复 NetBIOS
foreach ($nbBackup in $Script:Backup.NetBIOS) {
$adapter = Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object { $_.SettingID -eq $nbBackup.SettingID }
if ($adapter) {
$adapter.SetTcpipNetbios($nbBackup.OriginalValue) | Out-Null
Write-Log "已恢复 NetBIOS: $($adapter.Description)" -Level "Success"
}
}
Write-Log "SMB/NetBIOS 配置已回滚" -Level "Success"
}
}
)
#endregion
#region 执行引擎
function Invoke-Step {
param(
[Parameter(Mandatory=$true)][hashtable]$Step,
[switch]$AutoConfirm
)
if (-not $AutoConfirm) {
$choice = Request-Confirmation -Title $Step.Title -Description $Step.Description -Risk $Step.Risk
} else {
$choice = "Y"
}
switch ($choice) {
"Y" {
Write-Log "开始执行: $($Step.Title)" -Level "Info"
try {
& $Step.Execute
$Script:Backup.StepsExecuted += $Step.Id
Save-Backup
Write-Log "步骤 $($Step.Id) 执行成功" -Level "Success"
}
catch {
Write-Log "步骤 $($Step.Id) 执行失败: $_" -Level "Error"
$rollbackChoice = Read-Host "执行失败，是否回滚此步骤？ [Y]是 [N]否"
if ($rollbackChoice -eq "Y") {
& $Step.Rollback
}
}
}
"N" {
Write-Log "跳过步骤 $($Step.Id): $($Step.Title)" -Level "Warning"
}
"A" {
return "ALL"
}
"R" {
Invoke-Rollback
exit
}
"Q" {
Write-Log "用户退出脚本" -Level "Warning"
exit
}
default {
Write-Log "无效输入，跳过此步骤" -Level "Warning"
}
}
return "CONTINUE"
}
function Invoke-Rollback {
Write-Host ""
Write-Host "========================================" -ForegroundColor Red
Write-Host " 执行回滚操作" -ForegroundColor Red
Write-Host "========================================" -ForegroundColor Red
Write-Host ""
# 按反向顺序回滚已执行的步骤
$reversedSteps = $Script:Backup.StepsExecuted | Sort-Object -Descending
foreach ($stepId in $reversedSteps) {
$step = $Steps | Where-Object { $_.Id -eq $stepId }
if ($step) {
Write-Log "正在回滚步骤 $($step.Id): $($step.Title)" -Level "Warning"
try {
& $step.Rollback
}
catch {
Write-Log "回滚步骤 $($step.Id) 时出错: $_" -Level "Error"
}
}
}
Write-Log "回滚完成" -Level "Success"
}
function Show-FinalReport {
Clear-Host
Write-Host "========================================" -ForegroundColor Green
Write-Host " 加固执行报告" -ForegroundColor Green
Write-Host "========================================" -ForegroundColor Green
Write-Host ""
Write-Host "已执行的步骤：" -ForegroundColor White
foreach ($stepId in $Script:Backup.StepsExecuted) {
$step = $Steps | Where-Object { $_.Id -eq $stepId }
Write-Host " ✓ $($step.Id). $($step.Title)" -ForegroundColor Green
}
Write-Host ""
Write-Host "备份文件位置：" -ForegroundColor Yellow
Write-Host " $BackupFile" -ForegroundColor Yellow
Write-Host ""
Write-Host "日志文件位置：" -ForegroundColor Yellow
Write-Host " $LogFile" -ForegroundColor Yellow
Write-Host ""
Write-Host "验证命令：" -ForegroundColor Cyan
Write-Host " Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction" -ForegroundColor White
Write-Host " Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Rpc\Internet'" -ForegroundColor White
Write-Host " netstat -ano | findstr LISTENING" -ForegroundColor White
Write-Host ""
Write-Host "注意：RPC 端口范围修改需要重启后才能完全生效。" -ForegroundColor Yellow
}
#endregion
#region 主程序
Show-Banner
$autoMode = $false
foreach ($step in $Steps) {
$result = Invoke-Step -Step $step -AutoConfirm:$autoMode
if ($result -eq "ALL") {
$autoMode = $true
Invoke-Step -Step $step -AutoConfirm:$true
}
}
# 最终确认是否需要回滚
Write-Host ""
$finalChoice = Read-Host "所有步骤已处理，是否需要整体回滚？ [Y]是 [N]否"
if ($finalChoice -eq "Y") {
Invoke-Rollback
} else {
Show-FinalReport
}
#endregion使用方法：
将上述内容保存为 SecurityHardening.ps1。
如果 PowerShell 禁止执行脚本，先运行：
bash
#powershell
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser管理员身份运行：
bash
#powershell
.\SecurityHardening.ps1验证：
bash
#kali
nmap -p- 192.168.1.102最终结果：
All 65535 scanned ports on 192.168.1.102 are filtered2.路由器：
kali代码，网关是192.168.1.1，ip地址是192.168.1.102，按需修改：
bash
#!/bin/bash
#===============================================================================
#
# FILE: router_security_toolkit.sh
#
# USAGE: ./router_security_toolkit.sh
#
# DESCRIPTION: TP-LINK TL-7DR7299 安全检测与加固工具包
# 每个操作都包含：提示 -> 确认 -> 执行 -> 备份 -> 可回滚
#
# OPTIONS: 交互式菜单
# REQUIREMENTS: nmap, upnpc, iptables/nftables, curl, crontab
# AUTHOR: Security Toolkit
# VERSION: 1.0
# CREATED: 2026-07-22
#===============================================================================
#===============================================================================
# 颜色定义
#===============================================================================
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
CYAN='\033[0;36m'
NC='\033[0m' # No Color
#===============================================================================
# 全局配置
#===============================================================================
ROUTER_IP="192.168.1.1"
WAN_IP="221.231.223.122"
BACKUP_DIR="/root/router_security_backups"
LOG_FILE="/var/log/router_security_toolkit.log"
SCRIPT_DIR="/root"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
# 需要创建的目录
mkdir -p "$BACKUP_DIR" 2>/dev/null
#===============================================================================
# 日志函数
#===============================================================================
log() {
echo -e "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}
log_info() {
log "${BLUE}[INFO]${NC} $1"
}
log_success() {
log "${GREEN}[SUCCESS]${NC} $1"
}
log_warn() {
log "${YELLOW}[WARN]${NC} $1"
}
log_error() {
log "${RED}[ERROR]${NC} $1"
}
#===============================================================================
# 通用确认函数
# $1: 提示信息
# $2: 危险等级 (normal/critical)
# 返回: 0=确认, 1=取消
#===============================================================================
confirm_action() {
local msg="$1"
local level="${2:-normal}"
local prompt_color=""
if [ "$level" == "critical" ]; then
prompt_color="${RED}"
else
prompt_color="${YELLOW}"
fi
echo ""
echo -e "${prompt_color}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo -e "${prompt_color}⚠ 操作确认${NC}"
echo -e "${prompt_color}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo -e "${CYAN}$msg${NC}"
echo ""
echo -e "${YELLOW}输入 'yes' 确认执行，输入其他任意键取消:${NC}"
read -r CONFIRM
if [ "$CONFIRM" == "yes" ]; then
log_info "用户确认执行操作: $msg"
return 0
else
log_warn "用户取消操作: $msg"
echo -e "${YELLOW}操作已取消。${NC}"
return 1
fi
}
#===============================================================================
# 通用提示函数
#===============================================================================
show_info() {
echo ""
echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo -e "${CYAN}ℹ 信息提示${NC}"
echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo -e "$1"
echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo ""
}
#===============================================================================
# 显示主菜单
#===============================================================================
show_menu() {
clear
echo ""
echo -e "${GREEN}╔════════════════════════════════════════════════════════════╗${NC}"
echo -e "${GREEN}║ TP-LINK TL-7DR7299 安全检测与加固工具包 v1.0 ║${NC}"
echo -e "${GREEN}╚════════════════════════════════════════════════════════════╝${NC}"
echo ""
echo -e "${CYAN} [1]${NC} 扫描路由器暴露端口 (80/139/445/1900)"
echo -e "${CYAN} [2]${NC} 扫描路由器全部端口"
echo -e "${CYAN} [3]${NC} 列出当前 UPnP 端口映射"
echo -e "${CYAN} [4]${NC} 清理危险 UPnP 端口映射"
echo -e "${CYAN} [5]${NC} 部署自动清理 UPnP 映射脚本 (crontab)"
echo -e "${CYAN} [6]${NC} 删除自动清理脚本 (crontab 回滚)"
echo -e "${CYAN} [7]${NC} 部署网络层拦截 (iptables 阻断 SMB/UPnP)"
echo -e "${CYAN} [8]${NC} 撤销网络层拦截 (iptables 回滚)"
echo -e "${CYAN} [9]${NC} 生成完整安全检查报告"
echo -e "${CYAN} [10]${NC} 一键执行推荐加固方案"
echo -e "${CYAN} [11]${NC} 恢复所有修改 (完全回滚)"
echo -e "${CYAN} [0]${NC} 退出"
echo ""
echo -e "${YELLOW}请选择操作 [0-11]:${NC}"
}
#===============================================================================
# 功能 1: 扫描路由器暴露端口
#===============================================================================
scan_router_ports() {
show_info "将扫描路由器 ${ROUTER_IP} 的关键端口:\n\n • 80/tcp - HTTP 管理页面\n • 139/tcp - NetBIOS SMB\n • 445/tcp - Microsoft-DS SMB\n • 1900/tcp - UPnP SSDP\n • 1900/udp - UPnP SSDP\n\n此操作只读取信息，不会修改任何配置。"
confirm_action "是否扫描路由器 ${ROUTER_IP} 的关键端口？" || return 1
log_info "开始扫描路由器关键端口..."
