初始访问 → 权限提升 → 定位备份系统 → 禁用/删除备份 → 凭据收割 → 横向扩展 → 部署勒索

# Veeam B&R — 检查 9380/9401 端口暴露
nuclei -u https://target:9401 -tags veeam
curl -sk "https://target:9401/" -o /dev/null -w "%{http_code}"

# Veeam VSPC — 检查管理接口可达性
nuclei -u https://target:1280 -tags veeam,vspc
curl -sk "https://target:1280/api/v1/endpoint" -o /dev/null -w "%{http_code}"

# Commvault — 检查 Web Console 版本和认证状态
nuclei -u https://target:443 -tags commvault
curl -sk "https://target/webconsole/api/login" -o /dev/null -w "%{http_code}"

# NetBackup — 检查 Web UI 端口
nuclei -u https://target:8443 -tags netbackup,veritas
curl -sk "https://target:8443/netbackup/login" -o /dev/null -w "%{http_code}"

# Acronis — 检查本地管理接口
nuclei -u https://target:9877 -tags acronis
curl -sk "https://target:9877/" -o /dev/null -w "%{http_code}"

# Rubrik — 检查管理 API
nuclei -u https://target -tags rubrik
curl -sk "https://target/api/v1/session" -o /dev/null -w "%{http_code}"

id: CVE-2023-27532

info:
  name: Veeam Backup & Replication Hardcoded Credentials
  author: security-research
  severity: critical
  description: Veeam Backup & Replication 硬编码凭据导致未授权管理访问
  tags: veeam,auth-bypass,cve,cve2023
  reference:
    - https://www.veeam.com/kb4441

http:
  - method: GET
    path:
      - "{{BaseURL}}:9401/api/v1/sessions"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "sessionId"
          - "Veeam"
        condition: and

id: CVE-2023-36632

info:
  name: Veeam Service Provider Console Command Injection
  author: security-research
  severity: critical
  description: Veeam VSPC REST API 命令注入导致远程代码执行
  tags: veeam,vspc,rce,cve,cve2023
  reference:
    - https://www.veeam.com/kb4473

http:
  - method: GET
    path:
      - "{{BaseURL}}:1280/api/v1/endpoint"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Veeam.ServiceProvider"
        part: body

id: CVE-2024-22033

info:
  name: Commvault Auth Bypass
  author: security-research
  severity: critical
  description: Commvault 认证中间件绕过导致未授权管理访问
  tags: commvault,auth-bypass,cve,cve2024
  reference:
    - https://documentation.commvault.com/security/bulletins

http:
  - method: GET
    path:
      - "{{BaseURL}}/webconsole/api/login"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Commvault"
          - "apiVersion"
        condition: and

id: veritas-netbackup-webui

info:
  name: Veritas NetBackup Web UI Detection
  author: security-research
  severity: info
  description: Veritas NetBackup Web 管理界面检测
  tags: veritas,netbackup,backup

http:
  - method: GET
    path:
      - "{{BaseURL}}:8443/netbackup/login"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "NetBackup"
          - "Veritas"
        condition: and

id: rubrik-admin-api

info:
  name: Rubrik Admin API Detection
  author: security-research
  severity: info
  description: Rubrik 备份平台管理 API 端点检测
  tags: rubrik,backup,api

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/session"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
          - 401
      - type: word
        words:
          - "rubrik"
        part: body

#!/usr/bin/env python3
"""backup_port_scanner.py — 备份产品管理端口扫描与服务识别"""

import socket
import argparse
import json
from concurrent.futures import ThreadPoolExecutor, as_completed

