[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法一 (失敗)

[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法一 (失敗)

2026-09-02

https://github.com/Velocidex/velociraptor/releases

2026-08-10釋出0.77.2版，目前最新版

https://github.com/Velocidex/velociraptor/releases/tag/v0.77.2

velociraptor-v0.77.2-windows-amd64.exe

Client

https://docs.velociraptor.app/docs/deployment/clients/

檢視版本

C:\velociraptor>velociraptor.exe version name: velociraptor version: 0.77.2 commit: c0c9dd609 build_time: "2026-08-10T01:03:30Z" compiler: go1.25.3 system: windows architecture: amd64 C:\velociraptor>

檢視說明

C:\velociraptor>velociraptor.exe --help usage: velociraptor [<flags>] <command> [<args> ...] An advanced incident response and monitoring agent. Flags: -h, --[no-]help Show context-sensitive help (also try --help-long and --help-man). --remap=REMAP A remapping configuration file for dead disk analysis. --[no-]nobanner Suppress the Velociraptor banner --org=ORG Org ID to show --[no-]debug Enables debug and profile server. --debug_port=6060 Port for the debug server. -c, --config=CONFIG The configuration file. --embedded_config=EMBEDDED_CONFIG Extract the embedded configuration from this file. -a, --api_config=API_CONFIG The API configuration file. --runas=RUNAS Run as this username's ACLs -D, --definitions=DEFINITIONS A directory containing artifact definitions --[no-]nocolor Disable color output -v, --[no-]verbose Enabled verbose logging. --profile=PROFILE Write profiling information to this file. --profile_duration=PROFILE_DURATION Generate a profile file for each period in seconds. --trace=TRACE Write trace information to this file. --[no-]trace_vql Enable VQL tracing. --logfile=LOGFILE Write to this file as well --tempdir=TEMPDIR Write all temp files to this directory --mutant=MUTANT When specified we use this mutant to ensure only one copy of the client is allowed to run. --[no-]prompt Present a prompt before exit --max_wait=10 Maximum time to queue results. --timezone=TIMEZONE Default encoding timezone (e.g. Australia/Brisbane). If not set we use UTC -r, --run=RUN Run an artifact as a CLI tool. Commands: help [<command>...] artifacts list [<flags>] [<regex>] show <name> collect [<flags>] <artifact_name>... fetch --flow_id=FLOW_ID --output=OUTPUT [<flags>] reformat [<flags>] <paths>... verify [<flags>] <paths>... client [<flags>] config show [<flags>] client api_client --name=NAME [<flags>] <output> generate [<flags>] rotate_keys [<flags>] reissue_certs [<flags>] frontend repack [<flags>] <config_file> <output> csv [<flags>] <files>... deaddisk [<flags>] <output> debian [<flags>] server [<flags>] client [<flags>] frontend [<flags>] fs [<flags>] ls [<path>] cp <path> <dumpdir> cat <path> zcat <chunk_path> <file_path> rm <path> golden [<flags>] <directory> acl show [<flags>] <principal> grant [<flags>] <principal> [<policy>] gui [<flags>] hunts reconstruct service [<flags>] install remove start stop pause continue collector [<flags>] [<spec_file>] decrypt [<flags>] <collection> [<output>] pool_client [<flags>] query [<flags>] <queries>... rpm [<flags>] client [<flags>] server [<flags>] server_service install remove start stop pause continue tools show [<file>] rm <name> upload --name=NAME [<flags>] [<path>] unzip [<flags>] <file> [<members>] user add --role=ROLE <username> [<password>] show [<flags>] <username> version vql list export [<old_file>] C:\velociraptor>

產生設定檔 (Enter 表示選擇)