echo -e "\n${CYAN}[1/3] TCP 端口扫描...${NC}"
nmap -sV -Pn -p 80,139,445,1900 "$ROUTER_IP" -oN "$BACKUP_DIR/port_scan_tcp_$TIMESTAMP.txt"
echo -e "\n${CYAN}[2/3] UDP 1900 扫描...${NC}"
nmap -sU -Pn -p 1900 --script=upnp-info "$ROUTER_IP" -oN "$BACKUP_DIR/port_scan_udp_$TIMESTAMP.txt"
echo -e "\n${CYAN}[3/3] SMB 共享枚举...${NC}"
smbclient -L "//$ROUTER_IP" -N > "$BACKUP_DIR/smb_enum_$TIMESTAMP.txt" 2>&1
log_success "扫描完成，结果保存在: $BACKUP_DIR/"
echo ""
echo -e "${YELLOW}关键结果摘要:${NC}"
# 提取关键状态
grep -E "^(80|139|445|1900)/tcp" "$BACKUP_DIR/port_scan_tcp_$TIMESTAMP.txt" 2>/dev/null || true
echo ""
grep -E "^1900/udp" "$BACKUP_DIR/port_scan_udp_$TIMESTAMP.txt" 2>/dev/null || true
echo ""
echo -e "${YELLOW}SMB 匿名访问测试:${NC}"
cat "$BACKUP_DIR/smb_enum_$TIMESTAMP.txt"
echo ""
read -n 1 -s -r -p "按任意键继续..."
}
#===============================================================================
# 功能 2: 扫描路由器全部端口
#===============================================================================
scan_all_ports() {
show_info "将对路由器 ${ROUTER_IP} 进行全端口扫描 (TCP + UDP)。\n\n此操作耗时较长 (10-30 分钟)，可能会被路由器的入侵检测视为扫描行为。\n只读取信息，不修改配置。"
confirm_action "是否执行全端口扫描？" "normal" || return 1
log_info "开始全端口扫描..."
echo -e "\n${CYAN}[1/2] TCP 全端口扫描...${NC}"
nmap -sV -Pn -p- "$ROUTER_IP" -oN "$BACKUP_DIR/full_scan_tcp_$TIMESTAMP.txt" --max-retries 2
echo -e "\n${CYAN}[2/2] UDP 常见端口扫描...${NC}"
nmap -sU -Pn --top-ports 1000 "$ROUTER_IP" -oN "$BACKUP_DIR/full_scan_udp_$TIMESTAMP.txt" --max-retries 2
log_success "全端口扫描完成，结果保存在: $BACKUP_DIR/"
echo ""
echo -e "${YELLOW}开放的 TCP 端口:${NC}"
grep -E "^[0-9]+/tcp" "$BACKUP_DIR/full_scan_tcp_$TIMESTAMP.txt" 2>/dev/null || echo "未发现开放端口"
echo ""
echo -e "${YELLOW}开放的 UDP 端口:${NC}"
grep -E "^[0-9]+/udp" "$BACKUP_DIR/full_scan_udp_$TIMESTAMP.txt" 2>/dev/null || echo "未发现开放端口"
echo ""
read -n 1 -s -r -p "按任意键继续..."
}
#===============================================================================
# 功能 3: 列出当前 UPnP 映射
#===============================================================================
list_upnp_mappings() {
show_info "将使用 upnpc -l 列出路由器当前所有 UPnP 端口映射。\n\n注意：此操作只读取信息，不会修改路由器配置。"
confirm_action "是否列出当前 UPnP 映射？" || return 1
log_info "开始列出 UPnP 映射..."
OUTPUT_FILE="$BACKUP_DIR/upnp_mappings_$TIMESTAMP.txt"
upnpc -l > "$OUTPUT_FILE" 2>&1
echo -e "\n${CYAN}当前 UPnP 映射列表:${NC}\n"
cat "$OUTPUT_FILE"
# 统计映射数量
COUNT=$(grep -cE "^[[:space:]]+[0-9]+[[:space:]]+(UDP|TCP)" "$OUTPUT_FILE" 2>/dev/null || echo 0)
echo ""
log_info "发现 $COUNT 条 UPnP 映射"
# 高亮可疑描述
if grep -Eiq "(MiniTP|live-|vod-|p2p|torrent|xunlei|thunder|remote|backdoor)" "$OUTPUT_FILE"; then
echo ""
log_warn "⚠ 发现可疑映射描述，建议使用 [4] 清理危险映射"
fi
echo ""
read -n 1 -s -r -p "按任意键继续..."
}
#===============================================================================
# 功能 4: 清理危险 UPnP 端口映射
#===============================================================================
clean_dangerous_upnp() {
show_info "将自动清理路由器上的危险 UPnP 端口映射。\n\n清理规则包括:\n • MiniTP SDK 相关 (P2P/远程控制)\n • 迅雷/迅雷看看相关\n • IPTV/直播/VOD 相关 (live-, vod-)\n • 常见恶意软件端口 (54321, 12345, 28571 等)\n • 远程桌面 (3389), VNC (5900) 等敏感端口\n\n${RED}警告：如果某些映射是合法服务需要的，删除后可能影响功能。${NC}\n建议先执行 [3] 查看当前映射。"
confirm_action "是否清理危险 UPnP 端口映射？" "critical" || return 1
log_info "开始清理危险 UPnP 映射..."