BACKUP_SIGNATURES = {
    9380:  {"product": "Veeam Backup & Replication", "service": "Veeam Backup Catalog", "risk": "critical"},
    9401:  {"product": "Veeam Backup & Replication", "service": "Veeam REST API",       "risk": "critical"},
    1280:  {"product": "Veeam Service Provider Console", "service": "VSPC Web API",     "risk": "critical"},
    81:    {"product": "Commvault", "service": "Commvault Agent / Galaxy",               "risk": "high"},
    802:   {"product": "Commvault", "service": "Commvault CommandCenter",                "risk": "high"},
    8443:  {"product": "Veritas NetBackup", "service": "NetBackup Web UI",               "risk": "high"},
    9877:  {"product": "Acronis Cyber Protect", "service": "Acronis Management Console", "risk": "high"},
    443:   {"product": "Rubrik / Dell PowerProtect", "service": "Management API",        "risk": "medium"},
    5671:  {"product": "RabbitMQ (Commvault 依赖)", "service": "AMQP",                   "risk": "medium"},
    5432:  {"product": "PostgreSQL (Veeam 内部数据库)", "service": "Database",            "risk": "high"},
    1433:  {"product": "SQL Server (Veeam 内部数据库)", "service": "Database",            "risk": "high"},
}

def scan_port(host, port, timeout=2):
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(timeout)
        result = sock.connect_ex((host, port))
        sock.close()
        return port, result == 0
    except Exception:
        return port, False

def probe_http_banner(host, port, timeout=2):
    import http.client
    try:
        conn = http.client.HTTPSConnection(host, port, timeout=timeout, context=__import__("ssl")._create_unverified_context())
        conn.request("GET", "/")
        resp = conn.getresponse()
        server = resp.getheader("Server", "")
        body_snippet = resp.read(512).decode("utf-8", errors="ignore")
        return server, body_snippet
    except Exception:
        try:
            conn = http.client.HTTPConnection(host, port, timeout=timeout)
            conn.request("GET", "/")
            resp = conn.getresponse()
            server = resp.getheader("Server", "")
            body_snippet = resp.read(512).decode("utf-8", errors="ignore")
            return server, body_snippet
        except Exception:
            return "", ""

def scan_host(host, ports=None, timeout=2):
    if ports is None:
        ports = list(BACKUP_SIGNATURES.keys())
    results = []
    with ThreadPoolExecutor(max_workers=20) as pool:
        futures = {pool.submit(scan_port, host, p, timeout): p for p in ports}
        for f in as_completed(futures):
            port, is_open = f.result()
            if is_open:
                info = BACKUP_SIGNATURES.get(port, {"product": "Unknown", "service": "Unknown", "risk": "unknown"})
                banner, body = probe_http_banner(host, port, timeout)
                results.append({
                    "host": host,
                    "port": port,
                    "product": info["product"],
                    "service": info["service"],
                    "risk": info["risk"],
                    "banner": banner,
                    "body_snippet": body[:200],
                })
    return results

def main():
    parser = argparse.ArgumentParser(description="Backup Product Port Scanner")
    parser.add_argument("targets", nargs="+", help="Target IP / CIDR / hostname")
    parser.add_argument("--timeout", type=int, default=2, help="Connection timeout (seconds)")
    parser.add_argument("--output", help="Output JSON file path")
    args = parser.parse_args()

    all_results = []
    for target in args.targets:
        print(f"[*] Scanning {target} ...")
        hits = scan_host(target, timeout=args.timeout)
        for h in hits:
            risk_tag = f"[{h['risk'].upper()}]" if h['risk'] != 'unknown' else ""
            print(f"  {risk_tag} {h['port']}/tcp  {h['product']}  ({h['service']})")
        all_results.extend(hits)

    if args.output:
        with open(args.output, "w") as f:
            json.dump(all_results, f, indent=2, ensure_ascii=False)
        print(f"\n[+] Results saved to {args.output}")

    print(f"\n[+] Scan complete: {len(all_results)} backup service(s) found")

if __name__ == "__main__":
    main()

python3 backup_port_scanner.py 192.168.1.0/24 --timeout 3 --output scan_results.json
python3 backup_port_scanner.py 10.0.0.5 10.0.0.12 --output multi_host.json