cd C:\Velociraptor velociraptor.exe config generate -i

下圖，設定帳號、密碼　

下圖，沒有其他帳號、密碼，可以直接Enter通過

下圖，如果要修改設定檔案

version: name: velociraptor version: 0.77.2 commit: c0c9dd609 build_time: "2026-08-10T01:03:30Z" compiler: go1.25.3 system: windows architecture: amd64 Client: server_urls: - https://localhost:8000/ ca_certificate: | -----BEGIN CERTIFICATE----- MIIDTDCCAjSgAwIBAgIRALrEXWp8RVj4E+luaSFVZVQwDQYJKoZIhvcNAQELBQAw GjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMB4XDTI2MDkwMjAyNDg1NFoXDTM2 MDgzMDAyNDg1NFowGjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMIIBIjANBgkq hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5OhVcgFUtkH3DLhdNQQQfIk854xl6OY/ 7xWzzAMwzMU1kpmuqtJO0WBvR48Y1QZ4d7Me5KR/75HiN+Hx+zDk6SBGX5IZLYNf 2NvHeONjmjWFhWPmoNj6KT2uN5F5mIjLmA8ujY9ySkl1E3E/mZmsIyq9mbsxio32 U52OX8+pu+PWHe8IhsvUjR73RgRIcuWl9IrgvWv4MXJwPJuGty0tMlowHUczlMw7 tJ86U+SaxOPRLQoIKvbjgjjSv/7YMysb4g24X4DRYaACKvJzGX2LuM69DuojOoSu z10IZ4Szp1EZZrjB1JxyLksXgtcYUAv1+waRGGdJu3xZRi1Q5BYcbQIDAQABo4GM MIGJMA4GA1UdDwEB/wQEAwICpDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH AwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUVYkRz7YxTckKWP8KJuDHgoMP zVAwKAYDVR0RBCEwH4IdVmVsb2NpcmFwdG9yX2NhLnZlbG9jaWRleC5jb20wDQYJ KoZIhvcNAQELBQADggEBAKcI9Pop70xRpzu2v9Hi5hQdSGQEAGqqXwjuVUrzlF6W Z+uFfFn5x4zOTU1tzxRG0a3uyePbPTGAJs0Jp4v/w7VX+pXs2H87k2ohBtdsAKGY ZWYMmReNURtNdm22Lo9h7nZ4C5v7Y/S00D3u1PxpQV4dYBbDA+4MgGV0SGqppMdi aldMPxyrfVk8PyuAZJq/rIPz4FGWKmf6dVqlKzmkcuRvtCrhv1sMyLVmn2z0QFK/ pIsfgRmF0LEMh1Vn3ouDZXsp7jTRjpyibSB2S2UTDKINXsmuDAk71iD0YWfEMuRL Prwgj5rwrY+smEUz+d/ElznxRAGqcl5O+kUxc3oim2k= -----END CERTIFICATE----- nonce: X67UA31K0vY= writeback_darwin: /etc/velociraptor.writeback.yaml writeback_linux: /etc/velociraptor.writeback.yaml writeback_windows: $ProgramFiles\Velociraptor\velociraptor.writeback.yaml level2_writeback_suffix: .bak tempdir_windows: $ProgramFiles\Velociraptor\Tools max_poll: 60 nanny_max_connection_delay: 600 windows_installer: service_name: Velociraptor install_path: $ProgramFiles\Velociraptor\Velociraptor.exe service_description: Velociraptor service darwin_installer: service_name: com.velocidex.velociraptor install_path: /usr/local/bin/velociraptor server_version: version: 0.77.2 commit: c0c9dd609 build_time: "2026-08-10T01:03:30Z" use_self_signed_ssl: true max_upload_size: 5242880 local_buffer: memory_size: 52428800 disk_size: 1073741824 filename_linux: /var/tmp/Velociraptor_Buffer.bin filename_windows: $TEMP/Velociraptor_Buffer.bin