前置说明
零日漏洞是指未被厂商公开修复、攻击者已知晓的漏洞，防护核心是缩小攻击面、强化动态监控、快速阻断常见入口，接下来是0基础可直接操作的4项内容。
实操一：搭建免费本地自动更新强制管控（覆盖99%已知+90%潜在可被修复的入口型零日
入口型零日占9成以上，比如浏览器、PDF阅读器、办公套件，先用Windows Server Update Services（WSUS，针对Windows）、Ubuntu Advantage Free（针对Ubuntu Server）强制静默更新，macOS用JAMF Now Free（50台设备内）。
WSUS Windows家庭/中小团队本地部署
- 硬件要求：2核4G云服务器/物理机，500G+存储（缓存更新包），固定内网IP
- 系统要求：Windows Server 2019/2022 Datacenter/Standard（Evaluation激活后可转永久）
- 下载地址：微软官网Windows Server评估版→https://www.microsoft.com/zh-cn/evalcenter/evaluate-windows-server-2022
操作步骤：
- 打开Windows Server“服务器管理器”→点击“添加角色和功能”→下一步到“服务器角色”→勾选“Windows Server Update Services”→弹出“添加功能”→下一步直到“内容位置”→修改为“D:\WSUSContent”（非系统盘，防止满盘）→下一步勾选“WID数据库”→下一步直到“完成安装”。
- 安装后点击“服务器管理器”顶部的“WSUS”→点击“完成WSUS配置向导”→下一步取消勾选“使用Microsoft Update检查更新”→下一步选择“从Microsoft Update同步”→下一步下一步直到“开始同步”→同步完成后点击左侧“更新”→“产品与分类”→勾选“Windows 10/11”“Windows Server 2019/2022”“Microsoft Office 2016/2019/365”“Adobe Acrobat Reader DC”“Google Chrome”（WSUS默认支持Chrome需手动添加：在“产品与分类”→“分类”勾选“更新”“安全更新”→点击左侧“选项”→“更新源和代理服务器”→“高级同步选项”→添加Chrome WSUS源→https://dl.google.com/dl/edgedl/chrome/release/updates/win/GoogleUpdate.wsus.xml）→点击左侧“计算机”→“组”→新建“办公组”→把所有内网Windows设备拖拽进去→点击左侧“更新”→“自动审批”→对所有安全更新右键“审批安装”→选择“办公组”→设置“截止时间24小时内自动安装”。
Ubuntu Server自动强制静默更新
操作步骤：
- 登录Ubuntu Server终端执行UA Free激活：首先注册Ubuntu账号→https://ubuntu.com/pro/dashboard/→创建免费订阅（免费版激活密钥→复制密钥→终端执行sudo pro attach [密钥]。
- 配置静默自动更新所有安全包，执行以下完整可复制命令：
```bash
sudo apt update
sudo apt install -y unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades
这里选择“是”
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades
```
打开50unattended-upgrades，把以下内容全部替换原有Unattended-Upgrade::Allowed-Origins块：
```
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}";
"${distro_id}:${distro_codename}-security;
"${distro_id}ESMApps:${distro_codename}-apps-security;
"${distro_id}ESM:${distro_codename}-infra-security;
};
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::MinimalSteps "true";
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";
```
Ctrl+O保存→Ctrl+X退出→sudo systemctl restart unattended-upgrades.service→sudo systemctl enable unattended-upgrades.service
实操二：部署开源EDR替代方案（拦截95%以上零日利用）
用开源EDR（端点检测与响应）免费方案选Wazuh Agent+Server（免费全功能，支持Windows/macOS/Linux）。
Wazuh Server一键Docker部署（3分钟搞定）
- 硬件要求：2核8G云服务器/物理机，100G+存储（日志留存30天），固定公网IP+内网穿透（外网设备需）
- 系统要求：Ubuntu 22.04 LTS（Docker运行环境）
操作步骤：
- 安装Docker和Docker Compose：
```bash
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
sudo usermod -aG docker $USER
newgrp docker
sudo curl -L "https://github.com/docker/compose/releases/download/v2.24.6/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
```
- 部署Wazuh：
```bash
git clone https://github.com/wazuh/wazuh-docker.git -b v4.7.3
cd wazuh-docker/single-node
sudo docker-compose up -d
等待5分钟初始化
```
- 访问Web控制台：浏览器打开https://[Wazuh公网IP:443→默认账号admin→默认密码SecretPassword（首次登录强制修改→修改Wazuh Agent默认密码后记得复制控制台密码管理处）。
设备批量部署Wazuh Agent
Windows设备（单台/批量PowerShell脚本）：
单台：Web控制台→点击右上角“添加代理”→选择Windows→复制完整安装命令（修改MANAGER_IP为Wazuh公网IP）→管理员运行PowerShell粘贴执行→粘贴后重启设备即自动上线。
批量AD域Windows：保存以下完整可复制脚本→AD域控制器管理员运行PowerShell→替换MANAGER_IP为Wazuh公网IP→替换GROUP为之前创建的Windows分组→执行：
```powershell
$computers = Get-ADComputer -Filter -SearchBase "OU=办公设备,DC=yourdomain,DC=com" | Select-Object -ExpandProperty Name
