ARL资产侦察系统使用

官方DOC

https://tophanttechnology.github.io/ARL-doc/

安装

参考官网docker compose的安装方式

1
2
3
4
5
6
7
8
cd /opt/
mkdir docker_arl
wget -O docker_arl/docker.zip https://github.com/TophantTechnology/ARL/releases/download/v2.6.1/docker.zip
cd docker_arl
unzip -o docker.zip
docker volume create arl_db
docker-compose pull
docker-compose up -d

ARL功能增强配置

GOV EDU ORG解除限制

config-docker.yaml

修改前：

image-20240117104351368

修改后：

image-20240117104649977

添加CMS指纹

找到Ehole项目最新的finger.json

https://github.com/EdgeSecurityTeam/EHole/blob/main/finger.json

用大佬写好的脚本

https://github.com/loecho-sec/ARL-Finger-ADD/blob/main/ARL-Finger-ADD.py

1
python3 ARL-Finger-ADD.py http://192.168.31.98:5003/ admin pwd

成功添加

image-20240117112501888

image-20240117112618871

BUG解决

在kali安装出现timeout of 12000ms exceeded报错

需要把443端口改为80

image-20240117102342865

在config-docker.yaml文件中新增

image-20240117103311679

ARL新版本安装

安装docker

1
2
3
4
5
6
7
8
9
10
11
安装一些依赖
sudo yum install -y yum-utils device-mapper-persistent-data lvm2 wget
下载repo文件
wget -O /etc/yum.repos.d/docker-ce.repo
https://download.docker.com/linux/centos/docker-ce.repo
把软件仓库地址替换为 TUNA:
sudo sed -i 's+download.docker.com+mirrors.tuna.tsinghua.edu.cn/docker-ce+'
/etc/yum.repos.d/docker-ce.repo
安装
sudo yum makecache fast
sudo yum install docker-ce

安装docker compose

1
2
3
4
5
先安装pip,python3进行安装
curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
#先升级python3
python3 get-pip.py 
pip3 install docker-compose
1
2
https://github.com/ki9mu/ARL-plus-docker/archive/refs/tags/v2.7.1.zip
unzip ARL-plus-docker-2.7.1.zip
1
2
3
4
service docker start
docker volume create arl_db
docker compose up -d
docker ps

登录

1
2
http://110.41.185.80:5003
登录凭证：admin/arlpass

取消域名限制

https://blog.csdn.net/m0_64910183/article/details/128235841

1
config-docker.yaml

进入docker修改config.py

image-20240818022838271

1
docker compose restart

添加指纹

1
python3 ARL-Finger-ADD.py http://110.41.185.80:5003/ admin Wbzabcd114

多用户登录

1
# 可以使用下面的命令添加多个平行用户, 使用 admin1/admin123 可登录docker exec -ti arl_mongodb mongo -u admin -p adminuse arldb.user.insert({ username: 'admin1', password: hex_md5('arlsalt!@#'+'admin123')})

oneforall设置全部改true

image-20240818025111816

1
2
docker volume rm arl_db
docker volume create arl_db

image-20240818122535438

docker pull太慢换镜像源

1
2
3
4
5
6
7
8
9
10
11
12
13
14
sudo mkdir -p /etc/docker

sudo tee /etc/docker/daemon.json <<-'EOF'
{
    "registry-mirrors": [
        "https://docker.1panel.live",
        "https://hub.rat.dev"
    ]
}
EOF

sudo systemctl daemon-reload
sudo systemctl restart docker

centos python升级

1
2
3
4
5
yum update -y
 
yum -y groupinstall "Development tools"
 
yum install openssl-devel bzip2-devel expat-devel gdbm-devel readline-devel sqlite-devel psmisc libffi-devel
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
https://www.python.org/ftp/python/3.9.1/Python-3.9.1.tgz

tar -xzf Python-3.9.1.tgz

mkdir  /usr/local/python3/


#  Python-3.9.1目录下
./configure --prefix=/usr/local/python3

make && make install

mv /usr/bin/python /usr/bin/python_old
mv /usr/bin/python_old /usr/bin/python
mv /usr/bin/pip /usr/bin/pip_old

unlink /usr/bin/python3
ln -s /usr/local/python3/bin/python3.9 /usr/bin/python3

ln -s /usr/local/python3/bin/pip3.9 /usr/bin/pip

bug

WARNING: pip is configured with locations that require TLS/SSL, however the ssl module in Python is not available.

image-20240818004358059

1
pip config --global set global.index-url http://mirrors.aliyun.com/pypi/simple/

记事本打开pip.ini文件，在末行添加

1
2
[install]
trusted-host = mirrors.aliyun.com

__END__