filename_darwin: /var/tmp/Velociraptor_Buffer.bin API: bind_address: 127.0.0.1 bind_port: 8001 bind_scheme: tcp GUI: bind_address: 127.0.0.1 bind_port: 8889 gw_certificate: | -----BEGIN CERTIFICATE----- MIIDQjCCAiqgAwIBAgIRAIDS/dSpcucP88AV4qgKP+gwDQYJKoZIhvcNAQELBQAw GjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMB4XDTI2MDkwMjAyNDg1NFoXDTM2 MDgzMDAyNDg1NFowKTEVMBMGA1UEChMMVmVsb2NpcmFwdG9yMRAwDgYDVQQDDAdH UlBDX0dXMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1UXYPvIsQsrL 6L4ME/kYaUX5XaBqjMil8i1aBK0U8Aw9ErCM/E1MTnRMj9GVzRjjsumOosZvbkyU tW5dOBqtuaN/2c0aISe0YQwlUY/tAHO2NOYML9JOgC8Qs+/W+iuR4X4zXJOSoNzv 4m86IfGpFH61v/O8kJTCYEkcSHJYZeybQhiHOSLaF+EAgj9yJqFDld9PoRr16LoS dAKIymazzs0hhYP69FAaBxzzQAk65sMXQ7vWpyCdEbtDqn4Puenn9dcJPlBVb2i9 YbQILi/gWU9jFju6tTeT/qUTGsKMrEiTB3g0SJrIZzEkg+J3VAD8luIU2UpHBmyW uldoHiJtQwIDAQABo3QwcjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYB BQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUVYkRz7Yx TckKWP8KJuDHgoMPzVAwEgYDVR0RBAswCYIHR1JQQ19HVzANBgkqhkiG9w0BAQsF AAOCAQEAYpXqwuJZFxAy1jiZvg05bdw753+vj/B/xCu5NH0UwTIjcMeHyaG4f8x4 NNhPiRVvGkQkxWavHDHQ3B9zc4cOIeBaGhLf1N3TPzy+uHXga/azDxAHCa+El68n 2N1wjtiVU7VA/nHUDTwlS2ZaVYY9sktAAfsQTxxP2k2gtggC7Erajk21HmmQAcyH 59V4xfvaSX0tQlWtkTuUcwAnAOiQPJsqDj/jSLDj3orzEt2GLvt5PYwtgS+GwCUS P8nCgeMy+rBPD3ZzRfzmx7oteZaHszU0eHmzAPLiKtLk6oh3rXRA2J2V8GG8N3aC kinJsVtlbjDxvPP65v3n18kTDAfT8A== -----END CERTIFICATE----- gw_private_key: | -----BEGIN RSA PRIVATE KEY----- MIIEogIBAAKCAQEA1UXYPvIsQsrL6L4ME/kYaUX5XaBqjMil8i1aBK0U8Aw9ErCM /E1MTnRMj9GVzRjjsumOosZvbkyUtW5dOBqtuaN/2c0aISe0YQwlUY/tAHO2NOYM L9JOgC8Qs+/W+iuR4X4zXJOSoNzv4m86IfGpFH61v/O8kJTCYEkcSHJYZeybQhiH OSLaF+EAgj9yJqFDld9PoRr16LoSdAKIymazzs0hhYP69FAaBxzzQAk65sMXQ7vW pyCdEbtDqn4Puenn9dcJPlBVb2i9YbQILi/gWU9jFju6tTeT/qUTGsKMrEiTB3g0 SJrIZzEkg+J3VAD8luIU2UpHBmyWuldoHiJtQwIDAQABAoIBAEqu3iZQvKIZDOWw I1+dI2i9+bBJG/a3zrCrI/IuP/49cueIDp7NXLK+dA8KyAfdtuKweePTVDMOOyb7 gkZCxWIT+JHnCkbg9f/j9m+E1GwLmRsWEd9vKFEn6hPwoVnShw+tF0RMYxTUuWYU KAm568kDBBc3PWltxlFcWLyf2ge6euDmiF+6901kZA/r2lhxIUuHgUAGRF8l20ke fPxQvI42C67FRFdnolWOQ5zqJnimX6fq3AyHfnfVf47nCqjNEQJslvTA1cZCu68b KHyDT97oJ2eVzjCcpTgpxcd2Qb6uWqAntaSBeyyKXqEU4mjebIBcHhFu2CYe17iY u6dl6B0CgYEA3tjene4Yn68HDGzoIxm6dGXQLIfDSuVAYtZps/zpw5UaiVRmSf8v WwQ/wyikvpw6WKML+PjVmg6p1t9ryKmXHgKIjd39Afmt8SsJrvt+JlADUQj4hDSE 8HLyDv+HSK13ou3oInAp83CxEeUJSqukn1AHiOGiBP5ho6l+W1PQWg8CgYEA9QBW YZW9nw/jgKjr82dfuHPEJR4iICK8BmxsS0aZpaN3r79eqAJloAmUA+Yt+9sFJBbz ixMCp8WtY4e6XWuEmnJ/4JYwe7j3RlbnqROYt/nNfIuUH0G8VCtcHqtRvY/9qP+N