# 备份当前映射
BACKUP_FILE="$BACKUP_DIR/upnp_before_clean_$TIMESTAMP.txt"
upnpc -l > "$BACKUP_FILE" 2>&1
log_info "已备份当前映射到: $BACKUP_FILE"
# 危险端口列表
DANGEROUS_PORTS="54321 12345 28571 3389 5900 31337 1900 139 445"
# IPTV/直播类端口
IPTV_PORTS="8690 8551 8567 8354 8153 8177 8674 8433 8434 8022 8579 8255 8467 8069 8506 8428 8685 8286 8281 8278 8482 8736 8087 8537 8725 8346 8452 8018 8376 8205 8134 8474 8473 8126 8743 8755 8454 8221 8014 8797 8753"
ALL_PORTS="$DANGEROUS_PORTS $IPTV_PORTS"
DELETED=0
echo -e "\n${CYAN}开始删除危险端口映射...${NC}\n"
for PORT in $ALL_PORTS; do
# 删除 TCP
RESULT=$(upnpc -d "$PORT" TCP 2>&1)
if echo "$RESULT" | grep -q "returned : 0"; then
log_success "已删除 TCP $PORT"
echo -e "${GREEN}[-] TCP $PORT${NC}"
((DELETED++))
fi
# 删除 UDP
RESULT=$(upnpc -d "$PORT" UDP 2>&1)
if echo "$RESULT" | grep -q "returned : 0"; then
log_success "已删除 UDP $PORT"
echo -e "${GREEN}[-] UDP $PORT${NC}"
((DELETED++))
fi
done
# 删除描述匹配的可疑映射
echo -e "\n${CYAN}开始按描述清理可疑映射...${NC}\n"
TMP_LIST=$(mktemp)
upnpc -l > "$TMP_LIST" 2>&1
SUSPICIOUS_PATTERNS="MiniTP|live-|vod-|xunlei|thunder|torrent|p2p|remote|backdoor"
while IFS= read -r line; do
if echo "$line" | grep -Eq '^[[:space:]]+[0-9]+[[:space:]]+(UDP|TCP)'; then
PROTOCOL=$(echo "$line" | awk '{print $2}')
EX_PORT=$(echo "$line" | awk '{print $3}' | cut -d'-' -f1)
DESCRIPTION=$(echo "$line" | awk -F"'" '{print $2}')
if echo "$DESCRIPTION" | grep -Eiq "$SUSPICIOUS_PATTERNS"; then
RESULT=$(upnpc -d "$EX_PORT" "$PROTOCOL" 2>&1)
if echo "$RESULT" | grep -q "returned : 0"; then
log_success "已删除 [$PROTOCOL $EX_PORT] $DESCRIPTION"
echo -e "${GREEN}[-] $PROTOCOL $EX_PORT ($DESCRIPTION)${NC}"
((DELETED++))
else
log_warn "删除 [$PROTOCOL $EX_PORT] $DESCRIPTION 失败"
echo -e "${RED}[!] $PROTOCOL $EX_PORT ($DESCRIPTION) 删除失败${NC}"
fi
fi
fi
done < "$TMP_LIST"
rm -f "$TMP_LIST"
echo ""
if [ "$DELETED" -gt 0 ]; then
log_success "共删除 $DELETED 条危险映射"
else
log_info "未发现需要删除的危险映射"
fi
# 保存回滚信息
ROLLBACK_FILE="$BACKUP_DIR/rollback_upnp_$TIMESTAMP.sh"
cat > "$ROLLBACK_FILE" << ROLLBACK
#!/bin/bash
# 回滚脚本：恢复清理前的 UPnP 映射
# 注意：UPnP 映射本身无法完全恢复，此文件仅记录清理前的状态供人工参考
cat "$BACKUP_FILE"
echo "请根据上方记录手动重新添加需要的映射"
ROLLBACK
chmod +x "$ROLLBACK_FILE"
log_info "回滚参考文件已保存: $ROLLBACK_FILE"
echo ""
echo -e "${CYAN}清理后当前映射:${NC}"
upnpc -l
echo ""
read -n 1 -s -r -p "按任意键继续..."
}
#===============================================================================
# 功能 5: 部署自动清理脚本 (crontab)
#===============================================================================
deploy_auto_clean() {
show_info "将在 Kali 上部署自动清理 UPnP 映射的脚本，并加入 crontab 定时执行。\n\n可选频率:\n • 每小时一次 (推荐日常使用)\n • 每 30 分钟一次 (较严格)\n • 每 10 分钟一次 (观察期，最严格)\n\n脚本会:\n 1. 检查当前 UPnP 映射\n 2. 删除非白名单的可疑映射\n 3. 记录日志到 /var/log/clear_upnp.log"
confirm_action "是否部署自动清理脚本？" || return 1
echo ""
echo -e "${YELLOW}请选择执行频率:${NC}"
echo -e "${CYAN} [1]${NC} 每小时一次 (推荐)"
echo -e "${CYAN} [2]${NC} 每 30 分钟一次"
echo -e "${CYAN} [3]${NC} 每 10 分钟一次 (观察期)"
read -r FREQ_CHOICE
case "$FREQ_CHOICE" in
1) CRON_EXPR="0 * * * *" ;;
2) CRON_EXPR="*/30 * * * *" ;;
3) CRON_EXPR="*/10 * * * *" ;;
*)
log_warn "无效选择，默认使用每小时一次"
CRON_EXPR="0 * * * *"
;;
esac
# 创建自动清理脚本
AUTO_SCRIPT="$SCRIPT_DIR/clear_upnp_auto.sh"
cat > "$AUTO_SCRIPT" << 'AUTOEOF'
#!/bin/bash
# 自动清理 UPnP 映射脚本
LOG_FILE="/var/log/clear_upnp.log"
LOCK_FILE="/tmp/clear_upnp_auto.lock"
if [ -f "$LOCK_FILE" ]; then
PID=$(cat "$LOCK_FILE")
if ps -p "$PID" > /dev/null 2>&1; then
echo "$(date '+%Y-%m-%d %H:%M:%S') - 脚本正在运行 (PID: $PID)，退出" >> "$LOG_FILE"
exit 1
fi
fi
echo $$ > "$LOCK_FILE"
echo "$(date '+%Y-%m-%d %H:%M:%S') - ===== 自动清理开始 =====" >> "$LOG_FILE"
# 白名单（保留这些描述的映射）
WHITELIST=(
"wechat"
"weixin"
)
TMP_LIST=$(mktemp)
upnpc -l > "$TMP_LIST" 2>&1
DELETED=0
SUSPICIOUS_PATTERNS="MiniTP|live-|vod-|xunlei|thunder|torrent|p2p|remote|backdoor|MiniTP SDK"
while IFS= read -r line; do
if echo "$line" | grep -Eq '^[[:space:]]+[0-9]+[[:space:]]+(UDP|TCP)'; then
PROTOCOL=$(echo "$line" | awk '{print $2}')
EX_PORT=$(echo "$line" | awk '{print $3}' | cut -d'-' -f1)
DESCRIPTION=$(echo "$line" | awk -F"'" '{print $2}')
IS_WHITELISTED=0
for PATTERN in "${WHITELIST[@]}"; do
if echo "$DESCRIPTION" | grep -Eiq "$PATTERN"; then
IS_WHITELISTED=1
break
fi
done
if [ "$IS_WHITELISTED" -eq 1 ]; then
echo "$(date '+%Y-%m-%d %H:%M:%S') - 保留 [$PROTOCOL $EX_PORT] $DESCRIPTION" >> "$LOG_FILE"
else
echo "$(date '+%Y-%m-%d %H:%M:%S') - 删除 [$PROTOCOL $EX_PORT] $DESCRIPTION" >> "$LOG_FILE"
upnpc -d "$EX_PORT" "$PROTOCOL" >> "$LOG_FILE" 2>&1
((DELETED++))
fi
fi
done < "$TMP_LIST"
rm -f "$TMP_LIST"
if [ "$DELETED" -gt 0 ]; then
echo "$(date '+%Y-%m-%d %H:%M:%S') - 共删除 $DELETED 条非白名单映射" >> "$LOG_FILE"
else
echo "$(date '+%Y-%m-%d %H:%M:%S') - 没有非白名单映射需要删除" >> "$LOG_FILE"
fi
echo "$(date '+%Y-%m-%d %H:%M:%S') - ===== 自动清理结束 =====" >> "$LOG_FILE"
echo "" >> "$LOG_FILE"
rm -f "$LOCK_FILE"
AUTOEOF
chmod +x "$AUTO_SCRIPT"
log_info "自动清理脚本已创建: $AUTO_SCRIPT"
# 备份当前 crontab
crontab -l > "$BACKUP_DIR/crontab_backup_$TIMESTAMP.txt" 2>/dev/null || echo "# 无 crontab" > "$BACKUP_DIR/crontab_backup_$TIMESTAMP.txt"
log_info "当前 crontab 已备份: $BACKUP_DIR/crontab_backup_$TIMESTAMP.txt"
# 安装到 crontab
# 先清除旧的 clear_upnp 相关任务
crontab -l 2>/dev/null | grep -v "clear_upnp" | crontab -
# 添加新任务
(crontab -l 2>/dev/null; echo "$CRON_EXPR /root/clear_upnp_auto.sh") | crontab -
# 启动 cron 服务
systemctl enable cron --now 2>/dev/null || service cron start 2>/dev/null
log_success "自动清理已部署，执行频率: $CRON_EXPR"
echo ""
echo -e "${CYAN}当前 crontab:${NC}"
crontab -l
echo ""
echo -e "${YELLOW}测试运行中...${NC}"
"$AUTO_SCRIPT"
echo -e "${CYAN}最新日志:${NC}"
tail -20 "$LOG_FILE"
echo ""
read -n 1 -s -r -p "按任意键继续..."