#!/usr/bin/env python3
"""veeam_cve_2023_27532_checker.py — Veeam 硬编码凭据未授权访问检测"""

import argparse
import json
import ssl
import http.client
import sys

KNOWN_VEEAM_ENDPOINTS = [
    {"path": "/api/v1/sessions",       "method": "GET", "indicator": "sessionId",   "desc": "REST API session endpoint"},
    {"path": "/api/v1/oauth/token",    "method": "POST", "indicator": "access_token", "desc": "OAuth token endpoint"},
    {"path": "/v1/token",              "method": "POST", "indicator": "token",       "desc": "Legacy token endpoint"},
]

def check_veeam_instance(host, port=9401, timeout=5):
    results = []
    ctx = ssl._create_unverified_context()

    for ep in KNOWN_VEEAM_ENDPOINTS:
        try:
            if port in (443, 8443, 9401):
                conn = http.client.HTTPSConnection(host, port, timeout=timeout, context=ctx)
            else:
                conn = http.client.HTTPConnection(host, port, timeout=timeout)

            headers = {"Content-Type": "application/json"}
            conn.request(ep["method"], ep["path"], headers=headers)
            resp = conn.getresponse()
            status = resp.status
            body = resp.read(2048).decode("utf-8", errors="ignore")

            is_vulnerable = status == 200 and ep["indicator"].lower() in body.lower()

            results.append({
                "host": host,
                "port": port,
                "endpoint": ep["path"],
                "method": ep["method"],
                "status_code": status,
                "indicator_found": is_vulnerable,
                "description": ep["desc"],
                "response_snippet": body[:300],
            })

            conn.close()
        except Exception as e:
            results.append({
                "host": host,
                "port": port,
                "endpoint": ep["path"],
                "error": str(e),
            })

    return results

def assess_risk(results):
    vulnerable_count = sum(1 for r in results if r.get("indicator_found"))
    if vulnerable_count > 0:
        return "CRITICAL", "Veeam management API accessible without authentication — CVE-2023-27532 likely exploitable"
    reachable = sum(1 for r in results if r.get("status_code") and r["status_code"] in (401, 403))
    if reachable > 0:
        return "HIGH", "Veeam API reachable but requires authentication — verify patch level"
    return "INFO", "Veeam API not reachable or not responding as expected"

def main():
    parser = argparse.ArgumentParser(description="Veeam CVE-2023-27532 Checker")
    parser.add_argument("hosts", nargs="+", help="Target host(s)")
    parser.add_argument("--port", type=int, default=9401, help="Veeam API port (default: 9401)")
    parser.add_argument("--timeout", type=int, default=5)
    parser.add_argument("--output", help="Output JSON file")
    args = parser.parse_args()

    all_results = []
    for host in args.hosts:
        print(f"[*] Checking {host}:{args.port} ...")
        results = check_veeam_instance(host, args.port, args.timeout)
        risk_level, risk_msg = assess_risk(results)
        print(f"  [{risk_level}] {risk_msg}")
        for r in results:
            if r.get("indicator_found"):
                print(f"    -> Indicator '{r.get('endpoint')}' returned 200 with session data")
        all_results.extend(results)

    if args.output:
        with open(args.output, "w") as f:
            json.dump(all_results, f, indent=2, ensure_ascii=False)
        print(f"\n[+] Results saved to {args.output}")

if __name__ == "__main__":
    main()

python3 veeam_cve_2023_27532_checker.py 10.0.0.5 --port 9401 --output veeam_check.json
python3 veeam_cve_2023_27532_checker.py 10.0.0.5 10.0.0.12 10.0.0.20

#!/usr/bin/env python3
"""backup_log_analyzer.py — 备份系统日志异常分析"""

import re
import argparse
import json
from datetime import datetime
from collections import defaultdict