I2JacpCmVQ3g9e8w3JFsTawSi/d3dfbHgB6g/Y0CgYBgO4ze7GvLwVys2/be+YRQ MYtVP4dxN1C3ndnltOkJ4cCk30KQ39cGWe5jC5EhEvwLPNW1vVcYgQ6M0MyNydaN ShDIGr3gdX7M74Xt/4K5bsIP42zWQovJ/glTurskAmzwegZNoNws2VRN4vdBPKAJ gBjQ3ocF2wg1EcOUErydtwKBgCFq0V1wGjQW67YB1GUXxYOYLrnNWWQ+uJy7ry25 TH2+RTXwiU2rPgdNJyY9ACqpHhNlGgTvK96MZPD9c1sIrkaOtYiBk81cVkX+1oxG Qv9dED0boLF+utxUKbV5MqYDfNrPOIYKBUI5HqbdRMDmxihfoYEaplD3CRFK/r0n 8FeFAoGAdl3Nq9QVT0B+xAfovXm0fs1lDCvhKupEVfmByLYMTnLFCLFo3oKo2hxd b9OfUb7IeZnvXvbPc3vBzbZeYRqePW7CLWc4y5ft2A+SHcNmJCv/67Cppz3wP03s uIJ/hkNQFaThzHETQcTjL5WZCU38YA2kmdss3nhCumM7zLRti+g= -----END RSA PRIVATE KEY----- public_url: https://localhost:8889/app/index.html links: - text: Documentation url: https://docs.velociraptor.app/ icon_url: data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI1MyIgaGVpZ2h0PSI2MyIgdmVyc2lvbj0iMS4xIiB2aWV3Qm94PSIwIDAgNTMgNjMiPjxwYXRoIGQ9Ik0yNyAzYy0zIDItMTMgOC0yMyAxMGw2IDMyYTEwMyAxMDMgMCAwIDAgMTcgMTZsNi01IDExLTExIDYtMzJDMzkgMTEgMzAgNSAyNyAzeiIgZmlsbD0iI2ZmZiIgZmlsbC1ydWxlPSJldmVub2RkIi8+PHBhdGggZD0iTTI2IDBDMjMgMiAxMiA4IDAgMTBjMSA3IDUgMzIgNyAzNWExMTMgMTEzIDAgMCAwIDE5IDE4bDctNiAxMi0xMmMyLTMgNi0yOCA4LTM1QzQwIDggMjkgMiAyNiAwWm0wIDU1LTYtNC04LTktNS0yNnYtMWwyLTFjOC0xIDE2LTYgMTYtNmwxLTEgMSAxczggNSAxNyA2bDEgMXYxcy0zIDIzLTUgMjZsLTggOWMtMiAyLTQgNC02IDR6IiBmaWxsPSIjYWIwMDAwIiBmaWxsLW9wYWNpdHk9IjEiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjxwYXRoIGQ9Ik0zOSAxOWExMzQ3IDEzNDcgMCAwIDEtMTMgMjZoLTJMMTQgMTloM2wyIDEgMSAxdjFhMjUwIDI1MCAwIDAgMSA2IDE3IDUyODkgNTI4OSAwIDAgMCA5LTIwaDR6IiBmaWxsPSIjMDAwIiBmaWxsLXJ1bGU9ImV2ZW5vZGQiIHN0cm9rZT0iIzAwMCIgc3Ryb2tlLWRhc2hhcnJheT0ibm9uZSIgc3Ryb2tlLWxpbmVjYXA9ImJ1dHQiIHN0cm9rZS1saW5lam9pbj0ibWl0ZXIiIHN0cm9rZS13aWR0aD0iMSIvPjwvc3ZnPg== type: sidebar new_tab: true initial_users: - name: admin password_hash: cc13df84c2dd35e9b409138cb8912c8bf0bc3b4eda7fda11fdb08c60a7f134e7 password_salt: 518645ed9359fee7b2ba5484406bda0d81f7b8be0c0fe075d19a7b5b757ef5a5 authenticator: type: Basic CA: private_key: | -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEA5OhVcgFUtkH3DLhdNQQQfIk854xl6OY/7xWzzAMwzMU1kpmu qtJO0WBvR48Y1QZ4d7Me5KR/75HiN+Hx+zDk6SBGX5IZLYNf2NvHeONjmjWFhWPm oNj6KT2uN5F5mIjLmA8ujY9ySkl1E3E/mZmsIyq9mbsxio32U52OX8+pu+PWHe8I hsvUjR73RgRIcuWl9IrgvWv4MXJwPJuGty0tMlowHUczlMw7tJ86U+SaxOPRLQoI KvbjgjjSv/7YMysb4g24X4DRYaACKvJzGX2LuM69DuojOoSuz10IZ4Szp1EZZrjB 1JxyLksXgtcYUAv1+waRGGdJu3xZRi1Q5BYcbQIDAQABAoIBACeywlTL9crI/GUk mSePXaOXcmxOvULLobVfTGf6eq1cmzqiM/hUkk49/PaKUtpo7Z4GvroU7EoaQQMD