$credential = Get-Credential
foreach ($computer in $computers) {
Invoke-Command -ComputerName $computer -Credential $credential -ScriptBlock {
$MANAGER_IP = "替换为你的Wazuh公网IP"
$GROUP = "办公设备"
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.7.3-1.msi -OutFile C:\wazuh-agent.msi
msiexec.exe /i C:\wazuh-agent.msi /q WAZUH_MANAGER="$MANAGER_IP" WAZUH_AGENT_GROUP="$GROUP"
Start-Service -Name WazuhSvc
}
}
```
Linux/macOS设备：Web控制台→选择对应系统→复制完整安装命令→管理员/root执行。
实操三：强化Web应用防火墙（拦截90%以上Web零日利用）
用开源ModSecurity+Core Rule Set（CRS）部署在Nginx/Apache前，免费覆盖OWASP Top10+常见Web零日利用指纹。
Nginx+ModSecurity+CRS一键安装（Ubuntu 22.04 LTS）
操作步骤：
- 一键安装：
```bash
sudo apt update
sudo apt install -y nginx libnginx-mod-http-modsecurity modsecurity-crs
```
- 启用ModSecurity：
```bash
sudo nano /etc/nginx/mods-available/modsecurity.conf
把SecRuleEngine DetectionOnly改为SecRuleEngine On
把SecRequestBodyAccess On取消注释
```
- 启用CRS规则：
```bash
sudo ln -s /etc/modsecurity/crs/crs-setup.conf /etc/nginx/modsecurity.d/
sudo ln -s /usr/share/modsecurity-crs/rules/ /etc/nginx/modsecurity.d/
sudo nano /etc/nginx/sites-available/default
在server块的listen 80;或listen 443 ssl;后添加：
modsecurity on;
modsecurity_rules_file /etc/nginx/modsecurity.d/crs-setup.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-901-INITIALIZATION.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-903.9002-DOS-CONFIDENCE-EXCLUSIONS.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-905-COMMON-EXCEPTIONS.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-910-IP-REPUTATION.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-911-METHOD-ENFORCEMENT.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-912-DOS-PROTECTION.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-913-SCANNER-DETECTION.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-921-PROTOCOL-ATTACK.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/REQUEST-949-BLOCKING-EVALUATION.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/RESPONSE-950-DATA-LEAKAGES.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/RESPONSE-959-BLOCKING-EVALUATION.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/RESPONSE-980-CORRELATION.conf;
modsecurity_rules_file /etc/nginx/modsecurity.d/rules/RESPONSE-990-EXCLUSION-RULES-AFTER-CRS.conf;
```
- 检查配置并重启：
```bash
sudo nginx -t
sudo systemctl restart nginx
```
实操四：搭建开源蜜罐（提前捕获0day攻击尝试
用Cowrie SSH蜜罐（捕获SSH爆破、上传木马）、Dionaea全端口蜜罐（捕获各种端口扫描、漏洞利用），免费开源，一键Docker部署。
Cowrie+Dionaea Docker Compose部署
操作步骤：
- 新建docker-compose.yml文件：
```bash
mkdir honeypot && cd honeypot
nano docker-compose.yml
```
完整可复制docker-compose.yml内容：
```yaml
version: '3'
services:
cowrie:
image: cowrie/cowrie:latest
ports:
- "2222:2222"
volumes:
- ./cowrie/etc:/cowrie/cowrie-git/etc
- ./cowrie/var:/cowrie/cowrie-git/var
dionaea:
image: dinotools/dionaea:latest
ports:
- "21:21"
- "23:23"
- "80:80"
- "443:443"
- "3306:3306"
- "1433:1433"
- "445:445"
- "135:135"
- "139:139"
- "5900:5900"
volumes:
- ./dionaea/log:/var/dionaea/log
- ./dionaea/binaries:/var/dionaea/binaries
```
- 启动蜜罐：
```bash
sudo docker-compose up -d
```
- 查看Cowrie日志：sudo cat ./cowrie/var/log/cowrie/cowrie.json
- 查看Dionaea攻击样本：sudo ls ./dionaea/binaries