}
#===============================================================================
# 功能 6: 删除自动清理脚本 (crontab 回滚)
#===============================================================================
rollback_auto_clean() {
show_info "将撤销自动清理脚本部署：\n 1. 从 crontab 中删除 clear_upnp_auto 任务\n 2. 停止可能正在运行的脚本\n 3. 可选：删除脚本文件和日志\n\n${YELLOW}注意：此操作不会恢复已经删除的 UPnP 映射。${NC}"
confirm_action "是否撤销自动清理脚本部署？" "critical" || return 1
log_info "开始撤销自动清理脚本..."
# 备份当前 crontab
crontab -l > "$BACKUP_DIR/crontab_before_rollback_$TIMESTAMP.txt" 2>/dev/null || true
# 从 crontab 中移除 clear_upnp 相关条目
crontab -l 2>/dev/null | grep -v "clear_upnp" | crontab -
# 停止可能正在运行的脚本
for PID in $(pgrep -f "clear_upnp_auto.sh"); do
kill "$PID" 2>/dev/null && log_info "已停止运行中的脚本 PID: $PID"
done
rm -f "/tmp/clear_upnp_auto.lock"
log_success "已清空 crontab 中的自动清理任务"
echo ""
echo -e "${YELLOW}是否删除脚本文件和日志？${NC}"
echo -e "输入 'yes' 删除 /root/clear_upnp_auto.sh 和 /var/log/clear_upnp.log"
echo -e "输入其他保留文件（推荐，便于审计）"
read -r DEL_FILES
if [ "$DEL_FILES" == "yes" ]; then
rm -f "$SCRIPT_DIR/clear_upnp_auto.sh"
rm -f "/var/log/clear_upnp.log"
log_info "已删除脚本文件和日志"
else
log_info "保留脚本文件和日志供审计"
fi
echo ""
echo -e "${CYAN}当前 crontab:${NC}"
crontab -l
echo ""
read -n 1 -s -r -p "按任意键继续..."
}
#===============================================================================
# 功能 7: 部署网络层拦截 (iptables)
#===============================================================================
deploy_iptables_block() {
show_info "将使用 iptables 阻止内网设备访问路由器的 SMB (139/445) 和 UPnP (1900) 服务。\n\n适用条件:\n • 本 Kali 主机是网关/软路由/旁路由，流量经过本机\n • 或仅保护本机自己（OUTPUT 链）\n\n此操作需要 root 权限，会修改 iptables 规则。\n规则默认只加在 FORWARD 和 OUTPUT 链，不会阻断正常上网。"
confirm_action "是否部署 iptables 拦截规则？" "critical" || return 1
log_info "开始部署 iptables 拦截规则..."
# 备份当前 iptables 规则
iptables-save > "$BACKUP_DIR/iptables_backup_$TIMESTAMP.txt" 2>/dev/null || true
log_info "当前 iptables 规则已备份: $BACKUP_DIR/iptables_backup_$TIMESTAMP.txt"
# 添加规则
echo -e "\n${CYAN}添加 iptables 规则...${NC}\n"
# FORWARD 链：阻止内网其他设备访问路由器的危险端口
iptables -I FORWARD -d "$ROUTER_IP" -p tcp -m multiport --dports 139,445 -m comment --comment "Block SMB to router" -j DROP
echo -e "${GREEN}[+] FORWARD: drop TCP 139,445 to $ROUTER_IP${NC}"
iptables -I FORWARD -d "$ROUTER_IP" -p tcp --dport 1900 -m comment --comment "Block UPnP TCP to router" -j DROP
echo -e "${GREEN}[+] FORWARD: drop TCP 1900 to $ROUTER_IP${NC}"
iptables -I FORWARD -d "$ROUTER_IP" -p udp --dport 1900 -m comment --comment "Block UPnP UDP to router" -j DROP
echo -e "${GREEN}[+] FORWARD: drop UDP 1900 to $ROUTER_IP${NC}"
iptables -I FORWARD -d 239.255.255.250 -p udp --dport 1900 -m comment --comment "Block SSDP multicast" -j DROP
echo -e "${GREEN}[+] FORWARD: drop SSDP multicast 239.255.255.250:1900${NC}"
# OUTPUT 链：保护本机
iptables -I OUTPUT -d "$ROUTER_IP" -p tcp -m multiport --dports 139,445 -m comment --comment "Block SMB to router (local)" -j DROP
echo -e "${GREEN}[+] OUTPUT: drop TCP 139,445 to $ROUTER_IP${NC}"
iptables -I OUTPUT -d "$ROUTER_IP" -p tcp --dport 1900 -m comment --comment "Block UPnP TCP to router (local)" -j DROP
echo -e "${GREEN}[+] OUTPUT: drop TCP 1900 to $ROUTER_IP${NC}"
iptables -I OUTPUT -d "$ROUTER_IP" -p udp --dport 1900 -m comment --comment "Block UPnP UDP to router (local)" -j DROP
echo -e "${GREEN}[+] OUTPUT: drop UDP 1900 to $ROUTER_IP${NC}"
# 创建回滚脚本
ROLLBACK_FILE="$BACKUP_DIR/rollback_iptables_$TIMESTAMP.sh"
cat > "$ROLLBACK_FILE" << ROLLBACK
#!/bin/bash
# 回滚脚本：恢复 iptables 规则
iptables-restore < "$BACKUP_DIR/iptables_backup_$TIMESTAMP.txt"
echo "iptables 规则已恢复到部署前状态"
ROLLBACK
chmod +x "$ROLLBACK_FILE"
log_info "iptables 回滚脚本已创建: $ROLLBACK_FILE"
echo ""
log_success "iptables 拦截规则已部署"
echo ""
echo -e "${CYAN}当前相关 iptables 规则:${NC}"
iptables -L FORWARD -n --line-numbers | grep -E "(139|445|1900|SSDP)" || true
iptables -L OUTPUT -n --line-numbers | grep -E "(139|445|1900|router)" || true
echo ""
echo -e "${YELLOW}注意：iptables 规则重启后会丢失。如需持久化，请安装 iptables-persistent:${NC}"
echo -e "apt update && apt install -y iptables-persistent"
echo -e "netfilter-persistent save"
echo ""
read -n 1 -s -r -p "按任意键继续..."
}
#===============================================================================
# 功能 8: 撤销网络层拦截 (iptables 回滚)
#===============================================================================
rollback_iptables() {
show_info "将撤销 iptables 拦截规则，恢复部署前的规则状态。\n\n如果有备份文件，将使用 iptables-restore 恢复。\n如果没有备份，将按注释匹配删除规则。"
confirm_action "是否撤销 iptables 拦截规则？" "critical" || return 1
log_info "开始撤销 iptables 拦截规则..."