iKGRXHWwvvumnP63bLkxfnHQ765oD1Cvn2jwUEw0MgFZlZ62RKbJpT9wK/hFrovx ZUAIdmG/8RNW81PN5HUiWzVzEILwv7Fi4aCBnsHOW0T0TBee33sHL3w8PH2fQ0XS EeWJuLTEOATkk6UIHXpFWRtvhMRgvUFxh1Y90XBxhIJrA+t4Qonwcal+MCHz91sB atn2Yhjhb23HjlobRSif9kJPpaLmzvxBf7ZcG6pDSKSC+jCcu4lTWjSB3jYKOCen S78ZTkECgYEA7ooEqY0PF5rKeTXthvUzs+VV0N+0Kdc0za3jFjmD7+XnMZs6Q7dm jjXx9ZSYFyxLtVF5TPQrh4dWSPdGYjvaoUC2HSLXeKq1v/Az6V2RLcmwtW3IKbAh 8CvmgjeUcpTmmvA3M0Z9zpKcmOuu+T39Qdk113OEonzAGNoU7QABci0CgYEA9anU Wop2zSST/yJZO9p7k5AfyydCRZAeHYNa6PfiRoctFFei05KOU81M1HiPXaPg4siq x4dKfaoDnwIx88deTvaeJJ9TJpWoDHRaowrTFpbuIyBL/uADS0eRmbQgkaZXpOSJ BjL+DV2vnI6vYMDqyq1Xce0BRP4duYTMo6We+0ECgYEAtifTU56STdY4k8MotYx9 hPy2QaDytZjPi9kjto8JP6Lyn6EIJzngKOzs7jogwmFjFv02ghtbOk2RCHs71jwa wlTmPO2kWVMTI5VMLwLyoGKKfKFu3tbPs9XyWrISvEUUrHCP1qoX3C19RBGGNnKt +SDjyrk+Kc7V6qRuomUEtakCgYA2IbL6NHKTJ5E48e+pwa3jSSnIUSFIRMZuCGi6 1wxUMCsdxWXKqwuTqbRZSSuGHbtLHZ6MEuK2KAVeP1SUfATq72rPdRAUe3upKuZh 8NusqZtVwCMeyWvQZbfOn6NhlL7RRc5vwEK83Tz6CXLZpgjWmjWfk/LoqfoQzBNv p+oNQQKBgQDYHvucRGrTG6DQtfYNhl2LUKhmwKM0aSDF2NB2rrUtwnNg5jor/WIE 7cH9rg9FuBvF6Xfy3BKXB0VpX9csEzdEVHrFWPlfJpyHfmpmM1ANoUDPVPma3S/b hizBK1RnyseirVelx5cl2ZhPM1W9Y6vhTCJQYnhhP4tQHaWEVi7PoQ== -----END RSA PRIVATE KEY----- Frontend: hostname: localhost bind_address: 0.0.0.0 bind_port: 8000 certificate: | -----BEGIN CERTIFICATE----- MIIDVzCCAj+gAwIBAgIQUNs2ryX1dxf3TmfZ79AT8jANBgkqhkiG9w0BAQsFADAa MRgwFgYDVQQKEw9WZWxvY2lyYXB0b3IgQ0EwHhcNMjYwOTAyMDI0ODU0WhcNMzYw ODMwMDI0ODU0WjA0MRUwEwYDVQQKEwxWZWxvY2lyYXB0b3IxGzAZBgNVBAMTElZl bG9jaXJhcHRvclNlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB APyL4VOSOSWOtVNp76efcnOQC93MlV8LWENXTg7EI4Q+61dDymy9+YVSKJBnezgj WOIiyGWPChzFQTF16ykT0vE/sdAoauD5v2AQPuGjHSNJ2HxeoHmvvBni3P8RW6Z0 sXWsr7I3oL4NKVLElECYFC+MEYaEm83WoRrVl/ouFLxO/L3RneeZrJtoPYLYKgLT m3KdaEYhtvAermlkEm9o+smWrtb6BRrF+Ev9RrBr8eZSFRrNffFYBbFrKjVgZTV5 pfpaa6Ztt6O3xpBZu0SLb4Igs//yWFn9oboPYH+3UeyRngiwfEu3GY7LlltQVz/v pcw4oISOlHWyRAb8G1VB8WECAwEAAaN/MH0wDgYDVR0PAQH/BAQDAgWgMB0GA1Ud JQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQY MBaAFFWJEc+2MU3JClj/Cibgx4KDD81QMB0GA1UdEQQWMBSCElZlbG9jaXJhcHRv clNlcnZlcjANBgkqhkiG9w0BAQsFAAOCAQEAleTJ8HHlvTepfigdqKKE79agfZWT Lrjyc0qkOoHBKTBibRaquPR8FRw5mynh5uM6m54ga+EpBCXRId0pnUOy7IlxJzX4 IWnA3ThzH5XkdY89PGlyXXaLLKBtr9toHHyx0hnObLviyIC2sPpjk/04SEtuzpq5 Fv7HZgQZqeum0sTS7O+X7p+EoBEElxqDUI207L7vvzR9qMRBwazPuq/svbQ0vWJL HWOvHxxJqVE/876x3XOduX/c5XtBrEPSf1TKEyidP2WxuaS37VGMtmYVH1m/gDK8 odEm5xDVCE1nXN9i88Jvm4BJOrLNZZDP9y8MrcR7aXyS94Tp6/sRPgVOhQ== -----END