SUSPICIOUS_PATTERNS = {
    "backup_job_disabled": {
        "pattern": re.compile(r"(?:disable|stop|suspend|remove|delete).*(?:backup|job|task|policy|protection)", re.I),
        "severity": "CRITICAL",
        "description": "Backup job or protection policy was disabled/removed",
    },
    "backup_deleted": {
        "pattern": re.compile(r"(?:delete|remove|purge|overwrite|destroy).*(?:backup|snapshot|restore point|replica|copy)", re.I),
        "severity": "CRITICAL",
        "description": "Backup data / restore point was deleted or overwritten",
    },
    "credential_access": {
        "pattern": re.compile(r"(?:read|extract|export|decrypt|retrieve).*(?:credential|password|key|secret|token|certificate)", re.I),
        "severity": "CRITICAL",
        "description": "Credential or secret read/extract operation detected",
    },
    "admin_login_offhours": {
        "pattern": re.compile(r"(?:login|logon|authenticated|session started).*(?:admin|root|system|operator)", re.I),
        "severity": "HIGH",
        "description": "Administrative login detected — verify time and source",
    },
    "new_agent_registered": {
        "pattern": re.compile(r"(?:register|add|install).*(?:agent|proxy|gateway|node)", re.I),
        "severity": "HIGH",
        "description": "New backup agent or proxy registered — potential lateral movement",
    },
    "retention_changed": {
        "pattern": re.compile(r"(?:modify|change|update|set).*(?:retention|preserve|immutable|protection period)", re.I),
        "severity": "HIGH",
        "description": "Backup retention or immutability policy was modified",
    },
    "config_export": {
        "pattern": re.compile(r"(?:export|download|dump).*(?:config|database|catalog|inventory)", re.I),
        "severity": "MEDIUM",
        "description": "Configuration or catalog export detected",
    },
    "service_stopped": {
        "pattern": re.compile(r"(?:stop|kill|terminate).*(?:service|daemon|process|veeam|commvault|netbackup)", re.I),
        "severity": "HIGH",
        "description": "Backup service was stopped or terminated",
    },
}

OFF_HOURS_START = 22
OFF_HOURS_END = 6

def parse_log_line(line, source_file=""):
    findings = []
    line = line.strip()
    if not line:
        return findings

    timestamp = None
    ts_match = re.match(r"(\d{4}[-/]\d{2}[-/]\d{2}[\sT]\d{2}:\d{2}:\d{2})", line)
    if ts_match:
        try:
            timestamp = datetime.fromisoformat(ts_match.group(1).replace("T", " "))
        except ValueError:
            pass

    for key, rule in SUSPICIOUS_PATTERNS.items():
        if rule["pattern"].search(line):
            is_offhours = False
            if timestamp and (timestamp.hour >= OFF_HOURS_START or timestamp.hour < OFF_HOURS_END):
                is_offhours = True

            findings.append({
                "rule": key,
                "severity": rule["severity"],
                "description": rule["description"],
                "timestamp": timestamp.isoformat() if timestamp else None,
                "off_hours": is_offhours,
                "raw_line": line[:500],
                "source": source_file,
            })
    return findings

def analyze_log_file(filepath):
    findings = []
    try:
        with open(filepath, "r", errors="ignore") as f:
            for line_no, line in enumerate(f, 1):
                for finding in parse_log_line(line, filepath):
                    finding["line_number"] = line_no
                    findings.append(finding)
    except Exception as e:
        print(f"[!] Error reading {filepath}: {e}")
    return findings

def generate_summary(findings):
    summary = defaultdict(int)
    severity_count = defaultdict(int)
    for f in findings:
        summary[f["rule"]] += 1
        severity_count[f["severity"]] += 1
    return dict(summary), dict(severity_count)

def main():
    parser = argparse.ArgumentParser(description="Backup System Log Analyzer")
    parser.add_argument("log_files", nargs="+", help="Log file(s) to analyze")
    parser.add_argument("--output", help="Output JSON report file")
    parser.add_argument("--severity", choices=["CRITICAL", "HIGH", "MEDIUM"], help="Filter by minimum severity")
    args = parser.parse_args()

    severity_order = {"CRITICAL": 3, "HIGH": 2, "MEDIUM": 1}
    all_findings = []

    for filepath in args.log_files:
        print(f"[*] Analyzing {filepath} ...")
        findings = analyze_log_file(filepath)
        if args.severity:
            min_level = severity_order.get(args.severity, 0)
            findings = [f for f in findings if severity_order.get(f["severity"], 0) >= min_level]
        print(f"  Found {len(findings)} suspicious event(s)")
        all_findings.extend(findings)

    rule_summary, severity_summary = generate_summary(all_findings)

    print(f"\n{'='*60}")
    print(f"  BACKUP LOG ANALYSIS REPORT")
    print(f"{'='*60}")
    print(f"  Total suspicious events: {len(all_findings)}")
    print(f"\n  Severity breakdown:")
    for sev in ["CRITICAL", "HIGH", "MEDIUM"]:
        if sev in severity_summary:
            print(f"    {sev}: {severity_summary[sev]}")
    print(f"\n  Rule breakdown:")
    for rule, count in sorted(rule_summary.items(), key=lambda x: -x[1]):
        print(f"    {rule}: {count}")