# 查找最近的备份
LATEST_BACKUP=$(ls -t "$BACKUP_DIR"/iptables_backup_*.txt 2>/dev/null | head -1)
if [ -n "$LATEST_BACKUP" ]; then
echo -e "\n${CYAN}找到备份文件: $LATEST_BACKUP${NC}"
echo -e "${CYAN}恢复中...${NC}"
iptables-restore < "$LATEST_BACKUP"
log_success "已从备份恢复 iptables 规则"
else
echo -e "\n${YELLOW}未找到备份文件，按注释删除规则...${NC}"
# 删除 FORWARD 链中的规则
while iptables -L FORWARD -n --line-numbers | grep -q "Block SMB to router\|Block UPnP\|Block SSDP"; do
LINE=$(iptables -L FORWARD -n --line-numbers | grep -E "Block SMB to router|Block UPnP|Block SSDP" | head -1 | awk '{print $1}')
[ -n "$LINE" ] && iptables -D FORWARD "$LINE"
done
# 删除 OUTPUT 链中的规则
while iptables -L OUTPUT -n --line-numbers | grep -q "Block SMB to router (local)\|Block UPnP.*\(local\)"; do
LINE=$(iptables -L OUTPUT -n --line-numbers | grep -E "Block SMB to router \(local\)|Block UPnP.*\(local\)" | head -1 | awk '{print $1}')
[ -n "$LINE" ] && iptables -D OUTPUT "$LINE"
done
log_success "已删除相关 iptables 规则"
fi
echo ""
echo -e "${CYAN}当前相关 iptables 规则:${NC}"
iptables -L FORWARD -n --line-numbers | grep -E "(139|445|1900|SSDP)" || echo "无 FORWARD 规则"
iptables -L OUTPUT -n --line-numbers | grep -E "(139|445|1900|router)" || echo "无 OUTPUT 规则"
echo ""
read -n 1 -s -r -p "按任意键继续..."
}
#===============================================================================
# 功能 9: 生成完整安全检查报告
#===============================================================================
generate_report() {
show_info "将生成完整的安全检查报告，包括:\n • 路由器端口扫描结果\n • 当前 UPnP 映射列表\n • iptables 规则状态\n • crontab 任务\n • 系统建议"
confirm_action "是否生成完整安全检查报告？" || return 1
REPORT_FILE="$BACKUP_DIR/security_report_$TIMESTAMP.txt"
{
echo "============================================================"
echo " TP-LINK TL-7DR7299 安全检查报告"
echo " 生成时间: $(date '+%Y-%m-%d %H:%M:%S')"
echo "============================================================"
echo ""
echo "【1. 路由器信息】"
echo "路由器 IP: $ROUTER_IP"
echo "WAN IP (已知): $WAN_IP"
echo ""
echo "【2. TCP 关键端口扫描】"
nmap -sV -Pn -p 80,139,445,1900 "$ROUTER_IP" 2>/dev/null || echo "扫描失败"
echo ""
echo "【3. UDP 1900 UPnP 扫描】"
nmap -sU -Pn -p 1900 --script=upnp-info "$ROUTER_IP" 2>/dev/null || echo "扫描失败"
echo ""
echo "【4. 当前 UPnP 端口映射】"
upnpc -l 2>/dev/null || echo "获取失败"
echo ""
echo "【5. SMB 匿名访问测试】"
smbclient -L "//$ROUTER_IP" -N 2>/dev/null || echo "匿名访问失败（这是好事）"
echo ""
echo "【6. 当前 iptables 相关规则】"
echo "--- FORWARD 链 ---"
iptables -L FORWARD -n --line-numbers 2>/dev/null | grep -E "(139|445|1900|SSDP)" || echo "无相关规则"
echo "--- OUTPUT 链 ---"
iptables -L OUTPUT -n --line-numbers 2>/dev/null | grep -E "(139|445|1900|router)" || echo "无相关规则"
echo ""
echo "【7. 当前 crontab 任务】"
crontab -l 2>/dev/null || echo "无 crontab 任务"
echo ""
echo "【8. 备份文件列表】"
ls -la "$BACKUP_DIR" 2>/dev/null || echo "无备份文件"
echo ""
echo "【9. 安全建议】"
echo "1. 定期检查 upnpc -l 是否有新的可疑映射"
echo "2. 禁用 Windows 迅雷服务 XLServicePlatform 和 SSDPSRV"
echo "3. 升级路由器固件"
echo "4. 关闭 TP-LINK 云管理和远程管理"
echo "5. 使用 WPA3/WPA2-AES，关闭 WPS"
echo "6. 为 IoT 设备启用访客网络隔离"
echo "7. 考虑将 TP-LINK 降级为 AP，使用 OpenWrt/pfSense 做主网关"
echo ""
} > "$REPORT_FILE"
log_success "报告已生成: $REPORT_FILE"
echo ""
echo -e "${CYAN}报告预览:${NC}"
cat "$REPORT_FILE"
echo ""
read -n 1 -s -r -p "按任意键继续..."
}
#===============================================================================
# 功能 10: 一键执行推荐加固方案
#===============================================================================
one_click_harden() {
show_info "将一键执行推荐加固方案：\n\n 1. 扫描路由器关键端口\n 2. 列出当前 UPnP 映射\n 3. 清理危险 UPnP 映射\n 4. 部署每小时自动清理脚本\n 5. 生成安全报告\n\n${RED}此操作会修改 crontab 并删除路由器上的 UPnP 映射。${NC}\n请确认已经了解影响。"
confirm_action "是否执行一键推荐加固？" "critical" || return 1
log_info "开始一键推荐加固..."
# 依次执行
scan_router_ports
list_upnp_mappings
clean_dangerous_upnp
deploy_auto_clean
generate_report
log_success "一键加固完成！"
echo ""
echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo -e "${GREEN} 推荐加固已完成！${NC}"
echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo -e "${YELLOW}后续建议：${NC}"
echo -e " 1. 在 Windows 设备上禁用 XLServicePlatform 和 SSDPSRV 服务"
echo -e " 2. 升级路由器固件"
echo -e " 3. 关闭 TP-LINK 云管理和远程管理"
echo -e " 4. 定期查看 /var/log/clear_upnp.log"
echo -e " 5. 定期执行本工具的 [9] 生成报告"
echo ""
read -n 1 -s -r -p "按任意键继续..."
}
#===============================================================================
# 功能 11: 完全回滚
#===============================================================================
full_rollback() {
show_info "将恢复所有可回滚的修改：\n\n 1. 撤销 iptables 拦截规则\n 2. 撤销 crontab 自动清理任务\n 3. 可选：删除自动清理脚本和日志\n\n${RED}警告：此操作无法恢复已经被删除的 UPnP 端口映射。${NC}\n已删除的映射需要手动重新配置（如果有合法需求）。"
confirm_action "是否执行完全回滚？" "critical" || return 1
log_info "开始完全回滚..."