CERTIFICATE----- private_key: | -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEA/IvhU5I5JY61U2nvp59yc5AL3cyVXwtYQ1dODsQjhD7rV0PK bL35hVIokGd7OCNY4iLIZY8KHMVBMXXrKRPS8T+x0Chq4Pm/YBA+4aMdI0nYfF6g ea+8GeLc/xFbpnSxdayvsjegvg0pUsSUQJgUL4wRhoSbzdahGtWX+i4UvE78vdGd 55msm2g9gtgqAtObcp1oRiG28B6uaWQSb2j6yZau1voFGsX4S/1GsGvx5lIVGs19 8VgFsWsqNWBlNXml+lprpm23o7fGkFm7RItvgiCz//JYWf2hug9gf7dR7JGeCLB8 S7cZjsuWW1BXP++lzDighI6UdbJEBvwbVUHxYQIDAQABAoIBAAeD7VLtm28VOIBt f0jqGrklZKHO0Wwxcl4HL3sTaUmP7LRsO1sWIg0KSP69xqt4VhRlvetTgwxTmVaG Q6xO/2G+PX8uTDIQHrRamHnIWLj3LgHs738zzh5ka+dyMbl8G4LBGCSZbIUmAHOb 05N12YLc+wKqcfobFJbrcNGwtaHKwNFYSF7boE1PT0iWSRbcdMjm0MUI7jw3ugPO RLKeStO4NTx5vf0kyaLfLT6CN5fLNjLt1FJA81yZ6N9/Ht/wj18u1eQlMTrGvrQM hrki24BRzoTxPDuLH5Wcyddb2qsi0yTgDTzcVShuHRJyjs8VIU4Rf+QFFWz52Sks VKE6ZOkCgYEA/t3W77yTxKRW+FSHLUiIdZ6lRnHt1PNjP1y8MeeY4k7mkHnZBWZW yQuKBitBFkYx05iD1hJJ8R51ND/D7kW+qEWqtIthlozBddHFWdvw5tQU9izhis0H QSaT6NxDFsqUDFhzRqQeQd3gPy0qeDw3EBVwRuzbxTZSTBvko1tJRh8CgYEA/atm LeMXPP0oFbY9cfHege/rc5CY5Pgm1G3gZQIkwUiIH7WPW3S2itlK3Cc30D9x663C ODdFxPJjoGaRtGdlHLfGRjHeHIIhKIajxLBGwZlYL0LHADQwnY+irFoyNdb5VPYW 9AIEAQ2MICsQTSqDYXiZDDoystWMfiVsFMOC2H8CgYBBu+e+x215T0WbIPoIZOfF JljMVYAY53lWk016tZgJ7n2rD7I4oU+K5O4Bb1CHNS2OvIxsPyVRCiECi9u17ckh z24ayMQvtzgCcksrRP3aGyMY5zR4vy66z/9gFMc87pzGnl2E/7lKFbbLtJN6lVVC UbU2pcp9D+ij9qG+vEGm0wKBgQDis+2LkOpRvUW3sbjUPn7GzW41R8L8zrGVI+Vp IDNM8c+F1zMZXwNMr8lxWzNMT4c2Q4HRz8PwsVdMIJ6TBdydf7gZP7Pq8nlDyKBP xeJWXv8qrZk/m2TfS2Dse2doKomF3rDAvZRqhHr4vMPC0v27fJX7EYABx0vZ6QPg wqILbQKBgQCgdFhfm8eFnqA+yevabQXKXCSKlUCjOpPuXSEz66YpPqSjQiMCzsHr qDs1QhLZNcNC/pPTeZhnDDRLqu8lrgorZrbKvMEynqrkcad9H0thesZXbQREmBbZ X3jH3s8OwzF7wXxApHRvl/e4LoDDM/HixLvd0ibWmod4e2zT1PgJSQ== -----END RSA PRIVATE KEY----- default_client_monitoring_artifacts: - Generic.Client.Stats GRPC_pool_max_size: 100 GRPC_pool_max_wait: 60 resources: connections_per_second: 100 notifications_per_second: 30 max_upload_size: 104857600 expected_clients: 30000 Datastore: implementation: FileBaseDataStore location: /opt/velociraptor filestore_directory: /opt/velociraptor compression: zlib Logging: output_directory: /opt/velociraptor/logs separate_logs_per_component: true debug: disabled: true info: rotation_time: 604800 max_age: 31536000 error: rotation_time: 604800 max_age: 31536000 Monitoring: bind_address: 127.0.0.1 bind_port: 8003 api_config: {} obfuscation_nonce: J0Vrd60ffVE= defaults: hunt_expiry_hours: 168 notebook_cell_timeout_min: 10 security: certificate_validity_days: 3650