    offhours = [f for f in all_findings if f.get("off_hours")]
    if offhours:
        print(f"\n  [!] {len(offhours)} event(s) occurred during off-hours (22:00-06:00)")

    critical = [f for f in all_findings if f["severity"] == "CRITICAL"]
    if critical:
        print(f"\n  Top CRITICAL events:")
        for c in critical[:10]:
            ts = c.get("timestamp", "N/A")
            print(f"    [{ts}] {c['description']}")
            print(f"      -> {c['raw_line'][:120]}")

    if args.output:
        report = {
            "total_findings": len(all_findings),
            "severity_summary": severity_summary,
            "rule_summary": rule_summary,
            "off_hours_count": len(offhours),
            "findings": all_findings,
        }
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2, ensure_ascii=False)
        print(f"\n[+] Full report saved to {args.output}")

if __name__ == "__main__":
    main()

python3 backup_log_analyzer.py /var/log/veeam/veeam_backup.log --output report.json
python3 backup_log_analyzer.py veeam.log commvault.log --severity CRITICAL

#!/usr/bin/env python3
"""backup_integrity_checker.py — 备份文件完整性快速校验"""

import os
import hashlib
import json
import argparse
import struct
from datetime import datetime

VEEAM_VBK_MAGIC = b"\x40\x12\x63\x76"
SQL_DUMP_SIGNATURES = [
    b"-- MySQL dump",
    b"-- PostgreSQL database dump",
    b"-- MariaDB dump",
    b"CREATE TABLE",
    b"INSERT INTO",
]

def file_hash(filepath, algorithm="sha256", chunk_size=65536):
    h = hashlib.new(algorithm)
    try:
        with open(filepath, "rb") as f:
            while True:
                chunk = f.read(chunk_size)
                if not chunk:
                    break
                h.update(chunk)
        return h.hexdigest()
    except Exception as e:
        return f"ERROR: {e}"

def check_file_integrity(filepath):
    result = {
        "file": filepath,
        "exists": False,
        "size": 0,
        "modified": None,
        "created": None,
        "hash_sha256": None,
        "hash_md5": None,
        "file_type": "unknown",
        "anomalies": [],
    }

    if not os.path.exists(filepath):
        result["anomalies"].append("File does not exist")
        return result

    stat = os.stat(filepath)
    result["exists"] = True
    result["size"] = stat.st_size
    result["modified"] = datetime.fromtimestamp(stat.st_mtime).isoformat()
    result["created"] = datetime.fromtimestamp(stat.st_ctime).isoformat()
    result["hash_sha256"] = file_hash(filepath, "sha256")
    result["hash_md5"] = file_hash(filepath, "md5")

    ext = os.path.splitext(filepath)[1].lower()
    result["file_type"] = ext

    if result["size"] == 0:
        result["anomalies"].append("File is empty (0 bytes) — possible data wipe")

    if ext in (".vbk", ".vib", ".vrb") and result["size"] > 0:
        try:
            with open(filepath, "rb") as f:
                header = f.read(4)
            if header != VEEAM_VBK_MAGIC:
                result["anomalies"].append(f"Veeam file header mismatch — expected magic {VEEAM_VBK_MAGIC.hex()}, got {header.hex()} — possible tampering")
        except Exception:
            pass

    if ext in (".sql", ".dump", ".bak"):
        try:
            with open(filepath, "rb") as f:
                head = f.read(4096)
            matched = any(sig in head for sig in SQL_DUMP_SIGNATURES)
            if not matched and result["size"] > 1024:
                result["anomalies"].append("SQL dump file does not contain expected dump signatures — may be corrupted or repurposed")
        except Exception:
            pass

    if ext in (".zip", ".7z", ".rar", ".tar", ".gz"):
        if result["size"] < 22:
            result["anomalies"].append("Archive file suspiciously small — possibly truncated or placeholder")