# 回滚 iptables
LATEST_IPTABLES=$(ls -t "$BACKUP_DIR"/iptables_backup_*.txt 2>/dev/null | head -1)
if [ -n "$LATEST_IPTABLES" ]; then
iptables-restore < "$LATEST_IPTABLES" 2>/dev/null && log_success "iptables 已恢复"
else
log_warn "未找到 iptables 备份"
fi
# 回滚 crontab
LATEST_CRONTAB=$(ls -t "$BACKUP_DIR"/crontab_backup_*.txt 2>/dev/null | head -1)
if [ -n "$LATEST_CRONTAB" ]; then
crontab "$LATEST_CRONTAB" && log_success "crontab 已恢复"
else
log_warn "未找到 crontab 备份，将清空 clear_upnp 相关任务"
crontab -l 2>/dev/null | grep -v "clear_upnp" | crontab -
fi
# 停止运行中的脚本
for PID in $(pgrep -f "clear_upnp"); do
kill "$PID" 2>/dev/null && log_info "已停止 PID: $PID"
done
rm -f /tmp/clear_upnp*.lock
echo ""
echo -e "${YELLOW}是否删除脚本文件？${NC}"
echo -e "输入 'yes' 删除 /root/clear_upnp*.sh 和 /var/log/clear_upnp.log"
read -r DEL_ALL
if [ "$DEL_ALL" == "yes" ]; then
rm -f "$SCRIPT_DIR"/clear_upnp*.sh
rm -f /var/log/clear_upnp.log
log_info "已删除脚本和日志文件"
fi
log_success "完全回滚完成"
echo ""
echo -e "${CYAN}当前 crontab:${NC}"
crontab -l
echo ""
echo -e "${CYAN}当前 iptables 相关规则:${NC}"
iptables -L FORWARD -n --line-numbers 2>/dev/null | grep -E "(139|445|1900|SSDP)" || echo "无 FORWARD 规则"
iptables -L OUTPUT -n --line-numbers 2>/dev/null | grep -E "(139|445|1900|router)" || echo "无 OUTPUT 规则"
echo ""
read -n 1 -s -r -p "按任意键继续..."
}
#===============================================================================
# 退出前清理
#===============================================================================
cleanup_on_exit() {
log_info "工具包退出"
exit 0
}
#===============================================================================
# 主循环
#===============================================================================
trap cleanup_on_exit INT TERM
# 检查 root 权限
if [ "$EUID" -ne 0 ]; then
log_error "请以 root 权限运行本脚本: sudo $0"
exit 1
fi
# 检查依赖
MISSING_DEPS=""
for CMD in nmap upnpc curl iptables crontab; do
if ! command -v "$CMD" &> /dev/null; then
MISSING_DEPS="$MISSING_DEPS $CMD"
fi
done
if [ -n "$MISSING_DEPS" ]; then
log_warn "缺少以下依赖工具:$MISSING_DEPS"
echo -e "${YELLOW}是否尝试安装？ (yes/no)${NC}"
read -r INSTALL_DEPS
if [ "$INSTALL_DEPS" == "yes" ]; then
apt update && apt install -y nmap miniupnpc curl iptables cron
fi
fi
while true; do
show_menu
read -r CHOICE
case "$CHOICE" in
1) scan_router_ports ;;
2) scan_all_ports ;;
3) list_upnp_mappings ;;
4) clean_dangerous_upnp ;;
5) deploy_auto_clean ;;
6) rollback_auto_clean ;;
7) deploy_iptables_block ;;
8) rollback_iptables ;;
9) generate_report ;;
10) one_click_harden ;;
11) full_rollback ;;
0)
cleanup_on_exit
;;
*)
echo -e "${RED}无效选择，请重新输入 [0-11]${NC}"
sleep 1
;;
esac
done使用方法：
将上述内容保存为router_security_toolkit.sh放入root下。
设置权限：
bash
chmod +x /root/router_security_toolkit.sh运行方法：
/root/router_security_toolkit.sh
3.手机：
注意事项：
- 这是你自己的设备和网络
- 已安装
nmap和adb - 手机已开启 USB 调试并连接
- 已备份重要数据
kali代码，网关是192.168.1.1，ip地址是192.168.1.103，按需修改：
bash
#!/bin/bash
# =============================================================================
# 文件名: harmonyos_security_hardening.sh
# 功能: 华为/HarmonyOS 手机局域网开放端口检测与加固脚本
# 适用: Kali Linux + ADB
# 警告: 仅用于你自己拥有或授权管理的设备和网络！
# =============================================================================
set -o pipefail
# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color
# 全局变量
TARGET_IP=""
TARGET_MAC=""
BACKUP_DIR="$HOME/harmonyos_hardening_backup"
LOG_FILE="$BACKUP_DIR/operation.log"
DISABLED_PACKAGES_FILE="$BACKUP_DIR/disabled_packages.txt"
ORIGINAL_TCP_FILE="$BACKUP_DIR/original_tcp.txt"
ROLLBACK_SCRIPT="$BACKUP_DIR/rollback.sh"
UID_MAP_FILE="$BACKUP_DIR/uid_process_map.txt"
# 需要处理的可疑华为包列表
HUAWEI_PACKAGES=(
"com.huawei.nearby"
"com.huawei.android.instantshare"
"com.huawei.android.instantonline"
"com.huawei.pcassistant"
)
# =============================================================================
# 工具函数
# =============================================================================
log() {
local msg="[$(date '+%Y-%m-%d %H:%M:%S')] $1"
echo -e "$msg" | tee -a "$LOG_FILE"
}
info() {
echo -e "${BLUE}[*] $1${NC}"
log "[INFO] $1"
}
success() {
echo -e "${GREEN}[+] $1${NC}"
log "[SUCCESS] $1"
}
warn() {
echo -e "${YELLOW}[!] $1${NC}"
log "[WARN] $1"
}
error() {
echo -e "${RED}[-] $1${NC}"
log "[ERROR] $1"
}
pause() {
echo ""
read -p "按 Enter 键继续..."
}
confirm() {
local prompt="$1"
while true; do
read -p "$(echo -e "${YELLOW}[?] $prompt [y/N]: ${NC}")" yn
case $yn in
[Yy]* ) return 0;;
[Nn]* | "" ) return 1;;
* ) echo "请输入 y 或 n";;
esac
done
}
check_root() {
if [[ $EUID -ne 0 ]]; then
error "本脚本需要 root 权限运行，请使用 sudo。"
exit 1
fi
}
check_dependencies() {
info "检查依赖工具..."
local missing=()
if ! command -v nmap &> /dev/null; then
missing+=("nmap")
fi
if ! command -v adb &> /dev/null; then
missing+=("adb")
fi
if [[ ${#missing[@]} -gt 0 ]]; then
warn "缺少工具: ${missing[*]}"
if confirm "是否自动安装缺少的工具？"; then
apt update
apt install -y "${missing[@]}"
else
error "缺少必要工具，退出。"
exit 1
fi
else
success "依赖检查通过"
fi
}
init_backup_dir() {
mkdir -p "$BACKUP_DIR"
touch "$LOG_FILE"
log "============================================"
log "脚本启动，备份目录: $BACKUP_DIR"
}
# =============================================================================
# 功能1: 发现局域网设备
# =============================================================================
discover_devices() {
clear
info "功能1: 发现局域网存活设备"
echo "----------------------------------------"
# 获取本机网络信息
local iface=$(ip route | grep default | awk '{print $5}' | head -n1)
if [[ -z "$iface" ]]; then
error "无法获取默认网关网卡"
pause
return
fi
local local_ip=$(ip addr show "$iface" | grep "inet " | awk '{print $2}' | head -n1)
if [[ -z "$local_ip" ]]; then
error "无法获取本机 IP"
pause
return
fi
local network="${local_ip%.*}.0/24"
info "检测到网卡: $iface"
info "本机 IP: $local_ip"
info "扫描网段: $network"
if ! confirm "是否开始扫描网段 $network？"; then
warn "跳过设备发现"
return
fi
info "正在扫描，请稍候..."