如果你要讓其他電腦的 Agent 連進來

Frontend: bind_address: 127.0.0.1

需要改成：

Frontend: bind_address: 0.0.0.0

GUI 也要允許遠端

GUI: bind_address: 127.0.0.1

需要改成：

GUI: bind_address: 0.0.0.0

測試設定檔案

cd /d C:\Velociraptor velociraptor.exe --config server.config.yaml frontend -v

結果

C:\velociraptor>velociraptor.exe --config server.config.yaml frontend -v [INFO] 2026-09-02T03:01:04Z _ __ __ _ __ [INFO] 2026-09-02T03:01:04Z | | / /__ / /___ _____(_)________ _____ / /_____ _____ [INFO] 2026-09-02T03:01:04Z | | / / _ \/ / __ \/ ___/ / ___/ __ `/ __ \/ __/ __ \/ ___/ [INFO] 2026-09-02T03:01:04Z | |/ / __/ / /_/ / /__/ / / / /_/ / /_/ / /_/ /_/ / / [INFO] 2026-09-02T03:01:04Z |___/\___/_/\____/\___/_/_/ \__,_/ .___/\__/\____/_/ [INFO] 2026-09-02T03:01:04Z /_/ [INFO] 2026-09-02T03:01:04Z Digging deeper! https://www.velocidex.com [INFO] 2026-09-02T03:01:04Z This is Velociraptor 0.77.2 built on 2026-08-10T01:03:30Z (c0c9dd609) [INFO] 2026-09-02T03:01:04Z Loading config from file server.config.yaml [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\Velociraptor [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorFrontend [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorClient [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorGUI [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\Velociraptor [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorAPI [INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorAudit [INFO] 2026-09-02T03:01:04Z Starting Frontend. {"build_time":"2026-08-10T01:03:30Z","commit":"c0c9dd609","version":"0.77.2"} [ERROR] 2026-09-02T03:01:04Z Unable to write to configured temp dir C:\Program Files\Velociraptor\Tools - falling back to C:\Users\ADMINI~1\AppData\Local\Temp [INFO] 2026-09-02T03:01:04Z Setting temp directory to C:\Users\ADMINI~1\AppData\Local\Temp [INFO] 2026-09-02T03:01:04Z Starting Org Manager service. [INFO] 2026-09-02T03:01:04Z Starting services for Org <root> (root) [INFO] 2026-09-02T03:01:04Z Frontend: Server will be master. [INFO] 2026-09-02T03:01:04Z Starting Backup Services for Org <root> (root) every 24h0m0s [INFO] 2026-09-02T03:01:04Z Filestore implementation FileBaseDataStore. [INFO] 2026-09-02T03:01:04Z Starting Journal service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z Starting user manager service for org root [INFO] 2026-09-02T03:01:04Z UserManagerService: Watching for events from Server.Internal.UserManager [INFO] 2026-09-02T03:01:04Z Starting Server Scheduler Service [INFO] 2026-09-02T03:01:04Z Starting the notification service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z NotificationService: Watching for events from Server.Internal.Ping [INFO] 2026-09-02T03:01:04Z NotificationService: Watching for events from Server.Internal.Pong [INFO] 2026-09-02T03:01:04Z NotificationService: Watching for events from Server.Internal.Notifications [INFO] 2026-09-02T03:01:04Z ClientInfo Manager Rebuilding snapshot for org Org <root> (root) from legacy records - this might take a while. [DEBUG] 2026-09-02T03:01:04Z ClientInfo Manager Rebuilt 0 clients from Legacy data. [INFO] 2026-09-02T03:01:04Z Starting Client Info service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from Server.Internal.ClientTasks [INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from Server.Internal.ClientScheduled [INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from Server.Internal.ClientPing [INFO] 2026-09-02T03:01:04Z InventoryService: Watching for events from Server.Internal.Inventory [INFO] 2026-09-02T03:01:04Z Starting Inventory Service for Org <root> (root) [INFO] 2026-09-02T03:01:04Z InventoryService: Reloading inventory from file for org root [INFO] 2026-09-02T03:01:04Z Starting repository manager for Org <root> (root) [INFO] 2026-09-02T03:01:04Z RepositoryManager: Watching for events from Server.Internal.ArtifactModification [INFO] 2026-09-02T03:01:04Z Loaded 421 built in artifacts in 119.298ms [INFO] 2026-09-02T03:01:04Z Loaded 0 custom artifacts in 0s [WARNING] 2026-09-02T11:01:04+08:00 Unable to store inventory - will run with an in memory one. [INFO] 2026-09-02T03:01:04Z Starting hunt manager service for Org <root> (root) with rate limit 30/s. [WARNING] 2026-09-02T11:01:04+08:00 Unable to store inventory - will run with an in memory