    return result

def scan_backup_directory(dirpath, extensions=None):
    if extensions is None:
        extensions = {".vbk", ".vib", ".vrb", ".sql", ".dump", ".csv", ".bak",
                      ".zip", ".7z", ".rar", ".tar", ".gz", ".cab", ".iso"}
    results = []
    for root, dirs, files in os.walk(dirpath):
        for fname in files:
            ext = os.path.splitext(fname)[1].lower()
            if ext in extensions:
                fpath = os.path.join(root, fname)
                results.append(check_file_integrity(fpath))
    return results

def main():
    parser = argparse.ArgumentParser(description="Backup Integrity Checker")
    parser.add_argument("paths", nargs="+", help="File(s) or director(ies) to check")
    parser.add_argument("--output", help="Output JSON report file")
    parser.add_argument("--baseline", help="Baseline JSON file for comparison")
    args = parser.parse_args()

    all_results = []
    for path in args.paths:
        if os.path.isdir(path):
            print(f"[*] Scanning directory: {path}")
            results = scan_backup_directory(path)
            all_results.extend(results)
        elif os.path.isfile(path):
            print(f"[*] Checking file: {path}")
            all_results.append(check_file_integrity(path))
        else:
            print(f"[!] Path not found: {path}")

    anomaly_count = 0
    for r in all_results:
        status = "ANOMALY" if r["anomalies"] else "OK"
        if r["anomalies"]:
            anomaly_count += len(r["anomalies"])
        size_mb = r["size"] / (1024 * 1024) if r["size"] else 0
        print(f"  [{status}] {r['file']}  ({size_mb:.1f} MB, {r['file_type']})")
        for a in r["anomalies"]:
            print(f"    -> {a}")

    if args.baseline and os.path.exists(args.baseline):
        print(f"\n[*] Comparing against baseline: {args.baseline}")
        with open(args.baseline, "r") as f:
            baseline = json.load(f)
        baseline_map = {b["file"]: b for b in baseline if isinstance(b, dict)}
        for r in all_results:
            old = baseline_map.get(r["file"])
            if old and old.get("hash_sha256") and r.get("hash_sha256"):
                if old["hash_sha256"] != r["hash_sha256"]:
                    print(f"  [CHANGED] {r['file']} — hash mismatch since baseline")
                    print(f"    baseline: {old['hash_sha256'][:16]}...")
                    print(f"    current:  {r['hash_sha256'][:16]}...")

    print(f"\n[+] Check complete: {len(all_results)} file(s), {anomaly_count} anomaly(ies)")

    if args.output:
        with open(args.output, "w") as f:
            json.dump(all_results, f, indent=2, ensure_ascii=False)
        print(f"[+] Report saved to {args.output}")

if __name__ == "__main__":
    main()

python3 backup_integrity_checker.py /var/backup/ --output integrity_report.json
python3 backup_integrity_checker.py /mnt/backup/veeam/ --baseline previous_scan.json

攻击入口：已知硬编码凭据（公开披露）
     ↓
连接备份管理数据库（无需前端认证）
     ↓
获得完整管理控制台权限
     ↓
禁用备份 / 删除副本 / 提取凭据

攻击入口：Web API 命令注入点
     ↓
以备份服务进程权限执行任意命令
     ↓
获取操作系统级访问
     ↓
直接操作备份存储 / 修改配置 / 安装后门

攻击入口：认证中间件逻辑缺陷
     ↓
构造特殊请求绕过认证检查
     ↓
以管理员身份访问管理 API
     ↓
查看所有受保护资产 / 修改策略 / 提取数据

攻击前提：已获得备份服务器本地访问
     ↓
定位内部加密密钥存储
     ↓
使用密钥解密备份数据库中的凭据
     ↓
获取所有受保护系统的管理凭据
     ↓
全域横向移动

攻击前提：已获得备份代理所在主机的普通用户访问
     ↓
利用本地权限提升缺陷获取 SYSTEM/root
     ↓
以最高权限控制备份代理
     ↓
通过管理通道影响备份作业和数据

攻击前提：已获得备份系统认证访问
     ↓
调用存在信息泄露缺陷的 API
     ↓
获取备份拓扑、受保护资产清单、凭据元数据
     ↓
基于完整拓扑信息规划后续攻击路径