nmap -sn "$network" -oN "$BACKUP_DIR/devices_scan.txt"
success "扫描完成，结果保存到: $BACKUP_DIR/devices_scan.txt"
echo ""
cat "$BACKUP_DIR/devices_scan.txt"
pause
}
# =============================================================================
# 功能2: 选择目标设备
# =============================================================================
select_target() {
clear
info "功能2: 选择目标手机设备"
echo "----------------------------------------"
if [[ ! -f "$BACKUP_DIR/devices_scan.txt" ]]; then
warn "尚未扫描设备，请先执行功能1"
pause
return
fi
echo "已发现的设备:"
grep -E "Nmap scan report|MAC Address" "$BACKUP_DIR/devices_scan.txt" | paste - - | nl
echo ""
read -p "请输入目标设备编号（或直接输入IP）: " choice
if [[ "$choice" =~ ^[0-9]+$ ]]; then
TARGET_IP=$(grep -E "Nmap scan report" "$BACKUP_DIR/devices_scan.txt" | sed -n "${choice}p" | grep -oE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+")
else
TARGET_IP="$choice"
fi
if [[ -z "$TARGET_IP" ]]; then
error "无效选择"
pause
return
fi
info "目标设备 IP: $TARGET_IP"
if ! confirm "是否确认选择 $TARGET_IP 作为目标？"; then
TARGET_IP=""
warn "已取消选择"
pause
return
fi
# 获取 MAC 地址
TARGET_MAC=$(grep -A1 "Nmap scan report for $TARGET_IP" "$BACKUP_DIR/devices_scan.txt" | grep "MAC Address" | awk '{print $3}')
success "已选择目标: $TARGET_IP ($TARGET_MAC)"
pause
}
# =============================================================================
# 功能3: 端口扫描
# =============================================================================
scan_ports() {
clear
info "功能3: 全端口扫描"
echo "----------------------------------------"
if [[ -z "$TARGET_IP" ]]; then
warn "尚未选择目标设备，请先执行功能2"
pause
return
fi
info "目标: $TARGET_IP"
warn "此操作会扫描目标设备全部 65535 个端口，可能需要 10-30 秒"
if ! confirm "是否开始扫描 $TARGET_IP 的全部端口？"; then
warn "跳过端口扫描"
return
fi
local output="$BACKUP_DIR/portscan_$(date +%Y%m%d_%H%M%S).txt"
info "正在扫描，请稍候..."
nmap -Pn -sS -p- "$TARGET_IP" -oN "$output"
success "扫描完成，结果保存到: $output"
echo ""
grep -E "^[0-9]+/tcp" "$output" || info "未发现开放端口"
pause
}
# =============================================================================
# 功能4: 检查 ADB 连接
# =============================================================================
check_adb() {
clear
info "功能4: 检查 ADB 连接"
echo "----------------------------------------"
info "请确保手机已通过 USB 连接，并开启 USB 调试"
if ! confirm "是否开始检查 ADB 连接？"; then
warn "跳过 ADB 检查"
return
fi
# 重启 ADB 服务
adb kill-server &>/dev/null
adb start-server &>/dev/null
sleep 2
local devices=$(adb devices | grep -v "List of devices" | grep "device$")
if [[ -z "$devices" ]]; then
error "未检测到 ADB 设备，请检查："
echo " 1. USB 线是否支持数据传输"
echo " 2. 手机是否开启 USB 调试"
echo " 3. 是否允许此计算机调试"
pause
return 1
fi
success "ADB 设备已连接:"
echo "$devices"
pause
return 0
}
# =============================================================================
# 功能5: 分析 /proc/net/tcp
# =============================================================================
analyze_tcp() {
clear
info "功能5: 分析手机监听端口"
echo "----------------------------------------"
if ! check_adb_silent; then
warn "ADB 未连接，请先执行功能4"
pause
return
fi
if ! confirm "是否开始分析目标手机的 /proc/net/tcp？"; then
warn "跳过分析"
return
fi
# 备份原始状态
if ! adb shell cat /proc/net/tcp > "$ORIGINAL_TCP_FILE" 2>/dev/null; then
error "无法读取 /proc/net/tcp，请检查 ADB 连接"
pause
return
fi
success "已备份原始 /proc/net/tcp 到: $ORIGINAL_TCP_FILE"
info "当前 LISTEN 状态的端口:"
echo "----------------------------------------"
echo -e "${YELLOW}端口\t\tUID\t\tinode\t\t监听地址${NC}"
awk '
/^[[:space:]]*[0-9]+:/ {
local_addr = $2
state = $4
uid = $8
inode = $11
# 只显示 LISTEN 状态 (0A)
if (state == "0A") {
split(local_addr, arr, ":")
hex_port = arr[2]
ip_hex = arr[1]
dec_port = strtonum("0x" hex_port)
if (ip_hex == "00000000") {
ip = "0.0.0.0"
} else {
ip = sprintf("%d.%d.%d.%d",
strtonum("0x" substr(ip_hex, 7, 2)),
strtonum("0x" substr(ip_hex, 5, 2)),
strtonum("0x" substr(ip_hex, 3, 2)),
strtonum("0x" substr(ip_hex, 1, 2)))
}
printf "%-8s\t%-8s\t%-12s\t%s\n", dec_port, uid, inode, ip
}
}
' "$ORIGINAL_TCP_FILE"
success "分析完成"
pause
}
# =============================================================================
# 功能6: 端口归属定位
# =============================================================================
locate_ports() {
clear
info "功能6: 定位监听端口对应的应用"
echo "----------------------------------------"
if ! check_adb_silent; then
warn "ADB 未连接"
pause
return
fi
if ! confirm "是否开始定位端口对应的应用？此操作需要读取手机进程信息"; then
warn "跳过定位"
return
fi
# 如果没有原始 TCP 文件，自动获取
if [[ ! -f "$ORIGINAL_TCP_FILE" ]]; then
warn "未找到之前的 /proc/net/tcp 备份，自动从手机获取..."
if ! adb shell cat /proc/net/tcp > "$ORIGINAL_TCP_FILE" 2>/dev/null; then
error "无法读取 /proc/net/tcp，请检查 ADB 连接"
pause
return
fi
success "已获取并保存到: $ORIGINAL_TCP_FILE"
fi
info "正在根据 uid 定位应用..."