one. [INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from Server.Internal.HuntModification [WARNING] 2026-09-02T11:01:04+08:00 Unable to store inventory - will run with an in memory one. [INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from System.Hunt.Participation [INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from Server.Internal.Label [INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from Server.Internal.Interrogation [INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z Starting Enrollment service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z InterrogationService for Generic.Client.Info/BasicInformation: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z InterrogationService for Custom.Generic.Client.Info/BasicInformation: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z InterrogationService: Watching for events from Server.Internal.Enrollment [INFO] 2026-09-02T03:01:04Z HuntDispatcher: Watching for events from Server.Internal.HuntUpdate [INFO] 2026-09-02T03:01:04Z Starting Hunt Dispatcher Service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z Starting Indexing Service for Org <root> (root). Refreshing every 5m0s [DEBUG] 2026-09-02T03:01:04Z Indexing service search index loaded 0 items in 0s [INFO] 2026-09-02T03:01:04Z Starting VFS writing service for Org <root> (root). [INFO] 2026-09-02T03:01:04Z VFSService for System.VFS.ListDirectory: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z VFSService for System.VFS.ListDirectory/Stats: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z VFSService for System.VFS.DownloadFile: Watching for events from System.Flow.Completion [INFO] 2026-09-02T03:01:04Z Labeler: Watching for events from Server.Internal.Label [INFO] 2026-09-02T03:01:04Z Starting Server Artifact Runner Service for Org <root> (root) [INFO] 2026-09-02T03:01:04Z Starting Label service. [INFO] 2026-09-02T03:01:04Z NotebookWorker: Connecting to master scheduler with worker local_notebook_1 [INFO] 2026-09-02T03:01:04Z NotebookWorker: Connecting to master scheduler with worker local_notebook_0 [INFO] 2026-09-02T03:01:04Z NotebookWorker: Connecting to master scheduler with worker local_notebook_2 [INFO] 2026-09-02T03:01:04Z NotebookWorker: Connecting to master scheduler with worker local_notebook_3 [INFO] 2026-09-02T03:01:04Z NotebookWorker: Connecting to master scheduler with worker local_notebook_4 [DEBUG] 2026-09-02T03:01:04Z Reloading client monitoring tables from datastore [INFO] 2026-09-02T03:01:04Z Starting Client Monitoring Service for Org <root> (root) [INFO] 2026-09-02T03:01:04Z Creating default Client Monitoring Service [INFO] 2026-09-02T03:01:04Z client_monitoring_service: Watching for events from Server.Internal.ArtifactModification [INFO] 2026-09-02T03:01:04Z client_monitoring_service: Watching for events from Server.Internal.MetadataModifications [DEBUG] 2026-09-02T03:01:04Z Query Stats: {"RowsScanned":0,"PluginsCalled":0,"FunctionsCalled":0,"ProtocolSearch":0,"ScopeCopy":0} [DEBUG] 2026-09-02T03:01:04Z Query Stats: {"RowsScanned":0,"PluginsCalled":0,"FunctionsCalled":0,"ProtocolSearch":0,"ScopeCopy":0} [DEBUG] 2026-09-02T03:01:04Z Query Stats: {"RowsScanned":0,"PluginsCalled":0,"FunctionsCalled":0,"ProtocolSearch":0,"ScopeCopy":0} [INFO] 2026-09-02T03:01:04Z Exiting notification service for Org <root> (root)! [INFO] 2026-09-02T03:01:04Z Stopping watch for System.VFS.DownloadFile for Org <root> (root) (VFSService) [INFO] 2026-09-02T03:01:04Z Stopping watch for System.VFS.ListDirectory for Org <root> (root) (VFSService) [INFO] 2026-09-02T03:01:04Z Stopping watch for System.VFS.ListDirectory/Stats for Org <root> (root) (VFSService) velociraptor.exe: error: frontend: starting frontend: mkdir \\?\\opt: The system cannot find the file specified. C:\velociraptor>

執行

velociraptor.exe --config C:\Velociraptor\server.config.yaml frontend

C:\velociraptor>velociraptor.exe --config C:\Velociraptor\server.config.yaml frontend [ERROR] 2026-09-02T03:03:15Z Unable to write to configured temp dir C:\Program Files\Velociraptor\Tools - falling back to C:\Users\ADMINI~1\AppData\Local\Temp velociraptor.exe: error: frontend: starting frontend: mkdir \\?\\opt: The system cannot find the file specified. C:\velociraptor>

失敗，待續

(待續)