echo "----------------------------------------"
echo -e "${YELLOW}UID\t\t应用包名/进程名${NC}"
# 获取所有正在运行的进程及其 uid
if ! adb shell 'for pid in $(ls /proc | grep -E "^[0-9]+$"); do
uid=$(grep "^Uid:" /proc/$pid/status 2>/dev/null | awk "{print \$2}");
cmd=$(tr -d "\0" < /proc/$pid/cmdline 2>/dev/null);
if [[ -n "$cmd" && -n "$uid" ]]; then
echo "$uid|$cmd";
fi;
done' 2>/dev/null | sort -u -t'|' -k1,1 > "$UID_MAP_FILE"; then
error "无法获取进程信息"
pause
return
fi
cat "$UID_MAP_FILE"
# 与开放端口关联
echo ""
info "端口与应用关联:"
echo "----------------------------------------"
echo -e "${YELLOW}端口\t\tUID\t\t应用${NC}"
awk -v mapfile="$UID_MAP_FILE" '
/^[[:space:]]*[0-9]+:/ {
state = $4
if (state == "0A") {
local_addr = $2
uid = $8
split(local_addr, arr, ":")
hex_port = arr[2]
dec_port = strtonum("0x" hex_port)
# 从 uid 映射文件中查找应用
app = "[系统服务/未识别]"
cmd = "grep \"^" uid \"|\" \" mapfile \" | head -n1 | cut -d\\\"|\\\" -f2"
cmd | getline result
close(cmd)
if (result != "") {
app = result
}
printf "%-8s\t%-8s\t%s\n", dec_port, uid, app
}
}
' "$ORIGINAL_TCP_FILE"
success "定位完成"
pause
}
# =============================================================================
# 功能7: 禁用华为分享/附近服务（含回滚准备）
# =============================================================================
disable_huawei_services() {
clear
info "功能7: 禁用华为分享/附近/多屏协同服务"
echo "----------------------------------------"
if ! check_adb_silent; then
warn "ADB 未连接"
pause
return
fi
warn "⚠️ 警告：以下操作将禁用华为生态功能："
echo " - 华为分享（文件快传）"
echo " - 华为附近服务"
echo " - 超级终端/多屏协同"
echo " - 多屏协同连接电脑"
echo ""
warn "禁用后可以通过本脚本的回滚功能恢复。"
if ! confirm "是否继续禁用这些服务？"; then
warn "已取消禁用操作"
pause
return
fi
# 记录当前包状态
> "$DISABLED_PACKAGES_FILE"
> "$ROLLBACK_SCRIPT"
echo "#!/bin/bash" > "$ROLLBACK_SCRIPT"
echo "# 自动生成的回滚脚本" >> "$ROLLBACK_SCRIPT"
echo "# 生成时间: $(date)" >> "$ROLLBACK_SCRIPT"
echo "" >> "$ROLLBACK_SCRIPT"
for pkg in "${HUAWEI_PACKAGES[@]}"; do
echo ""
info "处理包: $pkg"
# 检查包是否存在
if ! adb shell pm list packages | grep -q "^package:$pkg$"; then
warn "包 $pkg 不存在，跳过"
continue
fi
# 检查当前状态
local current_state=$(adb shell pm dump "$pkg" 2>/dev/null | grep -i "disabled=" | head -n1 || echo "unknown")
info "当前状态: $current_state"
if confirm "是否禁用 $pkg？"; then
# 先尝试 disable-user
local result=$(adb shell pm disable-user --user 0 "$pkg" 2>&1)
if echo "$result" | grep -q "new state: disabled-user"; then
success "$pkg 已禁用 (disable-user)"
echo "$pkg|disabled-user" >> "$DISABLED_PACKAGES_FILE"
echo "adb shell pm enable $pkg # 恢复 $pkg" >> "$ROLLBACK_SCRIPT"
else
warn "disable-user 可能未生效，尝试 uninstall --user 0"
result=$(adb shell pm uninstall --user 0 "$pkg" 2>&1)
if echo "$result" | grep -q "Success"; then
success "$pkg 已卸载当前用户更新"
echo "$pkg|uninstalled" >> "$DISABLED_PACKAGES_FILE"
echo "adb shell cmd package install-existing $pkg # 恢复 $pkg" >> "$ROLLBACK_SCRIPT"
else
error "$pkg 禁用失败: $result"
echo "$pkg|failed" >> "$DISABLED_PACKAGES_FILE"
fi
fi
else
info "跳过 $pkg"
fi
done
chmod +x "$ROLLBACK_SCRIPT"
echo "" >> "$ROLLBACK_SCRIPT"
echo "echo '回滚完成，建议重新扫描验证端口状态'" >> "$ROLLBACK_SCRIPT"
success "禁用操作完成"
info "回滚脚本已生成: $ROLLBACK_SCRIPT"
pause
}
# =============================================================================
# 功能8: 验证加固效果
# =============================================================================
verify_hardening() {
clear
info "功能8: 验证加固效果"
echo "----------------------------------------"
if [[ -z "$TARGET_IP" ]]; then
warn "未选择目标 IP"
pause
return
fi
if ! confirm "是否重新扫描 $TARGET_IP 验证端口是否已关闭？"; then
warn "跳过验证"
return
fi
local output="$BACKUP_DIR/verification_$(date +%Y%m%d_%H%M%S).txt"
info "正在扫描..."
nmap -Pn -sS -p- "$TARGET_IP" -oN "$output"
success "验证完成"
echo ""
local open_ports=$(grep -E "^[0-9]+/tcp" "$output" | wc -l)
if [[ "$open_ports" -eq 0 ]]; then
success "🎉 未发现开放端口，加固成功！"
else
warn "仍存在 $open_ports 个开放端口:"
grep -E "^[0-9]+/tcp" "$output"
warn "这些可能是系统级服务端口，无法通过禁用应用关闭"
fi
pause
}
# =============================================================================
# 功能9: 生成报告
# =============================================================================
generate_report() {
clear
info "功能9: 生成操作报告"
echo "----------------------------------------"
local report="$BACKUP_DIR/FINAL_REPORT_$(date +%Y%m%d_%H%M%S).txt"
{
echo "============================================"
echo " HarmonyOS 安全加固报告"
echo " 生成时间: $(date)"
echo "============================================"
echo ""
echo "目标设备: $TARGET_IP"
echo "MAC 地址: $TARGET_MAC"
echo ""
echo "--- 备份文件列表 ---"
ls -la "$BACKUP_DIR"
echo ""
echo "--- 已禁用/卸载的包 ---"
if [[ -f "$DISABLED_PACKAGES_FILE" ]]; then
cat "$DISABLED_PACKAGES_FILE"
else
echo "无"
fi
echo ""
echo "--- 回滚脚本位置 ---"
echo "$ROLLBACK_SCRIPT"
echo ""
echo "--- 操作日志摘要 ---"
if [[ -f "$LOG_FILE" ]]; then
tail -n 50 "$LOG_FILE"
else
echo "无日志"
fi
} > "$report"
success "报告已生成: $report"
pause
}
# =============================================================================
# 功能10: 回滚操作
# =============================================================================
rollback() {
clear
info "功能10: 回滚/恢复禁用/卸载的服务"
echo "----------------------------------------"
if [[ ! -f "$DISABLED_PACKAGES_FILE" ]]; then
warn "未找到禁用记录，无法回滚"
pause
return
fi
if ! check_adb_silent; then
warn "ADB 未连接，无法回滚"
pause
return
fi
warn "⚠️ 此操作将恢复之前禁用的华为服务，开放端口可能重新出现。"
if ! confirm "是否继续回滚？"; then
warn "已取消回滚"
pause
return
fi
info "开始回滚..."
while IFS='|' read -r pkg state; do
case "$state" in
"disabled-user")
info "启用 $pkg"
adb shell pm enable "$pkg"
;;
"uninstalled")
info "恢复安装 $pkg"
adb shell cmd package install-existing "$pkg"
;;
"failed")
warn "$pkg 之前禁用失败，跳过"
;;
*)
warn "未知状态: $pkg = $state"
;;
esac
done < "$DISABLED_PACKAGES_FILE"
success "回滚完成"
info "建议重新执行功能8验证端口状态"
pause
}
# =============================================================================
# 辅助函数
# =============================================================================
check_adb_silent() {
adb devices | grep -v "List of devices" | grep "device$" &>/dev/null
return $?
}
show_menu() {
clear
echo "============================================"
echo " HarmonyOS 手机安全检测与加固脚本"
echo " 修复版 v1.1"
echo "============================================"
echo ""
echo " 当前目标: ${TARGET_IP:-未选择}"
echo " MAC 地址: ${TARGET_MAC:-未知}"
echo ""
echo " 1. 发现局域网设备"
echo " 2. 选择目标设备"
echo " 3. 扫描目标全部端口"
echo " 4. 检查 ADB 连接"
echo " 5. 分析 /proc/net/tcp"
echo " 6. 定位端口对应应用"
echo " 7. 禁用华为分享/附近/多屏协同服务"
echo " 8. 验证加固效果"
echo " 9. 生成操作报告"
echo " 10. 回滚/恢复服务"
echo " 0. 退出"
echo ""
}
# =============================================================================
# 主程序
# =============================================================================
main() {
check_root
check_dependencies
init_backup_dir
while true; do
show_menu
read -p "请选择功能 [0-10]: " choice
case $choice in
1) discover_devices ;;
2) select_target ;;
3) scan_ports ;;
4) check_adb ;;
5) analyze_tcp ;;
6) locate_ports ;;
7) disable_huawei_services ;;
8) verify_hardening ;;
9) generate_report ;;
10) rollback ;;
0)
info "退出脚本"
info "所有备份和报告保存在: $BACKUP_DIR"
exit 0
;;
*)
warn "无效选择，请重新输入"
pause
;;
esac
done
}
main使用方法：
将上述内容保存为harmonyos_security_hardening.sh放入root下。
设置权限：
bash
chmod +x /root/harmonyos_security_hardening.sh运行方法：
/root/harmonyos_security_hardening.sh